MalwarePublished 3 Sep 2025Updated 3 Oct 2025

Dissecting RapperBot Botnet: From Infection to DDoS & More

Source AlienVault OTX General

Description

This report details the analysis of RapperBot, a sophisticated botnet targeting IoT devices, particularly Network Video Recorders (NVRs). The malware exploits vulnerabilities in these devices to create a large-scale DDoS infrastructure. The analysis covers the botnet's infection process, command and control mechanisms, and its evolution over time. Key features include the use of NFS for malware distribution, encrypted DNS TXT records for C2 communication, and a wide range of supported device architectures. The report also discusses recent law enforcement actions against the botnet and provides recommendations for protection against such threats.

Impact

For European organizations, RapperBot poses a significant risk primarily through its ability to conscript vulnerable IoT devices into DDoS attacks, which can disrupt critical services and infrastructure. Organizations relying on NVRs for security surveillance, especially in sectors like transportation, manufacturing, retail, and public safety, may face service outages or degraded performance due to DDoS attacks launched from infected devices. The botnet’s use of encrypted DNS TXT records for C2 communication complicates detection and mitigation efforts, potentially allowing prolonged infection periods. Additionally, the widespread support for multiple device architectures means that a broad range of IoT devices deployed across Europe could be vulnerable, increasing the attack surface. The disruption caused by DDoS attacks can lead to financial losses, reputational damage, and operational downtime. Moreover, the infection of surveillance devices could indirectly impact physical security monitoring capabilities. While the botnet itself does not appear to exfiltrate sensitive data, the compromise of IoT devices undermines network integrity and could serve as a foothold for further attacks.

Defensive guidance

European organizations should implement targeted measures beyond generic IoT security advice. First, conduct comprehensive asset inventories to identify all NVRs and IoT devices on the network, including their firmware versions and architectures. Prioritize patching or upgrading devices to the latest firmware that addresses known vulnerabilities exploited by RapperBot. Where patches are unavailable, consider network segmentation to isolate vulnerable devices from critical infrastructure and limit lateral movement. Deploy DNS monitoring solutions capable of detecting anomalous or encrypted TXT record queries indicative of C2 communication. Implement strict egress filtering to restrict unauthorized outbound DNS traffic from IoT devices. Utilize network intrusion detection systems (NIDS) tuned to detect NFS traffic anomalies, as NFS is leveraged for malware distribution. Employ behavioral analytics to identify unusual device activity patterns consistent with botnet infection, such as unexpected network scanning or high-volume outbound traffic. Collaborate with ISPs and security vendors to share threat intelligence and participate in coordinated takedown efforts. Finally, enforce strong authentication and disable unnecessary services on IoT devices to reduce exploitation risk.

Indicators of compromise

Domains 34

bignum.bit
eicp.byxwgimpbwiskniw.info
eicp.byxwgimpbwiskniw.live
eicp.gaihwstpzuomtfnu.info
eicp.gaihwstpzuomtfnu.live
eicp.gwyhhcorybwjwuzh.info
eicp.gwyhhcorybwjwuzh.live
eicp.zkuafimfdwvetxjq.info
eicp.zkuafimfdwvetxjq.live
kdxa.byxwgimpbwiskniw.info

URLs 2

http://185.218.87.28
http://77.90.153.136/ss/armv4l

IP addresses 19

185.218.87.28
185.218.87.29
104.194.9.127
154.81.156.55
185.224.3.231
185.36.81.60
188.92.28.62
192.145.28.71
194.226.121.51
45.89.63.25

Hashes 101

01008691cc1cb4fe2deafd19b02931a8
02ce3715eee7a45765b52c3d1e44daa7
04b562b0b1448c173178d894a7cc7d1b
05fedc7678aec8685f9ae2f0af2f8f93
1550b889a9a674de6f7221567d973fad
1b8e9d1a08a206ef07471588b9b32696
353e2a752a3f73dfa858f57f54353f7a
367243961c9e36b030d9df39a4636817
41ed814b686f25a3d8bc1820762d5515
4fbb5c5a0cfeb4132d1cac1d9efb6279

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Sep 2025, 06:36 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details