Threats tagged 'botnet'

A newly discovered Rust-based DDoS botnet exploits exposed Docker APIs on port 2375 to recruit compromised hosts. The malware uses asynchronous Rust libraries and obfuscation techniques to evade detection, with no antivirus engines initially detecting it. Its command-and-control (C2) protocol is weakly secured, lacking encryption and using predictable nonces and hardcoded credentials. The botnet infrastructure is centralized on a single server, which serves both malware distribution and C2 functions. The researcher developed a honeypot that impersonates infected bots to monitor ongoing DDoS targets in real time. This threat highlights the risks of exposed Docker APIs and the challenges traditional detection tools face with modern Rust-based malware. European organizations running Docker with exposed APIs are at risk of compromise and subsequent participation in DDoS attacks. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and deployment of custom detection rules based on provided YARA and Snort signatures. Countries with high Docker adoption and significant internet infrastructure are most likely affected. The threat is assessed as medium severity due to moderate impact and exploitation complexity but notable evasion capabilities.

Malware#netsec#redditGermany+7

The Kimwolf Android botnet is a large-scale malware campaign infecting millions of devices globally, leveraging compromised Android smartphones to conduct distributed denial-of-service (DDoS) attacks. It propagates primarily through malicious apps or phishing, gaining control over devices without user consent. Once infected, devices become part of a botnet that can be remotely commanded to flood targets with traffic, disrupting services. Although no known exploits or patches are currently documented, the botnet's scale and use of mobile devices pose significant risks to network stability and data privacy. European organizations relying heavily on mobile infrastructure or with public-facing services are at risk of service disruption and indirect attacks. Mitigation requires proactive mobile device management, network traffic monitoring for anomalies, and user education to prevent infection. Countries with high Android usage and significant digital infrastructure, such as Germany, France, and the UK, are most likely to be affected. Given the widespread infection potential and impact on availability, but with no direct exploitation of vulnerabilities or authentication bypass, the threat severity is assessed as high. Defenders should prioritize detection of unusual outbound traffic from mobile devices and enforce strict app vetting policies.

Malware#infosecnews#redditGermany+6

The Kimwolf botnet has compromised approximately 1.8 million Android TV devices globally, leveraging them to conduct large-scale distributed denial-of-service (DDoS) attacks. This botnet exploits vulnerabilities in Android TV platforms to gain control without requiring user interaction or authentication. The hijacked devices are then orchestrated to flood targeted networks with traffic, disrupting services and causing outages. European organizations relying on Android TV infrastructure or connected smart devices may face increased risk of service disruption and collateral damage from these attacks. The botnet's scale and use of consumer IoT devices make mitigation challenging, requiring coordinated efforts between device manufacturers, network operators, and end users. Countries with high adoption rates of Android TV and significant digital infrastructure are particularly vulnerable. Immediate mitigation involves network-level traffic filtering, device firmware updates, and enhanced monitoring for unusual traffic patterns. Given the ease of exploitation and broad impact, this threat is assessed as high severity for affected entities in Europe.

Botnet#infosecnews#redditGermany+7

The Broadside botnet is a malware campaign targeting TBK brand DVR devices, raising concerns particularly for maritime logistics sectors that rely on these devices. This botnet infects vulnerable DVRs to conscript them into a larger network of compromised devices, potentially enabling distributed denial-of-service (DDoS) attacks or other malicious activities. Although no known exploits are currently active in the wild, the threat is considered medium severity due to the potential impact on maritime operations and critical infrastructure. The botnet's focus on TBK DVRs, which are commonly used in maritime logistics for surveillance and monitoring, highlights a strategic targeting of supply chain and port security systems. European organizations involved in maritime transport and port operations could face operational disruptions and data confidentiality risks if infected. Mitigation requires targeted actions such as network segmentation of DVR devices, strict access controls, firmware updates where available, and enhanced monitoring for unusual network traffic patterns. Countries with significant maritime trade and port infrastructure, such as the Netherlands, Germany, Belgium, Spain, and Italy, are most likely to be affected. Given the medium severity, the threat demands proactive defense measures but does not currently indicate widespread exploitation or critical system compromise. Defenders should prioritize securing TBK DVR devices and related maritime logistics systems to prevent botnet infiltration and potential service disruptions.

