MyloBot goes USB: the botnet that crawls towards the production line

In a factory, a USB drive is not a gadget. It is how a recipe reaches a machine, how a PLC project reaches the line and how a maintenance technician brings an update to a system that has never seen the internet. That habit makes removable media one of the most reliable ways into an industrial company, and attackers know it.

In October 2026 Fortgale MDR stopped, at a European manufacturing company, a new variant of MyloBot that spreads exactly this way. A botnet active since 2017 has turned into a self-replicating worm, built on fresh infrastructure that it shares with other criminal families. The attempt was blocked before any damage. The lesson is broader than the sample: the same door that lets a botnet in can let in the operators who stop production.

This analysis starts with the risk for industrial companies, then explains how the threat evolved, and closes with the technical details, the MITRE ATT&CK mapping, the indicators of compromise and what to do first.

▸ 1.1  Where removable media still rule

Plants, warehouses and remote sites run on systems that are deliberately kept apart from the corporate network. Data still has to reach them, and the USB drive is the simplest way. Contractors arrive with their own drives. The same drive can touch an office laptop, an engineering workstation and an operator panel in a single shift, quietly bridging networks that were designed to stay separate.

Many of those machines run operating systems that the vendor no longer supports, because the line was certified on that version and an upgrade means stopping production. Many have no modern endpoint protection, because agents are not allowed on validated or vendor-managed systems. On such a host, an attack does not need a sophisticated exploit. It needs one person to open the wrong file.

Exposure	Why it matters
USB as the normal data path to segmented or isolated systems	The attack reaches the first host without touching the network
Drives shared between office, engineering and production	A single drive bridges IT and OT
Obsolete, unpatched systems on operator panels and engineering stations	No exploit is needed, and modern defences are missing
No endpoint detection on validated or vendor-managed machines	The infection runs unseen
Third-party technicians with their own media	The attack surface includes suppliers you do not control

▸ 1.2  From one click to a stopped line

A botnet infection rarely ends with the botnet. Infected machines are a commodity: criminal groups rent them, sell the access they provide, or use them to deliver other malware. The variant we analysed is built to download and run a new payload every half hour, and the operator can change that payload at any time. Whoever controls the server decides what an infected machine becomes next.

In an industrial company, the most expensive answer to that question is ransomware. Initial access bought from a botnet or a loader is a common starting point for ransomware operations, and in manufacturing the impact is not only encrypted files. It is a line that stops, orders that are not delivered, safety systems that must be checked before restart, and a recovery measured in days.

This is not an isolated event. In June 2025 Fortgale MDR already blocked a MyloBot-related executable launched from an external device on a monitored workstation. The removable drive is not a legacy risk. It is an active one.

▸ 2.1  From proxy botnet to worm

For most of its life MyloBot has been a quiet Windows botnet. Public research (Bitsight, 2023) tied it to a residential proxy business, in which infected machines are rented out as exit nodes: the victim does not see a ransom note, but its IP address becomes someone else’s disguise. MyloBot used to arrive through droppers and other malware.

The new variant adds what public reporting on the family does not describe: a module that copies itself to removable drives and waits for the next user. The botnet no longer needs someone to deliver it. It moves on its own, from drive to machine to drive.

▸ 2.2  Criminals share their tools

The server that feeds this variant is not used by MyloBot alone. Samples of two other families, a historic USB worm and a banking trojan, contact the same address. Hosting, distribution and access are services in today’s criminal economy, and an infrastructure built for one group quickly becomes a delivery channel for others. Defending against a single sample is not enough: what matters is the infrastructure, and what it will deliver next.

▸ 3.1  One click on a shortcut

The user sees a USB drive with a single shortcut (.lnk) named like a folder. The real content sits in a hidden numeric folder (<drive>:\31\). Opening the shortcut runs cmd.exe /V /c with a long, delayed-expansion command line that does three things at once: it starts 31\2da6.exe, opens a folder with the same name as the shortcut as a decoy, and registers a scheduled task. The user asked for a folder and got one.

▸ 3.2  A downloader made of Windows parts

The scheduled task runs every 33 minutes. It uses conhost --headless to hide the console window and curl -k -L -Ss to download http://b.aivtes[.]net/b/b.gif into a randomly named .exe under %TEMP%, then executes it. The file is a GIF only by name. Everything after the first click is living-off-the-land: no dropper is needed to keep the infection fed, and the payload behind the URL can change at any time.

