An open directory on a server in the Netherlands exposed the full operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by the adversary Tadashi. This botnet provides commercial DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. It compromises over 4 million IoT devices by exploiting the Android Debug Bridge (ADB) service listening on TCP port 5555, affecting devices such as Android TV boxes, smart TVs, and routers. The botnet features bandwidth profiling to tier infected devices for pricing, employs ChaCha20 encryption with cryptographic weaknesses, and includes routines to remove competing malware. The entire operation is hosted within a single bulletproof /24 netblock in the Netherlands, which also contains cryptojacking infrastructure. There is no indication of official patches or fixes, and no known exploits in the wild have been reported.

The botnet enables attackers to launch distributed denial-of-service (DDoS) attacks against game servers and Minecraft hosts, potentially disrupting service availability. By compromising over 4 million IoT devices, it leverages significant scale for attacks. The exploitation of ADB on TCP/5555 indicates that devices with exposed or unsecured ADB services are at risk. The use of weak encryption and competitor-eradication routines suggests ongoing attempts to maintain control over infected devices and maximize botnet effectiveness. The presence of cryptojacking infrastructure alongside the botnet indicates additional malicious activity on the same infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the botnet exploits exposed Android Debug Bridge (ADB) services on TCP port 5555, it is recommended to disable or secure ADB on IoT devices and ensure that these devices are not exposed to the internet without proper access controls. Network administrators should block or monitor traffic to TCP port 5555 where possible. Given the lack of an official fix and the scale of infected devices, device owners should verify firmware updates from device manufacturers and apply them if available. Monitoring for unusual outbound traffic patterns consistent with DDoS activity may help detect infections. No urgent patch is currently available, so mitigation focuses on reducing exposure and securing vulnerable devices.