Malware#infosecnews#redditNetherlands+6

A critical remote code execution vulnerability (CVE-2025-6389) in the Sneeit Framework WordPress plugin is actively exploited in the wild, allowing unauthenticated attackers to execute code on affected servers. This can lead to the creation of malicious admin accounts or backdoors. Simultaneously, an ICTBroadcast vulnerability (CVE-2025-2611) is being exploited to spread the Frost DDoS botnet, which incorporates exploits for multiple CVEs. The attacks are part of a small, targeted campaign against a limited number of vulnerable internet-exposed systems.

A high-severity remote code execution (RCE) vulnerability affecting the Sneeit WordPress plugin is being actively exploited in the wild. Concurrently, a separate bug in ICTBroadcast is being leveraged to fuel Frost botnet attacks. The Sneeit RCE allows attackers to execute arbitrary code on vulnerable WordPress sites, potentially leading to full system compromise. The ICTBroadcast flaw facilitates botnet expansion and command-and-control activities. European organizations running WordPress sites with the Sneeit plugin or using ICTBroadcast software are at risk of compromise, data breaches, and service disruption. No official patches or CVSS scores are currently available, but the threat is considered high due to ease of exploitation and potential impact. Mitigation requires immediate identification and isolation of vulnerable systems, enhanced monitoring for suspicious activity, and applying any forthcoming vendor updates. Countries with large WordPress user bases and ICTBroadcast deployments, such as Germany, France, and the UK, are particularly at risk. The threat landscape is evolving rapidly, necessitating proactive defensive measures to prevent botnet proliferation and RCE exploitation.

Vulnerability#infosecnews#redditGermany+2

The Aisuru botnet recently launched the largest recorded DDoS attack, peaking at 29.7 Tbps, which was successfully mitigated by Cloudflare. This attack represents a significant escalation in volumetric DDoS capabilities, leveraging a large network of compromised devices to overwhelm targeted infrastructure. While no specific vulnerabilities or exploits were involved, the scale and sophistication of the botnet pose a serious threat to internet-facing services. European organizations, especially those with critical online infrastructure, could face service disruptions if targeted. Mitigation requires advanced DDoS protection services, network traffic filtering, and incident response preparedness. Countries with high internet infrastructure density and strategic digital assets, such as Germany, the UK, France, and the Netherlands, are likely to be primary targets. Given the attack's scale, ease of execution via botnet control, and potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize robust DDoS defenses and continuous monitoring to mitigate impact from similar future attacks.

Campaign#infosecnews#redditGermany+6

This threat describes a novel approach to detecting and mitigating Layer 7 (L7) Distributed Denial of Service (DDoS) attacks and bot traffic using ClickHouse analytics combined with Tempesta FW, an open-source HTTP reverse proxy and firewall. Traditional L7 mitigation techniques relying on challenges or static rules are increasingly ineffective against modern botnets using impersonation libraries and proxy networks. The solution collects access logs in real time from Tempesta FW and uses WebShield, a Python daemon, to analyze traffic spikes, classify clients, and automatically block malicious actors based on IP, TLS, or HTTP fingerprints. This method enables near real-time detection and mitigation of sophisticated multi-thousand-IP botnets without relying on user challenges. The approach is particularly relevant for organizations facing advanced botnet threats and requiring scalable, automated L7 defense mechanisms.

Botnet#netsec#redditGermany+7

The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.

Campaign#infosecnews#redditGermany+7

The Meatmeet BBQ Probe is a Bluetooth Low Energy (BLE) enabled smart BBQ thermometer device that has been demonstrated to be vulnerable to hacking, enabling the creation of a BLE-based botnet. This botnet leverages compromised BBQ probes to form a network of devices that can be remotely controlled or manipulated. The threat was recently discussed on Reddit's NetSec community and detailed on softwaresecured.com, highlighting the potential for IoT devices with BLE connectivity to be co-opted into botnets. While no known exploits are currently active in the wild, the medium severity rating reflects the risk posed by the widespread use of such consumer IoT devices and the potential for abuse in distributed denial-of-service (DDoS) attacks or other malicious activities. European organizations using or connected to these devices could face risks related to network congestion, data integrity, and unauthorized device control. Mitigation requires securing BLE communications, firmware updates, and network segmentation to prevent lateral movement. Countries with high consumer adoption of smart home and IoT devices, such as Germany, the UK, France, and the Netherlands, are more likely to be affected due to market penetration and historical targeting of IoT botnets in these regions. Given the ease of exploitation via BLE and the potential for widespread impact, the suggested severity is medium.