▸ 3.3  A small stub with a big suitcase

The sample reached our lab the way samples always do: a zip inside a zip, both locked with the password the whole industry knows by heart, infected. Inside was 2da6.exe, 428,724 bytes, unknown to VirusTotal at the time of analysis.

On paper it is a modest x86 executable, compiled on 10 September 2026, with the PDB path D:\Songs\bin\release\stub.pdb (the developer, it seems, keeps malware in the music folder). Three tiny sections, a single imported DLL, a handful of KERNEL32 functions. The real luggage travels outside the PE image: an overlay that starts at offset 0x1800, takes up 98.6% of the file and has an entropy of 7.7, which is what encrypted data looks like.

The imports tell the rest of the story. GetModuleFileNameA, CreateFileA and ReadFile: the stub reads its own file to fetch the overlay. CreateProcessA, VirtualAllocEx, WriteProcessMemory, GetThreadContext and ResumeThread, plus NtUnmapViewOfSection and NtSetContextThread resolved at runtime through GetProcAddress: the textbook recipe for process hollowing. Start a process suspended, empty it, fill it with the payload, point the thread at the new entry point, resume. Nothing new under the sun, but it keeps working.

▸ 3.4  The key was kept next to the lock

The overlay is XOR-encrypted, and not with a single byte: no one-byte key turns its first two bytes into MZ. Comparing the head of the overlay with a standard DOS header gave a keystream with no period, a sign that the executable does not start at offset zero. Counting how often a byte repeats at distance n over the first 20,000 bytes gave clean peaks at 64, 128, 192 and 256: a 64-byte repeating key.

The usual shortcut, assuming that the most frequent byte at each position hides a zero, failed as well: the plaintext is compressed and zeros are rare. So we looked in the most obvious place. Among the strings of the stub there is exactly one printable string 64 characters long, at RVA 0x1038. Of its 64 rotations, rotation 48 produced the most reassuring sentence in Windows history, This program cannot be run in DOS mode, within the first 4 KB. The key had been stored right next to the lock it opens.

XOR key	Value
As stored in the stub (RVA 0x1038)	XRb0 <VQDj55B)0%.:'o\[Ce>z2Kc!x]D;":^>n1hkIL47XWXA.yZ)5ESRjB\JUY
Effective from overlay offset 0 (rotation 48)	XA.yZ)5ESRjB\JUYXRb0 <VQDj55B)0%.:'o\[Ce>z2Kc!x]D;":^>n1hkIL47XW

▸ 3.5  Decrypted, but not yet unpacked

Decryption does not hand over a ready-to-run executable. The plaintext opens with a 22-byte header whose DWORD at offset 16 declares an image size of 975,872 bytes, more than twice the 422,558 bytes that follow. Those bytes start with MZ and the DOS stub, but are full of interleaved control bytes: pefile rejects them and the entropy is still 6.9. It is a PE image compressed with an LZ-family algorithm, which the stub expands in memory before the hollowing. We have not identified the algorithm yet. Matryoshka dolls, but for malware.

▸ 3.6  What the strings give away

LZ compression leaves most literals intact, so even a compressed blob talks if you scan it for strings. This one had plenty to say.

The USB module, as a template. The same schtasks /create … /mo 33 command line seen on the LNK, with conhost --headless and the download from b.aivtes. The top-level domain is split into a variable (!n!=net) and curl is spelled c^url: cmd ignores the caret, a rule looking for the word “curl” does not. Fake-moustache obfuscation, but enough to slip past a naive string match. Since the template lives inside the binary, writing the lure to new drives is a feature of the malware, not the work of an operator at the keyboard.

Persistence and anti-analysis. A Run key (Software\Microsoft\Windows\CurrentVersion\Run) and a list of things the bot would rather not meet: qemu, vmware, VirtualBox, virtual hd and, more curiously, teamviewer.exe and tv_w32. A remote support session on the host is apparently treated as a sign that someone is watching.

The HTTP client. A User-Agent dressed up as Edge on Chrome 143, form-urlencoded requests, and reads from SOFTWARE\Microsoft\Windows NT\CurrentVersion compatible with DigitalProductId and InstallDate, probably to fingerprint the host and build the bot ID (inferred from partial strings).

▸ 3.7  Why this is MyloBot

At offset 0x60b0 of the compressed stage sits GD!brWJJBeTgTGSgEFB/quRcfCkBHWg, followed by one byte that a compression token has pushed aside. The full 32-byte key, GD!brWJJBeTgTGSgEFB/quRcfCkBHWgl, is the AES key documented for the MyloBot downloader (Bitsight, 2023). The final l was confirmed the empirical way: with it, decryption returns readable text. Right after the key come 33 uppercase hex strings.

