Hijacked by RapperBot: Devices Exploited for Instant DDoS Attacks

A newly uncovered variant of the RapperBot malware covertly commandeers internet-connected devices—particularly outdated network video recorders (NVRs)—to form a DDoS army in seconds. Security researchers, according to Bitsight, detail an exploit chain that uses zero-day vulnerabilities, outdated firmware and an encrypted DNS TXT mechanism to orchestrate attacks that can reach multi-terabit traffic volumes.

The malware quickly fingerprints vulnerable DVR and NVR models, then performs a two-stage exploit: a path-traversal flaw in the HTTP service to extract administrator credentials, followed by an authenticated fake firmware update over TCP port 34567. Once active, it uses a remote NFS share to run the payload in memory, avoiding persistent filesystem footprints, and it avoids standard C2 IP hard-coding by querying OpenNIC resolvers for an encrypted TXT record of C2 servers.

On 19 August 2025, U.S. authorities charged an Oregon resident in connection with operating the RapperBot network as part of Operation PowerOFF, with researchers noting periodic rotation of IPs and a botnet that can surge to multi-terabit levels.