Botnet#netsec#redditGermany+5

The ShadowV2 botnet malware recently leveraged an AWS outage as a testing ground for its operations, indicating opportunistic behavior by threat actors to exploit cloud service disruptions. This malware represents a high-severity threat due to its botnet capabilities, which can facilitate large-scale distributed attacks, data exfiltration, or service disruption. Although detailed technical specifics and affected versions are not disclosed, the malware's use of a major cloud provider outage highlights its potential to exploit infrastructure instability. European organizations relying on AWS or interconnected cloud services may face increased risk from such botnets, especially during service interruptions. Mitigation requires enhanced monitoring during cloud outages, network segmentation, and proactive threat hunting to detect botnet activity. Countries with significant AWS usage and critical cloud-dependent infrastructure, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the malware's botnet nature, ease of exploitation during outages, and potential for widespread impact, the threat severity is assessed as high. Defenders should prioritize detection capabilities for anomalous traffic patterns and ensure incident response plans account for cloud service disruptions exploited by malware.

Malware#infosecnews#redditGermany+5

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

Malware#ethereum#123 stealerGermany+6

The Tsundere Botnet is a high-severity threat targeting Windows systems, expanding its reach by leveraging game-related lures and employing an innovative Ethereum blockchain-based command and control (C2) infrastructure. This botnet uses social engineering tactics centered around popular gaming to entice victims into executing malicious payloads, while its use of Ethereum for C2 communications complicates detection and takedown efforts. Although no known exploits are currently active in the wild, the botnet's architecture suggests a sophisticated and resilient threat capable of evading traditional security controls. European organizations, particularly those with significant gaming communities or Windows-based infrastructure, face risks including data theft, resource hijacking, and potential disruption of services. Mitigation requires targeted user awareness campaigns about gaming lure tactics, enhanced network monitoring for blockchain-based C2 traffic, and deployment of endpoint detection tools tuned to identify unusual behaviors associated with this botnet. Countries with large gaming markets and advanced IT sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the botnet's potential impact on confidentiality, integrity, and availability, combined with ease of exploitation through social engineering and no authentication barriers, the threat severity is assessed as high. Defenders should prioritize proactive detection and user education to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+7

ShadowRay 2.0 is a newly identified botnet that exploits an unpatched vulnerability in Ray, a GPU-accelerated computing framework, to propagate itself and perform unauthorized cryptomining. The botnet leverages this flaw to spread autonomously across vulnerable systems without requiring user interaction or authentication. Although no known exploits in the wild have been confirmed yet, the threat is considered high due to the potential for widespread GPU resource hijacking and the strain it can place on organizational infrastructure. European organizations using GPU-accelerated applications or services based on Ray are at risk, especially those in sectors with high GPU utilization such as research, finance, and media. Mitigation is complicated by the absence of an official patch, necessitating proactive network segmentation, monitoring for unusual GPU usage, and restricting access to vulnerable services. Countries with significant technology sectors and high adoption of GPU computing, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation, the broad impact on confidentiality, integrity, and availability, and the self-spreading nature of the botnet, the suggested severity is critical. Defenders should prioritize detection and containment measures while awaiting official patches.

Botnet#infosecnews#redditGermany+5

ShadowRay 2.0 is a global hacking campaign targeting the Ray AI framework. It exploits a vulnerability to hijack exposed Ray computing clusters, turning them into a self-propagating botnet. The attackers deliver payloads via GitLab and GitHub, using AI-generated code to adapt their tactics. The botnet supports multiple malicious activities including cryptojacking, DDoS attacks, and data exfiltration. The campaign uses DevOps-style infrastructure for real-time malware updates, increasing its persistence and adaptability. No specific affected versions or patch information are provided. The campaign highlights risks in AI workload security and infrastructure exposure.

