Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers