The Hoaxcalls Botnet has been developing a new family of botnets since at least August 2019. Operators have used 12 different exploits since March 2020 for the purpose of propagating their malware and infecting more devices. While the number seems impressive, not every attempt was a successful or fruitful one. Exploits do not guarantee additional devices. They can fail for one reason of another due to competition due to oversaturation or a limited number of devices to target or oversaturation. The operators have also seemed to be favoring the Netlink GPON Router 1.0.11 RCE and the Symantec Web Gateway 5.2.2″]
Source: https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/