Research reports
1,224 reports from 387 publishers45 added in the past week
35 reports, newest added first
Added Sun 25 Oct
Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware Family
Using a custom-built SystemBC tracker, Silent Push Preemptive Cyber Defense Analysts identified more than 10,000 unique infected IP addresses as part of this botnet. While we don’t have immediate visibility on any follow-on malware payloads deployed via this…
MalwareBotnets and DDoS
The DGA of Sisron
Sisron was part of a financial fraud and identity theft botnet. It was taken down by Microsoft in the anti-botnet operation B106. The malware uses a very simple domain generation algorithm (DGA) that produces sets of similar looking domains. mjawmjiwmtia.com…
Botnets and DDoS
Added Sat 10 Oct
JDY Botnet: How IoT and SOHO Devices Are Exploited
Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation Published on Jun 10, 2026 | 11 minute read Black Lotus Labs® recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat…
VulnerabilitiesBotnets and DDoS
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Wed 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
MalwareBotnets and DDoS
Added Sat 26 Sep
public-research/drifter/report.md at main · deepfield/public-research
What distinguishes Drifter is how it hides. Its C2 domains are named after IP camera brands ( cctv[.]su , nvms9000[.]su ), chosen to blend with the traffic of devices that
Botnets and DDoS
public-research/potassium/report.md at main · deepfield/public-research
Content warning: This report quotes malware artifacts verbatim, including domain names, URL paths, campaign tags, and embedded strings chosen by the threat actor. Some contain crude or offensive language, including an antisemitic slur. These are reproduced…
Botnets and DDoS
Added Tue 8 Sep
Who Invited Aisuru to the LAN Party?
Bitsight TRACE has been actively monitoring the Aisuru botnet since February 2026. Through our dedicated infrastructure, we have observed the specific commands issued to the botnet and operational patterns orchestrated by the botnet's operators. This…
Botnets and DDoS
Added Tue 1 Sep
public-research/cecbot/report.md at main · deepfield/public-research
No excerpt available.
Botnets and DDoSMobile
Added Wed 22 Jul
public-research/jackskid/report.md at main · deepfield/public-research
Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…
Botnets and DDoS
Added Tue 19 May
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsoredMalwareBotnets and DDoS
Added Thu 7 May
Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions
Check Point Research (CPR) spotted the resurgence of Phorpiex, an old threat known for its sextortion spam campaigns, crypto-jacking, cryptocurrency clipping and ransomware spread The new variant “Twizt” enables the botnet to operate successfully without…
Botnets and DDoS
Emotet Botnet Disrupted in International Cyber Operation
The Justice Department today announced its participation in a multinational operation involving actions in the United States, Canada, France, Germany, the Netherlands, and the United Kingdom to disrupt and take down the infrastructure of the malware and…
MalwareBotnets and DDoS
Added Wed 6 May
Ransomware with a Twizt: Inside the Phorpiex Botnet
Phorpiex, also known as Trik, is a resilient and long-running botnet with a history dating back to 2011. While it has grabbed some headlines, its sustained presence and adaptability make it a subject of ongoing concern for the cybersecurity community.…
RansomwareBotnets and DDoS
Added Fri 1 May
How Russian Spam King Peter Levashov Was Arrested, and His Kelihos Botnet Dismantled
One of the world’s most notorious spammers appears to have been tripped up by a basic cybersecurity no-no, according to the FBI: He used the same log-in credentials to both run his criminal enterprise and also log into sites like iTunes. The Justice…
Botnets and DDoSTakedowns and arrests
Austria subjected to pro-Russian DDoS intrusions
More than 40 Austrian organizations had their websites subjected to distributed denial-of-service attacks by pro-Russia hacktivist operations NoName057(16) and OverFlame that have been underway since last week ahead of the country's election on Sunday,…
Botnets and DDoS
Added Mon 27 Apr
Application Layer DDoS in an Era Where Everything Looks Legitimate
Radware icon WHY RADWARE? Learn how Radware EPIC-AI™ rapidly resolves issues Menu Customers CUSTOMERS Read case studies, reviews and customer testimonials Menu Diversity & Inclusion DIVERSITY & INCLUSION Get to know Radware’s fair and supportive culture Menu…
Botnets and DDoS
Added Thu 23 Apr
Steam, Riot Games hit by disruptions: massive DDoS attack suspected
By Don't miss our latest stories on Google News. Add us as your Preferred Source on Google Multiplayer gamers on different platforms have experienced service outages and disruptions simultaneously. The cybersecurity community suspects a major distributed…
Botnets and DDoS
Federal Indictment in Chicago Charges Turkish National With Directing Cyber Attack on Multinational Hospitality Company
CHICAGO — An alleged cyber attacker from Turkey has been indicted in federal court in Chicago for allegedly orchestrating a distributed denial-of-service (DDoS) attack on a Chicago-based multinational hospitality company. In August 2017, IZZET MERT OZEK used…
Botnets and DDoSTakedowns and arrests
Added Fri 17 Apr
28th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches The European Parliament website has been attacked following a vote declaring Russia a state sponsor of…
State-sponsoredBotnets and DDoS
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.