Do Son AhnLab uncovers SVF Bot, a Python-based DDoS botnet abusing Discord as its C&C channel to target misconfigured Linux servers and launch HTTP/UDP floods.
botnet
Google is suing the operators of BadBox 2.0, one of the world's largest smart TV botnets, to combat digital fraud and protect over 10 million infected Android devices.
FortiCNAPP uncovers Lcrypt0rx, an AI-generated ransomware linked to the H2Miner botnet. Despite its flaws, it achieves near-zero detection, targeting systems for crypto-mining and disruption.
The Free Software Foundation reports ongoing DDoS attacks since Aug 2024, with much traffic from AI company crawlers. Its small team is overwhelmed by the relentless web scraping.
NSFOCUS uncovers Hpingbot, a rapidly evolving Go-based botnet using Pastebin for payloads and hping3 for DDoS. It targets Windows/Linux/IoT, focusing on stealth and persistence.
FortiGuard Labs exposes RondoDox, a stealthy botnet exploiting critical flaws (CVE-2024-3721, CVE-2024-12856) in TBK DVRs & Four-Faith routers to launch sophisticated DDoS attacks.
Cloudflare successfully mitigated a record-breaking 7.3 Tbps DDoS attack in May 2025, delivering 37.4 TB in 45 seconds with no service disruption.
The Prometei botnet is back with a stealthy Linux variant, actively mining Monero and stealing credentials. It uses DGA, custom UPX packing, and sophisticated anti-analysis techniques.
RapperBot botnet resurfaces with 50,000+ active bots, now demanding Monero extortion to halt DDoS attacks. The self-proclaimed "rapper" malware targets IoT devices globally.
A critical RCE flaw (CVE-2025-3248) in Langflow is being actively exploited to deploy the stealthy Flodrix botnet for reconnaissance and diverse DDoS attacks on AI app servers.
Akamai reports active exploitation of critical Wazuh RCE (CVE-2025-24016) by multiple Mirai botnets, targeting IoT devices since March 2025.
A new Mirai botnet variant is exploiting CVE-2024-3721 to infect vulnerable DVRs. Learn how this sophisticated attack works and if your surveillance system is at risk.
LayerX found "sleeper agent" Chrome extensions, installed on 1.5M devices, disguised as audio tools but capable of remote command execution and data theft.
Darktrace uncovers PumaBot, a stealthy Linux botnet using Go binaries, SSH brute-force, and rootkits to compromise IoT devices, aiming for persistent, undetected access.
AyySSHush is a new stealthy botnet backdooring ASUS routers via SSH keys, abusing legitimate features to persist across firmware updates and targeting residential networks globally.
A stealthy campaign is persistently hacking ASUS routers via undocumented bypasses and CVE-2023-39780, building a backdoor network without malware.
The alleged architect of the Qakbot malware empire, Rustam Rafailevich Gallyamov, has been indicted, facing charges and a $24M crypto seizure.
The DOJ unsealed charges against four foreign nationals and the FBI seized domains for the Anyproxy and 5socks botnets, used to hijack routers globally.
FBI warns cybercriminals are exploiting outdated routers with TheMoon malware to build anonymous proxy networks for illicit activities.
Akamai uncovers active exploitation of retired GeoVision IoT devices via CVE-2024-6047 and CVE-2024-11120 using Mirai-based botnet LZRD.
RustoBot, a sophisticated botnet written in Rust, is exploiting vulnerabilities in TOTOLINK & DrayTek routers to launch DDoS attacks. Learn how this malware operates and how to protect your network.
Cisco Talos reveals a new VIP version of XorDDoS with centralized control, enabling global DDoS attacks. U.S. targeted in over 70% of observed campaigns.