Decrypted with AES-256 in ECB mode, no IV (a choice for those who value simplicity over secrecy), 26 of the 33 strings turn into command-and-control entries in the typical MyloBot format: seven random lowercase letters, .cyou (one .shop) and a non-standard port. The other seven were mangled by compression tokens and stayed silent. Only two entries arrive with a port that is certainly complete, pbfxxzh[.]cyou:7399 and qefqazb[.]cyou:1584: for the other 24 the plaintext ends exactly at the 16-byte block boundary, so the port may be missing a digit. The delivery is new. The core is the same.

In this case the EDR blocked the execution: the scheduled task was not created and the host was not infected. The same lure, on a host without a modern agent, would have completed every step.

▸ 4.1  A domain born four days after the stub

aivtes[.]net was registered on 14 September 2026, four days after the stub was compiled, through the NicNames registrar and behind Cloudflare DNS. b.aivtes[.]net serves the scheduled-task payload, and c.aivtes[.]net resolves to 45.59.103[.]111 (AS18450, WebNX, United States). This is fresh infrastructure, set up for this campaign and not a recycled MyloBot server.

▸ 4.2  One IP, three criminal families

The same IP is contacted by other samples. One is detected as MyloBot, downloads http://45.59.103[.]111/p.exe and talks to buy1.aiend[.]top, registered through the same registrar on 12 September 2026. Others belong to NgrBot/Dorkbot, itself a historic USB and messaging worm, and to Qadars, a banking trojan. Three families with different histories and goals meet on one distribution server.

▸ 5.1  MITRE ATT&CK mapping

Tactic	Technique	ID
Initial Access	Replication Through Removable Media (USB drive with LNK lure)	T1091
Lateral Movement	Replication Through Removable Media (module that rewrites the lure on new drives)	T1091
Execution	User Execution: Malicious File (LNK shortcut at the drive root)	T1204.002
Execution	Command and Scripting Interpreter: Windows Command Shell (cmd.exe /V /c)	T1059.003
Persistence	Scheduled Task/Job: Scheduled Task (every 33 minutes)	T1053.005
Persistence	Boot or Logon Autostart Execution: Registry Run Keys	T1547.001
Defense Evasion	Process Injection: Process Hollowing	T1055.012
Defense Evasion	Obfuscated Files or Information: Encrypted/Encoded File (XOR overlay, AES config)	T1027.013
Defense Evasion	Obfuscated Files or Information: Software Packing (stub with compressed payload in the overlay)	T1027.002
Defense Evasion	Obfuscated Files or Information: Command Obfuscation (c^url, top-level domain in a variable)	T1027.010
Defense Evasion	Deobfuscate/Decode Files or Information	T1140
Defense Evasion	Masquerading: Masquerade File Type (b.gif executable)	T1036.008
Defense Evasion	Hide Artifacts: Hidden Window (conhost --headless)	T1564.003
Defense Evasion / Discovery	Virtualization/Sandbox Evasion: System Checks	T1497.001
Command and Control	Ingress Tool Transfer (curl -k -L -Ss)	T1105
Command and Control	Application Layer Protocol: Web Protocols	T1071.001
Command and Control	Proxy (infected host rented as residential proxy)	T1090

The mapping is our reconstruction from the sample analysis and the observed command line, at high confidence for execution, persistence and evasion. T1090 reflects the documented purpose of MyloBot; we did not observe proxy traffic, because the chain was stopped before the bot came online.

