Tag: botnet
-
Aisuru’s 30 Tbps botnet traffic crashes through major US ISPs
Tags: attack, botnet, breach, cybercrime, data-breach, ddos, firmware, infrastructure, iot, malicious, router, serviceFrom Mirai roots to proxy sales: Aisuru is not new. Its foundations trace back to leaked code of the Mirai IoT botnet from 2016, which held “KrebsOnSecurity,” the investigative blog run by Krebs, offline for four days. “The 2016 assault was so large that Akamai which was providing pro-bono DDoS protection for KrebsOnSecurity at the…
-
Aisuru’s 30 Tbps botnet traffic crashes through major US ISPs
Tags: attack, botnet, breach, cybercrime, data-breach, ddos, firmware, infrastructure, iot, malicious, router, serviceFrom Mirai roots to proxy sales: Aisuru is not new. Its foundations trace back to leaked code of the Mirai IoT botnet from 2016, which held “KrebsOnSecurity,” the investigative blog run by Krebs, offline for four days. “The 2016 assault was so large that Akamai which was providing pro-bono DDoS protection for KrebsOnSecurity at the…
-
Hacker nutzen 100.000 IPAngriffe
Eine großangelegte Botnet-Kampagne zielt auf Remote-Desktop-Protocol-Anwender. Forscher des Security-Anbieters GreyNoise entdeckten kürzlich eine massive Angriffswelle, die von mehr als 100.000 IP-Adressen in mehr als 100 Ländern ausging. Die Analysten gehen davon aus, dass die Angriffe auf ein einzelnes, groß angelegtes Botnet zurückgeht. Laut Forschungsbericht haben es die Täter hinter der Kampagne hauptsächlich auf die RDP-Infrastruktur…
-
Hacker nutzen 100.000 IPAngriffe
Eine großangelegte Botnet-Kampagne zielt auf Remote-Desktop-Protocol-Anwender. Forscher des Security-Anbieters GreyNoise entdeckten kürzlich eine massive Angriffswelle, die von mehr als 100.000 IP-Adressen in mehr als 100 Ländern ausging. Die Analysten gehen davon aus, dass die Angriffe auf ein einzelnes, groß angelegtes Botnet zurückgeht. Laut Forschungsbericht haben es die Täter hinter der Kampagne hauptsächlich auf die RDP-Infrastruktur…
-
Researchers Warn RondoDox Botnet is Weaponizing Over 50 Flaws Across 30+ Vendors
Tags: botnet, cctv, data-breach, exploit, flaw, infrastructure, Internet, malware, network, router, vulnerabilityMalware campaigns distributing the RondoDox botnet have expanded their targeting focus to exploit more than 50 vulnerabilities across over 30 vendors.The activity, described as akin to an “exploit shotgun” approach, has singled out a wide range of internet-exposed infrastructure, including routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and First…
-
RondoDox botnet fires ‘exploit shotgun’ at nearly every router and internet-connected home device
56 bugs across routers, DVRs, CCTV systems, web servers “¦ time to run for cover First seen on theregister.com Jump to article: www.theregister.com/2025/10/09/rondodox_botnet_fires_exploit_shotgun/
-
RondoDox Botnet: an ‘Exploit Shotgun’ for Edge Vulns
RondoDox takes a hit-and-run, shotgun approach to exploiting bugs in consumer edge devices around the world. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/rondodox-botnet-exploit-edge-vulns
-
RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers
The RondoDox campaign’s “exploit shotgun” method leverages over 50 vulnerabilities across more than 30 vendors to infiltrate network devices, highlighting the urgent need for rapid patching and continuous monitoring. The first detected RondoDox intrusion on June 15, 2025, reused a command”injection vulnerability disclosed at Pwn2Own Toronto 2022: CVE-2023-1389, which targets the WAN interface of TP-Link…
-
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, CCTV systems, and servers, active globally since June. Trend Micro researchers reported that the RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, NVRs, CCTV systems, and web servers, active globally since June. Experts noted that the latest…
-
RondoDox botnet targets 56 n-day flaws in worldwide attacks
A new large-scale botnet called RondoDox is targeting 56 vulnerabilities in more than 30 distinct devices, including flaws first disclosed during Pwn2Own hacking competitions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rondodox-botnet-targets-56-n-day-flaws-in-worldwide-attacks/
