Research reports
1,224 reports from 387 publishers45 added in the past week
6 reports, newest added first
Added Sat 10 Oct
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Wed 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
MalwareBotnets and DDoS
Added Sat 26 Sep
public-research/drifter/report.md at main · deepfield/public-research
What distinguishes Drifter is how it hides. Its C2 domains are named after IP camera brands ( cctv[.]su , nvms9000[.]su ), chosen to blend with the traffic of devices that
Botnets and DDoS
public-research/potassium/report.md at main · deepfield/public-research
Content warning: This report quotes malware artifacts verbatim, including domain names, URL paths, campaign tags, and embedded strings chosen by the threat actor. Some contain crude or offensive language, including an antisemitic slur. These are reproduced…
Botnets and DDoS
Added Tue 1 Sep
public-research/cecbot/report.md at main · deepfield/public-research
No excerpt available.
Botnets and DDoSMobile
Added Wed 22 Jul
public-research/jackskid/report.md at main · deepfield/public-research
Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…
Botnets and DDoS
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.