GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
By yankywilson
Excerpt
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance capability in the Volt Typhoon / KV-botnet ecosystem (MITRE G1017). It fingerprints internet-exposed edge and SO…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.
Mentioned in the excerpt
More from GitHub49
- How-to-use-msfvenomGitHub · Added 19 Oct
- GitHub - FallenAstaroth/stink: the cutest python-native infostealerGitHub · Added 18 Oct
- cti/runster/readme.md at main · cert-orangecyberdefense/ctiGitHub · Added 16 Oct
On the same topics
- Kazuar: Anatomy of a nation-state botnetMicrosoft · Published 14 May
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware FamilySilent Push · Published 4 Feb
