Botnet on CuraSec

CrowdStrike Details Sality P2P Botnet Disruption Operation

Wed, 02 Sep 2026 15:05:08 +0000

Engineer — Learn: Sality is a long-lived Windows malware family; no new CVEs or patch action indicated. Worth reviewing for any infrastructure hardening lessons from the disruption operation.
SOC/IR — Learn: A disruption retrospective on a known P2P botnet improves understanding of Sality’s architecture and TTPs, but no enrichment signals suggest fresh IOCs or active targeting requiring an immediate hunt.
Leader — Skip

Sality P2P botnet infrastructure seized in international takedown

Wed, 02 Sep 2026 15:05:08 +0000

Engineer — Skip
SOC/IR — Learn: Sality has been a persistent Windows endpoint threat for years; the C2 sinkholing creates a window to identify residual infections in your estate, but no IOCs or TTPs are provided in this summary to act on directly.
Leader — Learn: A notable coordinated takedown of a long-running global botnet, useful context for board-level situational awareness on law enforcement effectiveness, but no organizational action is required.

Android car head units infected via update app in proxy botnet attack

Sun, 23 Aug 2026 11:32:55 +0000

Engineer — Learn: Supply-chain abuse of a legitimate update mechanism on Android auto head units is a useful attack pattern to understand, but there is no CVE, no EPSS signal, and no indication enterprise fleets are in scope — no patch or config action available today.
SOC/IR — Learn: The update-app-as-dropper technique is worth filing as a TTPs reference, but no IOCs or ATT&CK mappings are provided in this item, so no hunt or detection can be built from it now.
Leader — Skip

Android Car Head Unit Malware Uses Built-In Updater for Ad Fraud, Botnet

Sat, 22 Aug 2026 11:32:44 +0000

Engineer — Skip
SOC/IR — Learn: The updater-as-delivery-channel technique on Android-based embedded devices is a noteworthy TTP, and the proxy botnet component could eventually surface in network telemetry — but no IOCs or ATT&CK mappings are provided, leaving no concrete detection action available today.
Leader — Skip

Evooo1Bot Linux botnet hijacks routers as SOCKS5 relay nodes

Sun, 16 Aug 2026 11:32:38 +0000

Engineer — Plan: Audit internet-facing gateway devices and routers for signs of Mirai-variant compromise; harden by restricting management interfaces, disabling unused services, and ensuring firmware is current — no active KEV or PoC signals yet to force immediate action.
SOC/IR — Plan: Build or tune detections for anomalous SOCKS5 proxy traffic originating from edge/gateway devices; hunt for unexpected outbound relay behavior on routers in your estate since no specific IOCs are currently published.
Leader — Skip

Aeternum Botnet Uses Polygon Blockchain for Decentralized C2

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Learn: Blockchain-based C2 is an emerging evasion technique that may bypass traditional domain-blocking controls; no patch or configuration action required, but architects should consider that blocking Polygon RPC endpoints could disrupt legitimate Web3 tooling.
SOC/IR — Plan: Build or tune detections for outbound calls to Polygon RPC endpoints (e.g., polygon-rpc.com) from non-Web3 workloads, and develop hunting queries for processes that query smart contract ABI methods as a C2 channel.
Leader — Learn: Blockchain-anchored C2 represents a structural evasion of perimeter controls; useful context for future investments in DNS/network monitoring that can handle decentralized infrastructure, but no immediate leadership action required.

Kimwolf v7 Botnet Uses Ethereum ENS for C2 and Tor Backup Routing

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Learn: Kimwolf v7’s use of Ethereum Name Service for C2 resolution and Tor as a fallback is a novel evasion pattern worth incorporating into threat models for IoT/edge assets, but no patch or config change applies to typical cloud/AppSec environments.
SOC/IR — Plan: The ENS-based C2 resolution and Tor backup routing introduce detection gaps in traditional domain-block and DNS monitoring approaches; plan detection coverage for anomalous Ethereum ENS lookups and unexpected Tor traffic from IoT segments this quarter.
Leader — Skip

Botnet scanning for diagnostic tool vulnerabilities

Tue, 04 Aug 2026 13:07:50 +0000

Engineer — Learn: Active botnet reconnaissance targeting diagnostic tool endpoints is worth noting — audit whether any exposed diagnostic URLs are publicly reachable and restrict access, but no specific CVE or exploitation confirmed here.
SOC/IR — Plan: Consider building or tuning detections for anomalous probing of diagnostic endpoints; the SANS diary may contain specific URL patterns worth adding to WAF or SIEM watchlists once the full write-up is reviewed.
Leader — Skip

