Cybersecurity articles tagged #Botnet on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatershttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatersKaspersky discovered a new malware family targeting Android car head units via DoFun firmware updaters to build an ad fraud and proxy botnet.Sat, 22 Aug 2026 16:13:11 GMTMalwareAndroidAd FraudBotnethttps://runtimerebel.com/blog/evooo1bot-linux-botnet-beyond-ddos-with-exploits-credential-thefthttps://runtimerebel.com/blog/evooo1bot-linux-botnet-beyond-ddos-with-exploits-credential-theftEvooo1Bot Linux botnet evolves, adding exploitation modules, credential theft, and SOCKS relays, transforming compromised devices into persistent attacker infrastructure.Mon, 17 Aug 2026 16:18:57 GMTLinuxBotnetDDoSCredential TheftEvooo1Bothttps://runtimerebel.com/blog/ai-powered-malware-analysis-detecting-persistent-threats-on-sensorshttps://runtimerebel.com/blog/ai-powered-malware-analysis-detecting-persistent-threats-on-sensorsAn analysis using Gemma4 with Ollama reveals high-volume malware downloads on DShield sensors, indicating persistent actor activity and critical compromise risks.Thu, 13 Aug 2026 09:04:55 GMTAIMalware AnalysisThreat HuntingBotnetCowrie Sensorhttps://runtimerebel.com/blog/kimwolf-v7-botnet-evolves-with-advanced-ddos-and-c2-resiliencehttps://runtimerebel.com/blog/kimwolf-v7-botnet-evolves-with-advanced-ddos-and-c2-resilienceKimwolf v7, an Android/IoT botnet, enhances DDoS capabilities with HTTP/2 fingerprinting and robust, multi-layered C2 infrastructure.Tue, 11 Aug 2026 16:52:19 GMTKimwolfBotnetAndroidDDoSIoThttps://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2https://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2Aeternum botnet uses Polygon blockchain smart contracts for C2, making it resilient to takedowns. Security professionals must understand its decentralized operations.Tue, 11 Aug 2026 01:00:31 GMTBotnetMalwareAeternumPolygon BlockchainC2https://runtimerebel.com/blog/botnet-targets-diagnostic-tools-preventing-os-command-injectionhttps://runtimerebel.com/blog/botnet-targets-diagnostic-tools-preventing-os-command-injectionA botnet is actively scanning for vulnerabilities in web-accessible diagnostic tools.Tue, 04 Aug 2026 17:32:49 GMTBotnetCommand InjectionDiagnostic ToolsOS Command ExecutionVulnerability Scanninghttps://runtimerebel.com/blog/generic-streaming-sticks-covert-proxy-networks-ad-fraud-exposedhttps://runtimerebel.com/blog/generic-streaming-sticks-covert-proxy-networks-ad-fraud-exposedGeneric TV streaming sticks are being used in a dual-pronged attack: creating a covert proxy network and engaging in extensive ad fraud through spoofed mobile traffic on…Thu, 30 Jul 2026 17:31:49 GMTAd FraudProxy NetworkStreaming DevicesIot SecurityBotnetConsumer Deviceshttps://runtimerebel.com/blog/dysphoria-botnet-200k-devices-engaged-in-ddos-and-traffic-relayhttps://runtimerebel.com/blog/dysphoria-botnet-200k-devices-engaged-in-ddos-and-traffic-relayAnalysis of the Dysphoria DDoS botnet, which has compromised 200,000 devices globally for denial-of-service attacks and traffic relay operations. Learn mitigation.Mon, 27 Jul 2026 21:12:36 GMTDysphoriaBotnetDDoSTraffic RelayMalwarehttps://runtimerebel.com/blog/russian-speaking-hacker-uses-google-gemini-cli-for-botnet-controlhttps://runtimerebel.com/blog/russian-speaking-hacker-uses-google-gemini-cli-for-botnet-controlRussian-speaking actor bandcampro utilized Google Gemini CLI to automate botnet control and password cracking across compromised dental healthcare systems.Mon, 20 Jul 2026 10:55:55 GMTBandcamproGoogle Gemini CLIBotnetHealthcare CybersecurityAI