360Netlab Anglerfish system monitored attacker using two Tenda router 0-day vulnerabilities to spread a Remote Access Trojan (RAT) based on Mirai code. In addition to DDoS attacks, it implements 12 remote access functions such as Socket5 proxy for router devices, tampering with router DNS, setting iptables, executing custom system commands. At the C2 communication level, it uses the WSS (WebSocket over TLS) protocol, and it also provides secure encrypted communication for C2.”]