---
id: 6192
title: "Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2"
source_domain: hunt.io
source_url: "https://hunt.io/blog/iran-botnet-operation-open-directory"
published_at: "2026-03-17T00:00:00Z"
tags: ["threat-intelligence", "malware", "botnet", "ddos", "iran", "relay-network", "tls-pivoting", "censorship-bypass"]
phying_url: "https://phying.com/item/6192"
lang: en
---

# Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2

## Summary

A TLS certificate exposed a 15-node Iranian relay network: the operator compiled DDoS bots on victims, deployed them via 500-session SSH scripts, and ran censorship-bypass tunnels on the same hosts.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-03-17T00:00:00Z
- **Original:** https://hunt.io/blog/iran-botnet-operation-open-directory
- **Phying News:** https://phying.com/item/6192