ShadowRay 2.0 is an active global cyber campaign that hijacks Ray AI infrastructure to create a self-propagating botnet. The attackers exploit AI systems to turn them against themselves, leveraging the compromised AI nodes to expand the botnet autonomously. This campaign is currently ongoing and has been reported by Oligo Security with limited public technical details. Although no known exploits are confirmed in the wild, the campaign's medium severity rating reflects its potential to disrupt AI-based services and infrastructure. European organizations using Ray AI infrastructure or related AI platforms could face risks of service disruption, data compromise, or being unwitting participants in botnet activities. Mitigations require proactive monitoring of AI infrastructure, network segmentation, and rapid incident response capabilities. Countries with significant AI technology adoption and critical infrastructure relying on AI are more likely to be targeted. Given the campaign's self-propagating nature and AI focus, the threat severity is assessed as high due to potential widespread impact and complexity of mitigation.

Campaign#netsec#redditGermany+7

Microsoft Azure recently mitigated an extremely large-scale Distributed Denial of Service (DDoS) attack reaching 15.72 Tbps, orchestrated by the Aisuru botnet. This attack represents one of the largest volumetric DDoS campaigns observed to date, leveraging a vast network of compromised devices to overwhelm Azure's infrastructure. Although no specific vulnerabilities were exploited, the attack demonstrates the increasing scale and sophistication of botnet-powered DDoS threats. European organizations relying on cloud services like Azure could face indirect impacts such as service degradation or collateral damage during such attacks. Mitigation requires advanced DDoS protection, traffic filtering, and collaboration with cloud providers. Countries with high Azure adoption and critical digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the attack's scale, ease of execution via botnets, and potential for widespread disruption, the threat severity is assessed as high. Defenders should focus on enhancing network resilience, deploying multi-layered DDoS defenses, and maintaining incident response readiness.

Campaign#infosecnews#redditGermany+5

RondoDox is a botnet malware campaign actively exploiting unpatched XWiki servers to recruit additional devices into its network. The threat leverages known vulnerabilities in XWiki instances that remain unpatched, enabling remote compromise without authentication or user interaction. Once infected, these servers become part of the botnet, potentially used for distributed denial-of-service (DDoS) attacks, data exfiltration, or further propagation. European organizations running XWiki without timely patching are at heightened risk, especially those in sectors relying heavily on collaborative platforms. The threat is considered high severity due to ease of exploitation and potential widespread impact. Mitigation requires immediate patching of XWiki servers, network segmentation, and monitoring for unusual outbound traffic. Countries with significant XWiki adoption and strategic digital infrastructure, such as Germany, France, and the UK, are most likely to be targeted. Given the lack of CVSS scoring, the threat is assessed as high severity based on its impact and exploitation characteristics. Defenders should prioritize vulnerability management and incident detection to prevent botnet expansion.

Botnet#infosecnews#redditGermany+5

Operation Endgame successfully dismantled three major malware threats: the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. Authorities seized 1025 servers linked to these operations and arrested one individual involved. These malware families were used for stealing sensitive information and controlling botnets for malicious activities. Although no active exploits are currently reported, the takedown disrupts ongoing cybercriminal campaigns. European organizations could have been targets due to the global reach of these malware strains. The medium severity reflects the moderate impact and complexity of these threats. Defenders should focus on monitoring for remnants of these malware, improving endpoint detection, and collaborating with law enforcement. Countries with high internet infrastructure and financial sectors are more likely to have been affected. The operation highlights the importance of international cooperation in combating cybercrime. Vigilance is still required as threat actors may attempt to rebuild or pivot to new malware.

Malware#infosecnews#redditGermany+6

RondoDox v2 is a significantly evolved botnet variant that has expanded its exploit capabilities by 650%, now leveraging over 75 CVEs across 16 different architectures. Originally targeting DVRs and routers, it has broadened its scope to include enterprise systems, indicating a shift towards more valuable targets. The botnet employs new command and control (C&C) infrastructure hosted on compromised residential IP addresses, complicating detection and takedown efforts. Although no known exploits are currently observed in the wild, the botnet's increased sophistication and scale pose a high risk. The threat actor is identifiable by an open signature email, and detailed technical analysis including dropper behavior, binary decoding, and detection rules are available. European organizations face heightened risk due to the targeting of enterprise systems and the widespread use of vulnerable devices. Mitigation requires targeted patch management, network segmentation, deployment of YARA and IDS/IPS rules, and enhanced monitoring of residential IP traffic. Countries with large enterprise sectors and significant IoT device usage, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the high impact on confidentiality, integrity, and availability, ease of exploitation, and broad scope, this threat is assessed as high severity.

Vulnerability#netsec#redditGermany+3