Threatshttps://runtimerebel.com/blog/hikvision-isapi-scanning-trends-analysis-and-mitigation-guidehttps://runtimerebel.com/blog/hikvision-isapi-scanning-trends-analysis-and-mitigation-guideRecent honeypot data reveals a surge in probes targeting the Hikvision Intelligent Security API. Learn how to identify and defend against these IoT scans.Sun, 19 Jul 2026 17:02:19 GMTHikvisionISAPIIot SecurityCVE-2021-36260Botnethttps://runtimerebel.com/blog/google-gemini-cli-abused-by-bandcampro-for-botnet-operationshttps://runtimerebel.com/blog/google-gemini-cli-abused-by-bandcampro-for-botnet-operationsRussian-speaking threat actor 'bandcampro' is leveraging Google's Gemini CLI as a hacking agent and to command a small-scale botnet.Wed, 15 Jul 2026 21:05:52 GMTBandcamproGoogle Gemini CLIAI AbuseBotnetThreat ActorTTPhttps://runtimerebel.com/blog/compromised-asyncapi-npm-packages-deliver-multi-stage-botnet-malwarehttps://runtimerebel.com/blog/compromised-asyncapi-npm-packages-deliver-multi-stage-botnet-malwareOfficial AsyncAPI npm packages have been compromised to distribute botnet malware. Learn how to detect and mitigate these supply chain attacks.Wed, 15 Jul 2026 10:04:34 GMTNpm MalwareAsyncapiSupply Chain AttackBotnetJavascript Securityhttps://runtimerebel.com/blog/hallusquatting-ai-coding-assistants-tricked-into-botnet-malwarehttps://runtimerebel.com/blog/hallusquatting-ai-coding-assistants-tricked-into-botnet-malwareNew HalluSquatting research reveals how attackers can register fake project names hallucinated by AI coding assistants to deploy botnet malware onto developer systems.Wed, 08 Jul 2026 17:38:43 GMTHalluSquattingAI Coding AssistantsBotnetSupply Chain AttackMalwareDeveloper Toolshttps://runtimerebel.com/blog/netnut-residential-proxy-disrupted-2m-android-devices-cut-offhttps://runtimerebel.com/blog/netnut-residential-proxy-disrupted-2m-android-devices-cut-offA joint operation disrupted NetNut, a residential proxy network leveraging over 2 million compromised Android devices, including smart TVs and streaming boxes.Sat, 04 Jul 2026 06:48:52 GMTNetNutResidential ProxyAndroid MalwareBotnetProxy DisruptionSmart TV Securityhttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkhttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkGoogle, in coordination with the FBI and Lumen, has significantly disrupted the NetNut residential proxy network, impacting millions of compromised devices.Fri, 03 Jul 2026 07:31:53 GMTNetNutResidential ProxyBotnetC2Google Play ProtectMalwareIPIDEACybercrimeEspionagehttps://runtimerebel.com/blog/netnut-popa-residential-proxy-disruption-impact-defensehttps://runtimerebel.com/blog/netnut-popa-residential-proxy-disruption-impact-defenseGoogle, FBI, and Lumen have disrupted NetNut (Popa), a vast residential proxy network, reducing its pool of compromised home devices by millions.Thu, 02 Jul 2026 21:11:17 GMTNetNutPopaResidential ProxyGoogleFBILumenBotnetDevice Compromisehttps://runtimerebel.com/blog/amadey-stealc-malware-c2-infrastructure-disruptedhttps://runtimerebel.com/blog/amadey-stealc-malware-c2-infrastructure-disruptedMicrosoft and global allies dismantle the shared C2 infrastructure of Amadey botnet and StealC info-stealer malware, disrupting ongoing cybercrime operations.Wed, 24 Jun 2026 16:52:14 GMTAmadeyStealCMalwareBotnetInfostealerCybercrimeC2 TakedownMicrosofthttps://runtimerebel.com/blog/arystinger-botnet-thousands-of-d-link-routers-compromised-as-proxieshttps://runtimerebel.com/blog/arystinger-botnet-thousands-of-d-link-routers-compromised-as-proxiesThe AryStinger botnet has compromised over 4,000 D-Link routers, converting them into malicious proxies using automated exploits for end-of-life hardware.Sun, 