Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitialized memory in the C2 protocol update. Researchers gained insights into DanaBot's operations, infrastructure, and affiliates. In May 2025, law enforcement dismantled DanaBot's infrastructure and indicted 16 individuals in Operation Endgame. The blog details the technical analysis of the vulnerability, its impact, and the type of data exposed through the memory leak.

DanaBot is a malware-as-a-service platform primarily engaged in cybercrime activities such as banking fraud and information theft. A critical vulnerability, named DanaBleed, was discovered in the Command and Control (C2) server infrastructure of DanaBot. This vulnerability was introduced in version 2380 of the C2 server software and caused a memory leak due to uninitialized memory during a C2 protocol update. The memory leak persisted from June 2022 until early 2025, inadvertently exposing sensitive internal data including threat actor identities, server infrastructure details, and victim credentials. This flaw was a result of poor memory management in the C2 server’s protocol implementation, leading to inadvertent disclosure of critical data. The vulnerability did not require active exploitation in the wild but was an internal bug within the malware’s own infrastructure. Security researchers and law enforcement leveraged this leak to gain unprecedented insight into DanaBot’s operations, infrastructure, and affiliates. This intelligence gathering culminated in Operation Endgame in May 2025, where law enforcement dismantled DanaBot’s infrastructure and indicted 16 individuals. The malware employs a sophisticated and multi-faceted attack framework, utilizing various MITRE ATT&CK techniques such as Windows Management Instrumentation (T1047), External Remote Services (T1133), Application Layer Protocol (T1071), process injection (T1055), credential dumping (T1003), and phishing (T1566), among others. While the vulnerability primarily affected the DanaBot C2 server infrastructure rather than victim endpoints directly, the leaked data included victim credentials, amplifying risks to affected organizations. No direct exploits of this vulnerability were observed in the wild, but the exposure significantly undermined the threat actor’s operational security and exposed their internal mechanisms.

Detailed information about DanaBot C2 Server Memory Leak Bug. Get real-time updates, technical details, and mitigation strategies.

DanaBot C2 Server Memory Leak Bug - Live Threat Intelligence - Threat Radar | OffSeq.com

DanaBot C2 Server Memory Leak Bug

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups operating the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks without requiring deep technical expertise. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured with RSA and AES encryption, enhancing its resilience against interception and analysis. It relies on hardcoded C2 servers and employs Tor as a fallback communication channel, complicating efforts to disrupt its operations. Historically, DanaBot has been leveraged in targeted espionage campaigns against government officials in the Middle East and Eastern Europe, as well as in distributed denial-of-service (DDoS) attacks targeting Ukrainian servers. The presence of over 50 known affiliate nicknames indicates a broad and decentralized operator base. The malware’s use of advanced techniques such as credential dumping (T1003), persistence mechanisms (T1543, T1547), lateral movement (T1090), and execution through user interaction (T1204) underscores its versatility and threat level. Despite the absence of known exploits in the wild for specific software vulnerabilities, DanaBot’s modularity and MaaS model make it a persistent and adaptable threat vector.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'operation endgame'

Filter Threats

Threats Tagged 'operation endgame'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility