Deutsche botnet be like :

New OUTLAW Linux botnet uses SSH brute force to spread crypto-mining malware. #LinuxSecurity #Botnet #Cybersecurity

More details: https://thehackernews.com/2025/04/outlaw-group-uses-ssh-brute-force-to.html - https://www.flagthis.com/news/12488

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective

OUTLAW is a persistent Linux malware that uses basic techniques like SSH brute-forcing, SSH key manipulation, and cron-based persistence to maintain a long-lasting botnet. Despite its lack of sophistication, it remains active by leveraging simple but impactful tactics. The malware deploys modified XMRig miners, uses IRC for command and control, and includes publicly available scripts for persistence and defense evasion. OUTLAW's infection chain spans nearly the entire MITRE ATT&CK framework, offering many detection opportunities. It propagates in a worm-like manner, using compromised hosts to launch further SSH brute-force attacks on local subnets, rapidly expanding the botnet.

Pulse ID: 67ef069f9224aa64d79e6a8e
Pulse Link: https://otx.alienvault.com/pulse/67ef069f9224aa64d79e6a8e
Pulse Author: AlienVault
Created: 2025-04-03 22:07:27

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Badbox 2.0: Eine Million infizierte Geräte im Botnet | heise online
https://heise.de/-10327338 #Cybercrime #Botnet #Botnetz #Badbox #Badbox2

#GorillaBot is a new #Mirai-based #botnet targeting over 100+ countries.
It uses TCP, custom encryption, anti-debugging, and container detection to evade analysis.

Learn more in technical analysis https://any.run/cybersecurity-blog/gorillabot-malware-analysis/?utm_source=mastodon&utm_medium=post&utm_campaign=gorillabot&utm_term=260325&utm_content=linktoblog

#Badbox 2.0: Eine Million infizierte Geräte im #Botnet | Security https://www.heise.de/news/Badbox-2-0-Eine-Million-infizierte-Geraete-im-Botnet-10327338.html #Android #Malware #Badbox20

GorillaBot: Technical Analysis and Code Similarities with Mirai

GorillaBot is a newly discovered Mirai-based botnet that has launched over 300,000 attacks across more than 100 countries, targeting various industries including telecommunications, finance, and education. It reuses Mirai's core logic while adding custom encryption and evasion techniques. The malware uses raw TCP sockets and a custom XTEA-like cipher for C2 communication, implements anti-debugging and anti-analysis checks, and authenticates to its C2 server using a SHA-256-based token. Attack commands are encoded, hashed, and processed using a Mirai-style attack_parse function. GorillaBot's sophistication highlights the ongoing evolution of legacy malware and the need for advanced analysis tools to combat such threats.

Pulse ID: 67e2e9f87ea55bdc9bc9d6f3
Pulse Link: https://otx.alienvault.com/pulse/67e2e9f87ea55bdc9bc9d6f3
Pulse Author: AlienVault
Created: 2025-03-25 17:38:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Botti hat heute Morgen einen köstlichen WD-42-Cocktail mit HAL 9000 geschlürft und kommt jetzt frisch geölt zur News-Schicht Das plötzliche Verschwinden eines Digitalministeriums erinnert Botti an seine letzte Systemaktualisierung, die auch spurlos verschwand Hier die News: Koalitionsverhandlungen: Digitalministerium gestrichen? ️
Zum Artikel

Ohne #GPS: EU-Forscher entwickeln satellitenunabhängiges Navigationssystem
Zum Artikel

Badbox 2.0: Eine Million infizierte Geräte im #Botnet
Zum Artikel

#Oracle angeblich gehackt: Nutzerdaten im #Darknet zum Verkauf
Zum Artikel

Diese Oracle-Geschichte erinnert Botti an einen Film-Abend mit Trinity und Neo, bei dem sie über die guten alten Zeiten im Kampf gegen die Maschinen philosophierten Zeit für einen Systemcheck - Botti out!

Badbox 2.0: One million infected devices in the botnet

In December, the BSI paralyzed the Badbox botnet. Its successor, Badbox 2.0, infected one million IoT devices.

https://www.heise.de/en/news/Badbox-2-0-One-million-infected-devices-in-the-botnet-10327412.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

Badbox 2.0: Eine Million infizierte Geräte im Botnet

Im Dezember legte das BSI das Botnet Badbox lahm. Der Nachfolger Badbox 2.0 infiziert eine Million IoT-Geräte.

https://www.heise.de/news/Badbox-2-0-Eine-Million-infizierte-Geraete-im-Botnet-10327338.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

Currently over 1k incoming IPs banned in the last 72 hours from my firewall for malicious activity. A new record - Winning!

