AT-GS950 Gigabit Ethernet WebSmart Switch is getting exploited in the wild.
i have found several IoT devices to be compromised of this same variant
First found ips to be compromised:
12.196.184.34
14.142.209.198
182.72.167.124
190.108.63.242
200.123.251.66
211.192.113.231