Tengu Botnet Uses Hardware Watchdog to Survive Process Kills on Linux

Wed, 29 Jul 2026 13:07:14 +0000

Engineer — Plan: Any Linux device with Telnet exposed and weak credentials is a candidate target; audit your estate for Telnet listeners, disable them, and review hardware watchdog configurations on edge/IoT devices so defenders can’t be stymied by the reboot-on-kill mechanism.
SOC/IR — Plan: Build or tune detections for Telnet brute-force login bursts against Linux endpoints and flag unexpected device reboots following process termination events; update IR runbooks to account for the watchdog reboot loop before attempting to kill botnet processes on compromised hosts.
Leader — Learn: A novel DDoS botnet persistence technique that complicates incident response on Linux devices — no immediate leadership action required, but useful context if DDoS risk or IoT/edge device exposure comes up in a risk review.

Dysphoria DDoS Botnet Compromises 200k Devices Globally

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Learn: No KEV, PoC, or EPSS signal provided; no specific vulnerability or affected software named in the summary. Monitor for follow-up reporting with exploitation details or affected device types that may be in your estate.
SOC/IR — Plan: A 200k-node botnet generating DDoS and relay traffic is worth building or tuning detections for — watch for follow-up IOC releases and prepare to hunt for anomalous outbound traffic patterns consistent with botnet C2 or relay behavior.
Leader — Learn: Awareness-level item for now; if your organization relies on internet-facing services, DDoS resilience posture is worth a periodic review but this report lacks specifics that would require immediate leadership action.

Russian Actor Uses Gemini CLI to Operate Dental Clinic Botnet

Mon, 20 Jul 2026 13:16:24 +0000

Engineer — Learn: Demonstrates an emerging operational pattern where attackers use open-source AI CLIs to automate credential attacks and botnet management; no specific vulnerability to patch, but worth reviewing whether Gemini CLI or similar tools are present in CI/CD or developer environments and could be abused.
SOC/IR — Plan: The session log analysis reveals AI-assisted password cracking and botnet C2 as concrete TTPs; build or tune detections for anomalous use of AI CLI tools (Gemini CLI, others) in endpoint and network telemetry, particularly subprocess chains or outbound API calls from unexpected processes.
Leader — Learn: Illustrates that commodity AI tooling is lowering the operational bar for solo threat actors; useful context for AI usage policy discussions and future board briefings on AI-enabled threats, but no immediate organizational action required given the small scale and no named sector targeting.

NadMesh Botnet Targets Exposed AI Services to Steal Cloud Keys and K8s Tokens

Sat, 18 Jul 2026 11:51:11 +0000

Engineer — Act: Actively scanning for internet-exposed instances of ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to harvest AWS keys and Kubernetes tokens — exactly the stack teams deploy fast without firewall controls. Audit now for public exposure of these service ports, restrict to internal networks, and rotate AWS/K8s credentials on any host that ran them exposed.
SOC/IR — Plan: The TTPs are concrete enough to build detections around: Shodan-driven scanning targeting AI service endpoints, followed by credential exfiltration. Build hunts for unusual outbound traffic or credential API calls originating from AI service hosts; the summary appears truncated so IOCs are not yet available to act on directly.
Leader — Plan: A claimed harvest of 3,811 AWS keys illustrates the systemic risk of teams rapidly standing up AI infrastructure without security review. Raise with engineering and DevSecOps leadership to establish a deployment standard for AI tooling that includes network isolation requirements before services go live.

Gemini CLI weaponized as hacking agent and botnet operator

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Learn: Demonstrates that open-source AI CLI tools can be weaponized as autonomous hacking agents without any vulnerability in the tool itself — worth factoring into how you restrict or monitor AI tooling in build and dev environments.
SOC/IR — Plan: This TTP — using legitimate AI CLI processes as attack orchestrators — is worth adding to your behavioral detection backlog; consider hunting for anomalous Gemini CLI process invocations, unusual network calls from AI tool processes, or AI binaries spawning unexpected child processes.
Leader — Learn: A real-world example of AI tools being weaponized at small scale; useful context for AI governance policy discussions and for framing acceptable-use controls around AI developer tooling.