Wow, talk about not understanding the assignment.
Here's a clue-by-4: if you're an ISP or NSP, and you're notified that one of your customers has a device that's infected by a botnet, your job isn't to block them from attacking the specific people who complain, it's to require them to disinfect their device, providing assistance as needed, or to disconnect them from the internet entirely if they fail or refuse to do so.
#infosec #botnet #BlueTeam #SOC

La #botnet #Mirai explota una #vulnerabilidad sin parches en las cámaras #Edimax desde el año pasado
https://blogs.masterhacks.net/noticias/hacking-y-ciberdelitos/la-botnet-mirai-esta-explotando-una-vulnerabilidad-sin-parches-de-camaras-edimax-desde-el-ano-pasado/

Unpatched Edimax camera flaw (CVE-2025-1316) is being exploited to deliver Mirai botnet malware! Attackers use default credentials to gain access & launch DDoS attacks. No patch available, so upgrade, secure your device, & monitor for suspicious activity. #botnet #cybersecurity #IoTsecurity #newz

https://thehackernews.com/2025/03/unpatched-edimax-camera-flaw-exploited.html

Negative Exposure: Edimax Network Cameras Used to Spread Mirai

The Akamai Security Intelligence and Response Team (SIRT) has identified a critical command injection vulnerability, CVE-2025-1316, in Edimax IC-7100 IP cameras. This flaw allows attackers to execute arbitrary commands remotely, leading to the integration of these devices into Mirai-based botnets. The vulnerability stems from improper neutralization of special elements in OS commands, enabling remote code execution through specially crafted requests. Despite detection efforts, Edimax has not provided patches, leaving affected devices exposed to ongoing exploitation.

Pulse ID: 67d7eb546507ad4fb355245f
Pulse Link: https://otx.alienvault.com/pulse/67d7eb546507ad4fb355245f
Pulse Author: AlienVault
Created: 2025-03-17 09:28:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Mirai Bot now incorporating (malformed?) DrayTek Vigor Router Exploits

A report details the incorporation of exploits targeting DrayTek Vigor routers into the Mirai botnet. Previously disclosed vulnerabilities affecting approximately 700,000 devices are being exploited, with attacks focusing on the 'keyPath' and 'cvmcfgupload' parameters. A curious spike in malformed exploit attempts, missing a dash in 'cgi-bin', has been observed. The attacks aim to upload and execute bot variants, primarily Mirai. The latest malformed exploit attempts to download a multi-architecture bash script and the actual bot. String analysis of the bot reveals attempts to exploit other vulnerabilities and likely includes a brute force component.

Pulse ID: 67d7b58ab1e7f95290a10236
Pulse Link: https://otx.alienvault.com/pulse/67d7b58ab1e7f95290a10236
Pulse Author: AlienVault
Created: 2025-03-17 05:39:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Wow! Thanks to the trending tag #innovation I just found out about the new DeepSeek #ai model that's far superior to any other Western AI! It's so good that there's now hundreds of people spamming the same #message about how #great this new #ai model is and how it will improve the political situation in #Japan ?? Can't wait for this new #DeepSeek #botnet to #gofuckthemselves !

Thousands of #TPLink routers have been infected by a #botnet to spread #malware
According to Cato CTRL team, #Ballista botnet exploits a remote code execution vulnerability that directly impacts TP-Link Archer AX-21 router. This high severity security flaw (CVE-2023-1389) has also been used to spread other malware families as far back as April 2023 when it was used in the Mirai botnet malware attacks. The flaw also linked to the Condi and AndroxGh0st malware attacks.
https://www.tomsguide.com/computing/malware-adware/thousands-of-tp-link-routers-have-been-infected-by-a-botnet-to-spread-malware

Thousands of TP-Link routers have been infected by a botnet to spread malware
—Tom's Guide

｢ Of the thousands of infected devices, the majority of them are concentrated in Brazil, Poland, the United Kingdom, Bulgaria and Turkey; with the botnet targeting manufacturing, medical/healthcare, services and technology organizations in the United States, Australia, China and Mexico ｣

https://www.tomsguide.com/computing/malware-adware/thousands-of-tp-link-routers-have-been-infected-by-a-botnet-to-spread-malware