Quad7 Activity

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. (Citation: Bitsight 7777 Botnet) (Citation: Microsoft Storm-0940) The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner <code>xlogin</code>. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying <code>alogin</code>. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. (Citation: Bitsight 7777 Botnet)(Citation: Medium 777-Botnet) Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities. (Citation: Microsoft Storm-0940)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2023-08-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2023-08-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2025-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1685 · Disable or Modify Tools

  Defense Impairment — Quad7 Activity has disabled the TP-Link management interface for TP-Link by killing the <code>/usr/bin/httpd</code> process.(Citation: Sekoia 7777 Botnet JUL 2024)(Citation: Microsoft Storm-0940)(Citation: Bitsight 7777 Botnet)

• T1665 · Hide Infrastructure

  Command And Control — Quad7 Activity has rotated the compromised SOHO IPs used in password spraying activity to hamper detection and network blocking activities by defenders.(Citation: Microsoft Storm-0940)

• T1584.008 · Network Devices

  Resource Development — Quad7 Activity has compromised network devices, such as IP cameras, Network Attached Storage (NAS) devices, and SOHO routers, to leverage for follow-on activity.(Citation: Microsoft Storm-0940)(Citation: Sekoia 7777 Botnet JUL 2024)

• T1071.002 · File Transfer Protocols

  Command And Control — Quad7 Activity has used a File Transfer Protocol (FTP) server to download malicious binaries.(Citation: Microsoft Storm-0940)

• T1071.001 · Web Protocols

  Command And Control — Quad7 Activity has used the same User Agents of <code>Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko</code> and <code>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36</code> combined with a reference to the Microsoft Azure PowerShell Application ID <code>1950a258-227b-4e31-a9cf-717495945fc2</code> in their sign-in attempts.(Citation: Microsoft Storm-0940)

• T1589.002 · Email Addresses

  Reconnaissance — Quad7 Activity has gathered targeted individual’s e-mail addresses for the password spraying attempts.(Citation: Medium 777-Botnet)

• T1190 · Exploit Public-Facing Application

  Initial Access — Quad7 Activity has enabled the exploitation of vulnerabilities for remote code execution capabilities in SOHO routers including CVE-2023-50224 and CVE-2025-9377 in TP-Link devices.(Citation: Microsoft Storm-0940)(Citation: TP-Link Quad 7 AUG 2025)

• T1090.002 · External Proxy

  Command And Control — Quad7 Activity has initialized SOCKS5 proxies on compromised devices.(Citation: Microsoft Storm-0940)(Citation: Bitsight 7777 Botnet)

• T1110.003 · Password Spraying

  Credential Access — Quad7 Activity has conducted a throttled variant of password spraying techniques that only utilized a single attempt to sign in within a 24-hour time period, eluding brute force detection thresholds.(Citation: Microsoft Storm-0940)

• T1090.003 · Multi-hop Proxy

  Command And Control — Quad7 Activity has routed traffic through chains of compromised network devices for password spray attacks.(Citation: Microsoft Storm-0940)

• T1571 · Non-Standard Port

  Command And Control — Quad7 Activity has used non-standard TCP ports – such as 7777, 11288, 63256, 63210, 3256, and 3556 for C2.(Citation: Microsoft Storm-0940)(Citation: Sekoia 7777 Botnet JUL 2024)

• T1105 · Ingress Tool Transfer

  Command And Control — Quad7 Activity has downloaded additional binaries from a remote File Transfer Protocol (FTP) server to compromised devices.(Citation: Microsoft Storm-0940)

• T1027.011 · Fileless Storage

  Stealth — Quad7 Activity has infected victim network devices by storing artifacts in the <code>/tmp</code> directory which is volatile in memory and will clear its contents upon shutdown or restart.(Citation: Bitsight 7777 Botnet)

• T1059.004 · Unix Shell

  Execution — Quad7 Activity has enabled the creation of an access-controlled command shell <code>/bin/sh</code> on compromised routers.(Citation: Microsoft Storm-0940)(Citation: Bitsight 7777 Botnet)

• T1584.005 · Botnet

  Resource Development — Quad7 Activity has compromised various branded SOHO routers to form a botnet that has been leveraged in password spraying activity.(Citation: Bitsight 7777 Botnet)(Citation: Microsoft Storm-0940)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0055

  Official MITRE ATT&CK campaign record C0055. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.