▸ 5.2  Indicators of Compromise

Indicator (defanged)	Type	Role
51528cb1fa4d41c25aab289f58346932305e957c7fc1a370282e71e3abff6fb8	SHA-256	MyloBot USB loader / stub (2da6.exe, 428,724 bytes)
c17213d97c9cd4dccdb2034598a52cf1	MD5	MyloBot USB loader / stub
da8068cb315f4ced5d4f14905447e34cf764d75f	SHA-1	MyloBot USB loader / stub
54f24774187bd048261f1d14185dd25d	imphash	MyloBot USB loader / stub
d519e9d59d9929b5b2330239ae1f963879de569c307f4fa73c640ac611c00015	SHA-256	MyloBot second stage, compressed (XOR-decrypted overlay without its 22-byte header). Does not match the in-memory image
f726409773da91514bb256dcfcf6d80b	MD5	Same compressed blob
f906da5187f702b0206c4ba1549a1bac3b8a49397a5ab9f12efa2cb7e4a09418	SHA-256	MyloBot sample on the same infrastructure (downloads p.exe)
<drive>:\31\2da6.exe	Path	Hidden payload launched by the LNK lure at the drive root
D:\Songs\bin\release\stub.pdb	PDB path	Loader build artefact
hxxp://b.aivtes[.]net/b/b.gif	URL	Scheduled-task payload download
aivtes[.]net · b.aivtes[.]net · c.aivtes[.]net	Domain	Distribution infrastructure (registered 2026-09-14)
45.59.103[.]111	IPv4	Distribution server (AS18450 WebNX), shared by several families
hxxp://45.59.103[.]111/p.exe · buy1.aiend[.]top	URL / Domain	MyloBot payload delivery (registered 2026-09-12)
asigxxg[.]cyou · braffoz[.]cyou · dqofcuu[.]cyou · eirjuyp[.]cyou · ejfezik[.]cyou · fizmhel[.]cyou · fkhkkfd[.]cyou · ikpxzcu[.]cyou · nbpeqak[.]cyou · nccalhb[.]cyou · pbfxxzh[.]cyou · pugkhpl[.]cyou · pytlbzt[.]cyou · qefqazb[.]cyou · rooetlk[.]cyou · sqibsne[.]cyou · sxlxfgg[.]cyou · tgzjomt[.]shop · tyuyoxf[.]cyou · tzahhad[.]cyou · uncgdnd[.]cyou · uortwpz[.]cyou · upqoewg[.]cyou · wcllajq[.]cyou · whqizla[.]cyou · xhxbpmf[.]cyou	Domain	MyloBot C2 pool decrypted from the second stage. Confirmed ports: pbfxxzh 7399, qefqazb 1584; the others may be truncated
03577caaceba8c0a86c7cfbd067310fd95ab710c0cf877c3fcc46da462df6672	SHA-256	NgrBot/Dorkbot sample contacting 45.59.103[.]111 (correlation only)
53fb041a5e7b9e90505cee66f909e5e5bf3d65079ec0b4e357c2013e3557593f	SHA-256	NgrBot/Dorkbot sample contacting 45.59.103[.]111 (correlation only)
e3e4fdd6d5b1ec1bc23c0fe36692bd3a18148274c3107f3264e636beb746b98f	SHA-256	Qadars sample contacting 45.59.103[.]111 (correlation only)
dd0d004c16617c06e40a740da9936371110c47707190e0331a49ae368209ff1c	SHA-256	NgrBot/Dorkbot sample contacting 45.59.103[.]111 (correlation only)

Indicators are integrated into the Fortgale Intelligence Feed and will be updated as the infrastructure evolves. For the full indicator set, or to check exposure across your plants, contact us at info@fortgale.com.

Immediate. Block the indicators above at proxy, DNS and EDR level, starting with aivtes[.]net, 45.59.103[.]111 and the .cyou C2 pool. Hunt for scheduled tasks that run conhost with --headless or call curl towards a .gif URL, and for executables with random names in user %TEMP% folders. Look for LNK files at the root of removable drives next to numeric folders such as \31\.

Short term. Block execution from removable media by policy (Windows Defender ASR rule Block untrusted and unsigned processes that run from USB, or the equivalent EDR device-control setting), disable AutoRun/AutoPlay, and show file extensions on every workstation. Alert on cmd.exe started by explorer.exe with a command line that references a removable drive, and on curl.exe spawned by the Task Scheduler.

Structural. Treat removable media in OT as a controlled data path, not a convenience. Use dedicated, scanned transfer drives or a kiosk station between IT and OT, keep an inventory of legacy hosts that cannot run an EDR, and isolate them with network segmentation and application allow-listing. Contractors’ drives are part of the attack surface: scan them before they touch a production machine. Finally, prepare for the worst case: offline backups of engineering projects and PLC programs, and a tested plan to restart the line if a ransomware operator gets in through the same door.

A cyber attack is not something. It is someone. MyloBot is a clean illustration: the code is nine years old, but the people behind it keep adding new ways in, and they share their infrastructure with other criminals who do the same. The USB drive in a plant is where those choices meet an obsolete, unprotected machine, and where a botnet infection can become the first step towards a stopped production line.

Knowing the adversary is the first act of defence. Stopping them in time is the second.

Talk to our analysts about removable-media exposure across your European plants, or request a threat briefing on MyloBot and its indicators.