TheMoon, an IoT botnet targeting home routers and modems, is entering a new phase. It has added a previously undocumented module that allows it to be sold as-a-service to other malicious actors. TheMoon is a modular botnet active since 2014, which targets vulnerabilities in residential routers within broadband networks. It can be used maliciously to circumnavigate internet filtering or obscure the source of internet traffic, allowing the botnet author to sell its proxy network as a service to others.
Source: https://threatpost.com/themoon-botnet-as-a-service/141393/