Network Security Research Lab at 360
Beijing
Joined January 2018
- Tweets423
- Following12
- Followers4.6K
- Likes55
So, we published our Fodcha botnet blog two days ago, and the author behind this botnet pushed an updated new sample with the following message inside....🤪
A new updated fbot have been attacking various big names, it is now one of the most active DDos botnets that we have observed recently, more details can be found from our recently published blog blog.netlab.360.com/botnet-g… (in Chinese, but google translate will do the trick).
Our latest blog, blog.netlab.360.com/b1txor20… B1txor20, a new Linux backdoor rides on the Log4J vulnerability and uses DNS tunnel for C2 communications.
We observed that ripprbot botnet has instructed its bots to attack targets 147.237.0.0, 147.237.64.0 and 147.237.68.0, all belong to Israeli Government Network
A DDoS attack today against Israel reportedly took down the country's government websites.
@kentikinc observed a DDoS attack focused primarily against AS8867 (Israeli E-Government Project) beginning just before 15:30 UTC (5:30pm local).
haaretz.com/israel-news/.pre…
We also see multiple botnets related DDos targeting Russian websites, for example, kremlin.ru, fsb.ru, digital.gov.ru, baltbank.ru got attacked about 2 hours ago, and duma.gov.ru is being DDosed right now
More updates on Ukraine related DDos attacks, so far we have seen 15 C2s being used to launch DDos attacks. Some targets appear to make sense(attacks targeting banks and mil.gov.ua websites just few hours ago), some are little strange(pizza site and taxi site???)
An update for the Ukraine related DDos attacks, so far we have seen 4 different types of botnets(mirai, gafgyt, ircbot,ripprbot), nine unique C2 IPs, as well as daily NTP amp attacks. We have shared more detailed info to the security community and to some relevant parties.
We have been asked about if we see the Ukraine related DDos attacks, the answer is yes, mirai is behind it. and the C2 is located in Netherlands.