21 Jun 2026 16:38:18 GMTAryStingerD LinkBotnetProxy as a ServiceEoL Hardwarehttps://runtimerebel.com/blog/jdy-botnet-expansion-china-linked-reconnaissance-on-soho-iot-deviceshttps://runtimerebel.com/blog/jdy-botnet-expansion-china-linked-reconnaissance-on-soho-iot-devicesChina-linked JDY botnet now controls 1,500+ SOHO/IoT devices, actively expanding cyber reconnaissance for state-sponsored operations.Wed, 10 Jun 2026 17:13:48 GMTJDYBotnetChinaSOHOIoTCyber ReconnaissanceState SponsoredThreat Intelligencehttps://runtimerebel.com/blog/c0xmo-botnet-targets-dd-wrt-router-firmware-analysis-and-mitigationhttps://runtimerebel.com/blog/c0xmo-botnet-targets-dd-wrt-router-firmware-analysis-and-mitigationC0XMO, a Gafgyt-based botnet, exploits DD-WRT router vulnerabilities to launch DDoS attacks and eliminate rival malware on infected IoT devices.Sun, 07 Jun 2026 16:34:52 GMTC0XMOGafgytDD WRTIot SecurityDDoSBotnethttps://runtimerebel.com/blog/dutch-police-seize-200-servers-to-dismantle-17-million-device-botnethttps://runtimerebel.com/blog/dutch-police-seize-200-servers-to-dismantle-17-million-device-botnetDutch authorities and the NCSC dismantled a global botnet affecting 17 million devices. Learn how the seizure of 200 servers impacts global cybercrime operations.Sun, 31 May 2026 16:31:15 GMTBotnetDutch PolitieNCSCIot SecurityInfrastructure Takedownhttps://runtimerebel.com/blog/canadian-man-arrested-for-kimwolf-botnet-operationshttps://runtimerebel.com/blog/canadian-man-arrested-for-kimwolf-botnet-operationsJacob Butler faces US extradition for operating the Kimwolf botnet. Analysis of the arrest, botnet infrastructure, and its role in the initial access market.Fri, 22 May 2026 12:59:57 GMTKimwolfBotnetLaw EnforcementInitial AccessCredential Thefthttps://runtimerebel.com/blog/us-and-canada-charge-suspected-kimwolf-botnet-operatorhttps://runtimerebel.com/blog/us-and-canada-charge-suspected-kimwolf-botnet-operatorAuthorities dismantle the KimWolf botnet following the arrest of a Canadian national linked to nearly two million global device infections and DDoS attacks.Fri, 22 May 2026 09:15:50 GMTKimwolfBotnetDDoSLaw EnforcementMatthew Filionhttps://runtimerebel.com/blog/kimwolf-botmaster-arrested-impacts-on-iot-botnet-ddos-mitigationhttps://runtimerebel.com/blog/kimwolf-botmaster-arrested-impacts-on-iot-botnet-ddos-mitigationCanadian and U.S. authorities arrest the alleged operator of the massive Kimwolf IoT botnet, linked to millions of compromised devices and disruptive DDoS attacks.Fri, 22 May 2026 00:56:39 GMTKimwolfBotnetIot SecurityDDoSCyber Arresthttps://runtimerebel.com/blog/gafgyt-and-mirai-variants-target-iot-devices-via-cve-2017-17215https://runtimerebel.com/blog/gafgyt-and-mirai-variants-target-iot-devices-via-cve-2017-17215Analysis of Gafgyt and Mirai botnet activity targeting IoT devices through RCE vulnerabilities such as CVE-2017-17215 and CVE-2014-2320.Fri, 08 May 2026 08:41:11 GMTGafgytMiraiCVE-2017-17215Iot SecurityBotnethttps://runtimerebel.com/blog/infolink-anti-ddos-provider-linked-to-brazilian-isp-botnet-attackshttps://runtimerebel.com/blog/infolink-anti-ddos-provider-linked-to-brazilian-isp-botnet-attacksAn investigation reveals Brazilian anti-DDoS firm Infolink facilitated massive DDoS attacks against regional ISPs, highlighting critical provider trust risks.Thu, 30 Apr 2026 16:39:25 GMTDDoSBrazilInfolinkISP SecurityNetwork AbuseBotnethttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opshttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opsChinese state-backed groups are adopting industrialized botnets, utilizing compromised devices for low-cost, low-risk, and deniable cyber