Read more

With the fall of RapperBot in August 2025, Aisuru quickly regained its position as the world’s most powerful DDoS botnet. By September, Aisuru had achieved record-breaking attacks, flooding targets wi...

NETSCOUT's analysis reveals that the Eleven11 botnet, initially reported as new in February 2025, is actually a rebranded version of the RapperBot botnet, active since 2021. This botnet has earned the moniker "DDoS ghost" due to its ability to evade detection for several years. The operators of Eleven11 employ advanced techniques to remain undetected, posing significant challenges to traditional cybersecurity measures. The botnet's longevity and stealth capabilities highlight the need for advanced detection mechanisms, such as behavioral analysis and threat intelligence, to combat evolving threats. Cybersecurity professionals should adopt a multi-layered defense strategy, including regular security audits, employee education, and network traffic monitoring, to mitigate the risks posed by sophisticated botnets like Eleven11. The revelation underscores the importance of staying ahead of cyber threats through continuous innovation and vigilance in cybersecurity practices.

Cloudflare mitigated a record 11.5 Tbps DDoS attack in 35 seconds, highlighting rising hyper-volumetric threats.

The US Department of Justice has announced the takedown of the RapperBot botnet and charges against its American administrator.

Botnets, which are massive networks of hacked devices, are being used for dangerous attacks, one of which recently set a world record.

Bitsight is a cyber risk management leader transforming how companies manage exposure, performance, and risk for themselves and their third parties.

: Feds say Mirai-spawned botnet blasted 370K attacks before AWS and pals helped yank its servers

RapperBot is a sophisticated malware that has recently come to light through a detailed analysis posted on Reddit. This malware is notable for its use of DNS TXT records to hide rotating Command and Control (C2) servers and its ability to deliver multi-architecture payloads that are stripped, encrypted, and self-deleting. The malware employs a custom base56 + RC4-like routine to extract C2 IPs, adding a layer of complexity to its operations. The infrastructure supporting RapperBot is highly dynamic, with scanners moving between different countries and binaries hosted on various protocols such as FTP and NFS. The timeline of RapperBot's activities coincides with the Department of Justice's Operation PowerOFF, suggesting a potential connection or impact from this law enforcement action. Technically, RapperBot's use of DNS TXT records for C2 communication is a clever tactic to evade detection. DNS TXT records are not typically monitored for malicious activity, making them an effective hiding spot for C2 servers. The multi-architecture payloads (MIPS, ARM, x86) indicate that RapperBot is designed to infect a wide range of devices, from embedded systems to traditional computers. The payloads are stripped to reduce their size and make them harder to detect, encrypted to obfuscate their contents, and self-deleting to cover their tracks after execution. The custom base56 + RC4-like routine used to extract C2 IPs adds another layer of obfuscation, making it more challenging for researchers to analyze the malware's communication channels. The dynamic infrastructure of RapperBot is another notable aspect. The malware's scanners are constantly moving between different countries, indicating a global reach and a sophisticated operation. The use of various protocols (FTP, NFS) for hosting binaries further complicates the tracking and mitigation of this malware. The coincidence of RapperBot's timeline with Operation PowerOFF, a law enforcement operation targeting botnets involved in DDoS attacks, suggests that RapperBot might be one of the botnets affected by this operation. This connection highlights the ongoing battle between cybercriminals and law enforcement agencies in the cybersecurity landscape. The impact of RapperBot on the cybersecurity landscape is significant. Its ability to infect a wide range of devices and its sophisticated evasion techniques make it a formidable threat. Cybersecurity professionals need to be aware of the tactics used by RapperBot, such as the use of DNS TXT records for C2 communication and the dynamic infrastructure, to better detect and mitigate such threats. The coincidence with Operation PowerOFF also underscores the importance of international cooperation and law enforcement actions in combating cyber threats. In conclusion, RapperBot represents a sophisticated and evolving threat in the cybersecurity landscape. Its use of DNS TXT records for C2 communication, multi-architecture payloads, and dynamic infrastructure highlights the need for advanced detection and mitigation strategies. Cybersecurity professionals should stay vigilant and update their defenses to counter such advanced threats effectively.

Cloudflareが記録的な11.5TbpsのDDoS攻撃を自動で阻止したと発表。攻撃は約35秒継続し、初期報告ではGoogle Cloudが主要な攻撃源とされた。2025年第2四半期には超大規模攻撃が6,500件発生し、前四半期の9倍に増加。同時期にRapperBotボットネットも撃破された。

Cloudflareが記録的な11.5TbpsのDDoS攻撃を自動で阻止したと発表。攻撃は約35秒継続し、初期報告ではGoogle Cloudが主要な攻撃源とされた。2025年第2四半期には超大規模攻撃が6,500件発生し、前四半期の9倍に増加。同時期にRapperBotボットネットも撃破された。

The Bitsight TRACE threat research team dissects RapperBot botnet: from the point of infection to DDoS attack. Read a comprehensive breakdown, including IoCs.

Bitsight is a cyber risk management leader transforming how companies manage exposure, performance, and risk for themselves and their third parties.

Cybersecurity researchers began detecting an alarming surge in early April 2025 in UDP flood traffic emanating from compromised network video recorders (NVRs) and other edge devices. Within milliseconds of infection, these devices were weaponized to direct overwhelming volumes of packets at unsuspecting targets, leading to service disruptions and massive bandwidth consumption. Bitsight analysts identified this […]