IoT botnet Archives • Daily CyberSecurity

Google Disrupts Videostrong XCPE Botnet on Android TV

XCPE botnet and Videostrong XCPE botnet architecture diagram

Google Disrupts Videostrong XCPE Botnet on Android TV

Do Son November 2, 2026

Google dismantled the Videostrong XCPE botnet infecting 1.3M set-top boxes. The XCPE botnet sold residential proxy access to cybercrime affiliates.

Rust Doorway Botnet Exploits Routers, Cameras, and Servers Doorway botnet and Rust Doorway botnet architecture diagram

Rust Doorway Botnet Exploits Routers, Cameras, and Servers

Do Son November 2, 2026

CloudSEK uncovers the Doorway botnet. The Rust Doorway botnet exploits routers, cameras, and servers to build a global proxy network.

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays

Do Son August 4, 2026

The Dysphoria botnet uses blockchain ENS/SNS domains for covert C2 and turns victims into relays. XLab tracked over 200,000 bots in this IoT DDoS botnet.

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

Do Son August 3, 2026

Nozomi details the Tengu botnet, a modernized Mirai variant. This IoT malware adds encrypted C2, proxy, anti-analysis, and self-defense to resist removal.

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help TuxBot v3 Evolution IoT botnet C2 panel and cross-compilation build screen

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help

Do Son July 21, 2026

Unit 42 exposed TuxBot v3 Evolution, an IoT botnet built with LLM help. AI-written bugs left the malware only 70% functional. See the full analysis.

COXMO Botnet Variant: New Advanced Threat Exploits Router Firmware COXMO botnet variant Gafgyt malware analysis

COXMO Botnet Variant: New Advanced Threat Exploits Router Firmware

Do Son June 10, 2026

Read the latest Gafgyt malware analysis revealing how the dangerous COXMO botnet variant spreads via standalone scripts.

Shadowy IoT Army: Decades-Old Proxy Botnet Exposed and Crippled IoT botnet, proxy network

Shadowy IoT Army: Decades-Old Proxy Botnet Exposed and Crippled

Do Son May 13, 2025

A massive, long-running proxy botnet using outdated IoT devices for criminal anonymity has been dismantled in a global law enforcement operation.

IoT Botnet Fuels Large-Scale DDoS Attacks Targeting Global Organizations

Do Son January 19, 2025

Discover how a newly discovered IoT botnet is targeting organizations globally with large-scale DDoS attacks.

CatDDoS-Related Gangs Ramp Up Attacks Exploiting Over 80 Vulnerabilities

Do Son May 26, 2024

CatDDoS-related gangs have leveraged a wide array of vulnerabilities across multiple vendor devices like Apache, Cisco, D-Link, Huawei, ...