Kernel Developer | Security REsearcher | Basketball Fan {Botconf | VirusBulletin | Kaspersky SAS} Speaker Current: @Xlab_qax EX: @360Netlab @Kaspersky AKA 渣兔
Joined December 2014
- Tweets316
- Following390
- Followers1.4K
- Likes567
🚨XCPE botnet~
Been tracking lw_android_agent since August 20th — man, it's painful.
XLab，简直痛失百万啊~😭😭😭
Google and partners just shut the door on the XCPE botnet, severing criminal access to 10M+ devices. 🛡
Instead of a hacker breaking in, a device maker hid a backdoor in its own TV boxes to sell access to cybercriminals.
Full story: goo.gle/4iwISz8
🚨写写简单的威胁快讯，刷一刷KPI也挺开心😂。
By the way, are there any #Telegram experts who can uncover the real identity of 0xWR?🤔
Happy hunting 🍷@Xlab_qax
A mysterious hacker group known as #Mr_Rot13, which has operated covertly for six years, is exploiting critical cPanel vulnerabilities to deploy backdoor malware. blog.xlab.qianxin.com/mr_rot…
#botnet #ioc #c2 👉 xlabslover[.]lol and the console output had us in stitches. 😂
📸"To love or hate, that is the question". 📸
By the way, @Huntio about "The xlab 2 Rivalry" part… hmm, I'm thinking "F-word xlab 2" — may be "F-word xlab too."🤣
Happy hunting 🍷@Xlab_qax
🚨 NEW RESEARCH: xlabs_v1 DDoS-for-Hire IoT Botnet Exposed - One Open Directory. An Entire Operation Revealed.
hunt.io/blog/xlabs-v1-ddos-f…
The operator built a full commercial DDoS-for-hire operation. Tiered pricing, 21 flood variants, competitor-killing routines baked in.
Then left the whole toolkit on a public server with no login. Hunt.io AttackCapture tool had it indexed before they noticed.
Key findings:
- Botnet branded xlabs_v1, operator handle Tadashi, targeting game servers and Minecraft hosts
- 21 flood variants including RakNet and OpenVPN-shaped UDP to dodge common filters
- TCP/5555 observed open on 4M+ hosts in the past 180 days, any running ADB is a potential target
- ChaCha20 encryption broken via known-plaintext, full nonce reuse across all 16 calls
- C2, staging, distribution, and Monero cryptojacking all inside one bulletproof /24 in the Netherlands
👉 Full IOCs, MITRE mapping, and HuntSQL queries: hunt.io/blog/xlabs-v1-ddos-f…
🚨#fast16 🫡向大佬们脱帽致敬，这溯源能力太强了！
Lua brings me back to the days of analyzing Project Sauron and Godlua. For the lazy ones out there, I’ve uploaded the decrypted and preliminarily decompiled Lua payloads to VT 18735eebaa648c22d68a3a362d89dc6a.
Happy hunting