-
âš¡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More
Cybersecurity never stops”, and neither do hackers. While you wrapped up last week, new attacks were already underway.From hidden software bugs to massive DDoS attacks and new ransomware tricks, this week’s roundup gives you the biggest security moves to know. Whether you’re protecting key systems or locking down cloud apps, these are the updates you…
-
New Botnet ‘Loader-as-a-Service’ Turns Home Routers and IoT into Mirai Farms
CloudSEK has uncovered a sophisticated Loader-as-a-Service botnet campaign spanning the last six months, leveraging exposed command-and-control logs to orchestrate attacks against SOHO routers, embedded Linux devices, and enterprise applications. The threat actors exploit unsanitized POST parameters”, such as NTP, syslog, and hostname fields”, alongside default credentials and known CVEs in WebLogic, WordPress, and vBulletin systems…
-
Mit ShadowV2 wird DDoS zu einem Cloud-nativen Abo-Dienst
DDos-Attacken sind mittlerweile als Auftragsmodell verfügbar, wie eine aktuelle Analyse zeigt.Laut einer Darktrace-Analyse nutzt eine ShadowV2-Bot-Kampagne falsch konfigurierte Docker-Container auf AWS und rüstet sie für DDoS-as-a-Service-Angriffe auf.Was ShadowV2 dabei besonders macht, ist die professionelle Ausstattung mit APIs, Dashboards, Betreiber-Logins und sogar animierten Benutzeroberflächen. ‘Dies ist eine weitere Erinnerung daran, dass Cyberkriminalität kein Nebenjob mehr ist,…
-
Neuer Weltrekord: DDoS-Attacke erreicht erstmals über 20 Terabit pro Sekunde
Die Datenrate des vorherigen DDoS-Rekords wurde damit in etwa verdoppelt. Hinter der Attacke steckt vermutlich ein Botnetz aus Routern. First seen on golem.de Jump to article: www.golem.de/news/neuer-weltrekord-ddos-attacke-erreicht-erstmals-ueber-20-terabit-pro-sekunde-2509-200421.html
-
ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign
Darktrace’s latest investigation uncovered a novel campaign that blends traditional malware with modern DevOps technology. At the center of this operation lies a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. The threat actors leverage a multi-stage Docker deployment initiated by a Python spreader, followed by a Go-based Remote Access Trojan (RAT) that implements a…
-
Exposed Docker Daemons Fuel DDoS Botnet
The for-hire platform leverages legitimate cloud-native tools to make detection and disruption harder for defenders and SOC analysts. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/exposed-docker-daemons-fuel-ddos-botnet
-
ShadowV2 turns DDoS into a cloud-native subscription service
From botnet to business platform: ShadowV2 is not just malware, it is a marketplace. Darktrace uncovered a full operator interface built with Tailwind and FastAPI, complete with Swagger documentation, admin and user privilege tiers, blacklists, and modular attack options. The design mirrors legitimate SaaS platforms, featuring dashboards and animations that make DDoS as easy as…
-
ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoSHire Service
Cybersecurity researchers have disclosed details of a new botnet that customers can rent access to conduct distributed denial-of-service (DDoS) attacks against targets of interest.The ShadowV2 botnet, according to Darktrace, predominantly targets misconfigured Docker containers on Amazon Web Services (AWS) cloud servers to deploy a Go-based malware that turns infected systems into attack nodes First seen…
-
Vom Botnet zu Zero-Day: Die wichtigsten Begriffe zur Cybersicherheit kurz erklärt
First seen on t3n.de Jump to article: t3n.de/news/cybersicherheit-glossar-security-1707854/
-
New Botnet Exploits Simple DNS Flaws That Leads to Massive Cyber Attack
Cybersecurity researchers have uncovered a sophisticated Russian botnet operation that leveraged DNS misconfigurations and compromised MikroTik routers to deliver malware through massive spam campaigns. The discovery reveals how threat actors exploited simple DNS errors to bypass email security protections and distribute malicious payloads on a global scale. The investigation began in November 2024 when researchers…
