Ddos on CuraSec

Large-scale DDoS attacks disrupt Threema messaging service

Mon, 17 Aug 2026 11:37:07 +0000

Engineer — Skip
SOC/IR — Learn: DDoS campaign against a privacy-focused messaging platform; no IOCs or TTPs published, so no detection work is actionable, but useful context if your organization uses Threema or monitors availability-based attacks.
Leader — Skip

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Learn: The HTTP/2 traffic-mimicry technique is worth understanding when reviewing WAF and CDN rate-limiting rules, but no enrichment signals (no KEV, no PoC, no active targeting) justify an immediate configuration change.
SOC/IR — Plan: The botnet’s ability to blend DDoS volume into legitimate-looking HTTP/2 sessions is a detection gap worth scoping — review whether your traffic-analysis and DDoS-detection rules distinguish request-rate anomalies at the HTTP/2 stream level rather than relying on IP reputation alone.
Leader — Learn: Awareness item for the evolving DDoS evasion landscape; relevant background for the next DDoS-mitigation vendor review or business-continuity risk discussion, but no board-level action is warranted now.

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Learn: No KEV, PoC, or EPSS signal provided; no specific vulnerability or affected software named in the summary. Monitor for follow-up reporting with exploitation details or affected device types that may be in your estate.
SOC/IR — Plan: A 200k-node botnet generating DDoS and relay traffic is worth building or tuning detections for — watch for follow-up IOC releases and prepare to hunt for anomalous outbound traffic patterns consistent with botnet C2 or relay behavior.
Leader — Learn: Awareness-level item for now; if your organization relies on internet-facing services, DDoS resilience posture is worth a periodic review but this report lacks specifics that would require immediate leadership action.

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Learn: Blockchain-based C2 and peer-relay architecture represent an evasion technique relevant to defenders running IoT-adjacent infrastructure, but there are no specific CVEs, affected products, or actionable mitigations named here.
SOC/IR — Plan: The shift to blockchain name services and victim-device relays changes the detection model for this botnet family; build or tune detections for anomalous outbound connections to blockchain resolvers and unexpected device-to-device relay traffic in your estate.
Leader — Learn: Useful context on botnet resilience trends following law-enforcement disruptions, but no immediate vendor exposure or board-level risk event is indicated here.

Tue, 14 Jul 2026 12:08:08 +0000

Engineer — Learn: Novel abuse of npm as free hosting infrastructure to serve malicious browser-side JavaScript to site visitors rather than targeting package consumers directly; review whether your org hosts any user-facing content via npm and revisit supply-chain threat models to include registry-as-CDN attack patterns.
SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs are published from this research, so there is nothing actionable to hunt or detect today; file as a reference technique — browser-based DDoS recruited via malicious proxy sites — for future detection engineering when lure sites targeting your sector emerge.
Leader — Skip