Qbot, also known as Bashlite, is one of the most widely known IoT Botnet frameworks, and is often stated as a precursor of Mirai. We recently observed that Bug 60281 (or the Nbot loader bug) is weaponized and freely being shared in hacking forums. We predicted that with the simplicity and effectiveness of the bug, it can easily be adopted in other botnets. In the decompiled code, we can see the exact implementation of Nbotloader to get credentials and run its payload via arbitrary code execution.”]