-
SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers
A proxy network known as REM Proxy is powered by malware known as SystemBC, offering about 80% of the botnet to its users, according to new findings from the Black Lotus Labs team at Lumen Technologies.”REM Proxy is a sizeable network, which also markets a pool of 20,000 Mikrotik routers and a variety of open…
-
SystemBC Botnet Compromises 1,500 VPS Every Day to Rent Out for DDoS Attacks
SystemBC, a resilient socks5 malware network first spotted in 2019, has dramatically evolved its proxy infrastructure by compromising an average of 1,500 virtual private servers (VPS) each day. This shift from residential devices to large-scale VPS nodes grants threat actors unprecedented bandwidth and longevity for malicious traffic, enabling sustained distributed denial-of-service (DDoS) and brute-force operations…
-
SystemBC Botnet Compromises 1,500 VPS Every Day to Rent Out for DDoS Attacks
SystemBC, a resilient socks5 malware network first spotted in 2019, has dramatically evolved its proxy infrastructure by compromising an average of 1,500 virtual private servers (VPS) each day. This shift from residential devices to large-scale VPS nodes grants threat actors unprecedented bandwidth and longevity for malicious traffic, enabling sustained distributed denial-of-service (DDoS) and brute-force operations…
-
SystemBC malware turns infected VPS systems into proxy highway
The operators of the SystemBC proxy botnet are hunting for vulnerable commercial virtual private servers (VPS) and maintain an average of 1,500 bots every day that provide a highway for malicious traffic. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/systembc-malware-turns-infected-vps-systems-into-proxy-highway/
-
AISURU Botnet Fuels Record-Breaking 11.5 Tbps DDoS Attack With 300,000 Hijacked Routers
The newly identified AISURU botnet, leveraging an estimated 300,000 compromised routers worldwide, has been pinpointed as the force behind a record-shattering 11.5 Tbps distributed denial-of-service (DDoS) attack in September 2025. This unprecedented assault eclipses the previous 5.8 Tbps peak seen earlier in the year and underscores a dangerous escalation in botnet scale and sophistication. First…
-
Riesiges DDoS-Botnetz: Mehr als fünf Millionen Geräte greifen Server an
Seit März ist das Botnetz um den Faktor 4 gewachsen. Am jüngsten DDoS-Angriff sollen 5,76 Millionen IP-Adressen beteiligt gewesen sein. First seen on golem.de Jump to article: www.golem.de/news/riesiges-ddos-botnetz-mehr-als-fuenf-millionen-geraete-greifen-server-an-2509-200084.html
-
Qrator Labs Mitigated Record L7 DDoS Attack from 5.76M-Device Botnet
Qrator Labs blocked a record L7 DDoS attack from a 5.76M-device botnet targeting government systems, showing rapid global growth since March. First seen on hackread.com Jump to article: hackread.com/qrator-labs-mitigate-l7-ddos-attack-5-76m-botnet/
-
Massive L7 DDoS Botnet Exploits 5.76M Hijacked Devices for Record Attacks
In a stark reminder of how vulnerable online services remain, Qrator Labs has revealed that a sprawling Layer 7 distributed denial-of-service (DDoS) botnet has swelled to over 5.76 million compromised devices, unleashing unprecedented traffic against critical infrastructures. Monitored since late March, the botnet has been used in a series of three large-scale attacks that demonstrate…
-
Kompromittierten Residential-Proxy-Netzwerke
Die Forscher von Censys haben Residential-Proxy-Netzwerke analysiert. Dabei wurde mit ein mutmaßliches ORB (Operation Relay Boxes)-Netzwerk untersucht, das Anfang August 2025 mit fast 40.000 Geräten aktiv war. Polaredge zeigt, wie sich moderne IoT-Botnets von kurzlebigen Ausbrüchen zu einer dauerhaften, global verteilten Infrastruktur entwickeln, die langfristig heimlich böswillige Operationen unterstützt. Ein tieferes Verständnis der Infrastruktur […]…
-
New Docker Malware Strain Spotted Blocking Rivals on Exposed APIs
Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development. First seen on hackread.com Jump to article: hackread.com/new-docker-malware-blocking-rivals-exposed-apis/