#Botnet
All CosmicBytez Labs articles tagged #Botnet, across news, security advisories, how-to guides, and projects.
- News
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato hijacks exposed Docker daemons on port 2375 to install a weaponized Hermes AI agent that steals LLM API keys via Telegram commands.
- News
Read This Before You Buy That TV Streaming Stick
Bitsight researcher Pedro Fale traced 38,000+ H96 Android TV boxes secretly running ad fraud and residential-proxy malware for China's Fengwo Group.
- News
New x47.c Windows Botnet Weaponizes xAI Grok for AI-Powered Persistence and API Draining
Qrator details x47.c, a $950 Windows botnet using xAI Grok for persistence and a novel attack that drains stolen OpenAI/xAI API credits.
- News
New Carbonato Malware Uses AI Agents to Hijack Exposed Docker Hosts
ThreatDown: Carbonato worms through unauthenticated Docker APIs, then installs an AI agent operators command over Telegram.
- News
Sality Botnet Infrastructure Dismantled in Joint Global Takedown
Law enforcement and CrowdStrike sinkholed the 20+ year-old Sality P2P botnet, cutting off operator SALTY SPIDER's control channels.
- News
Hackers Infect Android Car Head Units with Proxy Botnet Malware
A supply-chain attack trojanizes a legitimate Android car head unit update app to quietly enlist vehicles in a proxy botnet or commit ad fraud.
- News
New Evooo1Bot Linux Botnet Turns Routers Into Traffic Relay Nodes
FortiGuard Labs uncovers Evooo1Bot, a Mirai-derived Linux botnet exploiting 8 CVEs to compromise routers and convert them into persistent SOCKS5 relay proxies.
- News
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A solo Russian-speaking threat actor known as "bandcampro" outsourced their entire C2 operation to Google's Gemini CLI — writing zero code themselves...
- News
Google Gemini CLI Jailbroken and Used as a Hacking Agent to Run a Malware Botnet
Trend Micro researchers discovered a Russian-speaking threat actor named 'bandcampro' who jailbroke Google's open-source Gemini CLI to operate an...
- News
Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware
This week's threat roundup covers residential proxy botnets hiding in streaming boxes, browser-based ransomware campaigns, AI agent abuse techniques, and...
- News
NetNut Proxy Network Disrupted, 2 Million Infected Devices Cut Off
Google's Threat Intelligence Group and the FBI have dismantled NetNut, a residential proxy network built on 2 million compromised Android smart TVs and...
- News
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
Working alongside the FBI and Lumen Technologies, Google's Threat Intelligence Group has significantly degraded NetNut — one of the largest networks that...
- News
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
Researchers at QiAnXin's XLab have identified AryStinger, a novel malware targeting end-of-life D-Link routers and QNAP NAS devices to build a distributed...
- News
AryStinger Botnet Infected Thousands of D-Link Routers Worldwide
A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated D-Link routers, converting them into malicious proxy...
- News
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown
In a major Operation Endgame action, law enforcement and private partners seized 106 SocGholish command-and-control servers and domains, with...
- News
Police Cleans Nearly 15,000 SocGholish-Infected Sites Tied to Evil Corp
International law enforcement cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish...
- News
'Popa' Botnet Linked to Publicly-Traded Israeli Firm
Security researchers have traced the sprawling Popa Android botnet — which enslaved millions of consumer TV boxes for ad fraud and data scraping — to a...
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Dutch Police Dismantle Massive 17-Million-Device Botnet
Dutch authorities seized command-and-control servers tied to a botnet of 17 million infected computers, smartphones, and tablets that was allegedly used to…
- News
From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a-Service Market
DDoS attacks are increasingly sold as subscription services with pricing tiers, reseller programs, and customer support. Flare's analysis reveals how the…
- News
Dutch Govt Disrupts Malware Botnet with 17 Million Infected Devices
Dutch authorities took offline a massive botnet of 17 million infected devices and seized more than 200 servers from a local hosting provider that...
- News
CrowdStrike Dismantles Glassworm Botnet Targeting Open-Source Supply Chain
CrowdStrike, Google, and Shadowserver dismantled the Glassworm botnet, stripping operators of infrastructure used to inject malware into OSS packages.
- News
Alleged Kimwolf Botmaster ''Dort'' Arrested, Charged in U.S. and Canada
Canadian authorities arrested a 23-year-old Ottawa man suspected of building and operating Kimwolf, an IoT botnet that enslaved millions of devices for...
- News
Canadian Man Arrested and Charged for Running KimWolf DDoS
Jacob Butler, a Canadian national, has been arrested and charged in the United States and Canada for running the KimWolf DDoS-for-hire botnet, which...
- News
US and Canada Arrest and Charge Suspected Kimwolf Botnet
U.S. and Canadian authorities arrested and charged a Canadian man with operating the Kimwolf DDoS botnet, which infected nearly two million devices...
- News
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
Russia's Turla APT has transformed its long-running Kazuar backdoor into a modular peer-to-peer botnet architecture engineered for stealth and deep...
- News
Russian Hackers Turn Kazuar Backdoor into Modular P2P Botnet
Secret Blizzard, a Russian state-sponsored threat group, has evolved its long-running Kazuar backdoor into a sophisticated modular peer-to-peer botnet...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- News
New Mirai Campaign Exploits RCE Flaw in End-of-Life D-Link
A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability in end-of-life D-Link DIR-823X...
- News
The Gentlemen Ransomware Now Uses SystemBC for Bot-Powered
Researchers have discovered a SystemBC proxy botnet of over 1,570 compromised hosts linked to Gentlemen ransomware operations. The gang's affiliate is...
- News
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack
Threat actors are deploying the Nexcorium Mirai botnet variant by exploiting CVE-2024-3721 in TBK DVR devices and targeting end-of-life TP-Link Wi-Fi...
- News
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache
This week's ThreatsDay Bulletin from The Hacker News covers 20 active threats including a hybrid P2P DDoS botnet, a 13-year-old Apache ActiveMQ RCE flaw...
- News
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
A joint operation by the US Department of Justice, Canada, and Germany has dismantled the infrastructure behind four highly disruptive IoT botnets that...
- News
Manager of Botnet Used in Ransomware Attacks Gets 2 Years
Ilya Angelov, co-leader of the TA551/Mario Kart cybercrime group, was sentenced to two years in prison for operating a phishing botnet that sent 700,000...
- News
DoJ Disrupts 3 Million-Device IoT Botnets Behind Record
The U.S. Department of Justice, in coordination with Germany and Canada, has dismantled the C2 infrastructure of four major IoT botnets — AISURU, Kimwolf,...
- News
SSHStalker Linux Botnet Uses IRC Protocol for Command and Control
Security researchers discover a new Linux botnet named SSHStalker that leverages the legacy IRC protocol for C2 operations, marking a return to old-school...
- News
Massive Kimwolf Botnet Disrupts I2P Anonymous Network
IoT botnet Kimwolf launches sustained attack against The Invisible Internet Project (I2P), disrupting the encrypted, decentralized communications network...
- Security
Record-Breaking 31.4 Tbps DDoS Attack: Aisuru Botnet Sets
Cloudflare discloses the largest publicly reported DDoS attack to date, peaking at 31.4 Tbps during 'The Night Before Christmas' campaign attributed to...