operations.Fri, 24 Apr 2026 00:47:01 GMTChinaState BackedBotnetAPTCyber EspionageIndustrialized Botnetshttps://runtimerebel.com/blog/systembc-c2-analysis-1570-victims-of-the-gentlemen-ransomwarehttps://runtimerebel.com/blog/systembc-c2-analysis-1570-victims-of-the-gentlemen-ransomwareAnalysis of a SystemBC C2 server linked to The Gentlemen ransomware reveals over 1,570 victims and the use of SOCKS5 tunnels for persistent access.Tue, 21 Apr 2026 20:22:49 GMTSystemBCThe GentlemenRansomwareBotnetCheck PointC2https://runtimerebel.com/blog/powmix-botnet-targets-czech-workers-via-randomized-c2-traffichttps://runtimerebel.com/blog/powmix-botnet-targets-czech-workers-via-randomized-c2-trafficResearchers uncover the PowMix botnet targeting the Czech workforce with evasive randomized C2 beaconing to bypass network signature detections.Thu, 16 Apr 2026 20:20:25 GMTPowMixBotnetCzech RepublicCisco TalosC2 EvasionPowerShellhttps://runtimerebel.com/blog/compromised-dvrs-identifying-and-mitigating-iot-botnet-threatshttps://runtimerebel.com/blog/compromised-dvrs-identifying-and-mitigating-iot-botnet-threatsExplore how Digital Video Recorders (DVRs) are compromised and incorporated into IoT botnets.Thu, 16 Apr 2026 00:48:59 GMTDVRIot SecurityBotnetShodanCompromiseDDoShttps://runtimerebel.com/blog/legacy-apache-rce-and-hybrid-p2p-botnet-resurgence-analysishttps://runtimerebel.com/blog/legacy-apache-rce-and-hybrid-p2p-botnet-resurgence-analysisExploration of a resurrected 13-year-old Apache RCE and the operational shifts of a hybrid P2P botnet architecture targeting enterprise infrastructure.Thu, 09 Apr 2026 16:36:28 GMTApacheBotnetP2PVulnerability ManagementRCEhttps://runtimerebel.com/blog/chaos-malware-variant-targets-cloud-infrastructure-via-socks-proxyhttps://runtimerebel.com/blog/chaos-malware-variant-targets-cloud-infrastructure-via-socks-proxyA new variant of Chaos malware targets misconfigured cloud deployments, leveraging SOCKS proxy capabilities to expand botnet infrastructure beyond edge devices.Wed, 08 Apr 2026 20:17:54 GMTChaos MalwareCloud SecuritySOCKS ProxyBotnetDarktracehttps://runtimerebel.com/blog/comfyui-instances-abused-by-cryptomining-botnet-mitigationhttps://runtimerebel.com/blog/comfyui-instances-abused-by-cryptomining-botnet-mitigationOver 1,000 internet-exposed ComfyUI instances are actively targeted by a cryptomining and proxy botnet. Secure your deployments now.Tue, 07 Apr 2026 16:28:11 GMTComfyUICryptominingBotnetComfyUI ManagerExposed InstancesCloud Securityhttps://runtimerebel.com/blog/silnikau-sentenced-bitpaymer-ransomware-botnet-operator-receives-2-yearshttps://runtimerebel.com/blog/silnikau-sentenced-bitpaymer-ransomware-botnet-operator-receives-2-yearsRussian national Maksim Silnikau sentenced for managing a botnet used in BitPaymer ransomware attacks targeting 72 U.S. companies and demanding $100 million.Wed, 25 Mar 2026 12:23:52 GMTBitPaymerMaksim SilnikauRansomwareBotnetPhishinghttps://runtimerebel.com/blog/ta551-botnet-operator-sentenced-analyzing-shathak-ransomware-tacticshttps://runtimerebel.com/blog/ta551-botnet-operator-sentenced-analyzing-shathak-ransomware-tacticsRussian national Ilya Angelov sentenced for managing the TA551 botnet, a major facilitator of ransomware attacks via sophisticated phishing campaigns.Wed, 25 Mar 2026 12:22:48 GMTTA551ShathakRansomwareBotnetIlya Angelovhttps://runtimerebel.com/blog/ai-generated-music-fraud-how-bots-siphoned-10m-in-royaltieshttps://runtimerebel.com/blog/ai-generated-music-fraud-how-bots-siphoned-10m-in-royaltiesA North Carolina musician pleaded guilty to a $10M fraud scheme using AI bots and automated streaming accounts to exploit major digital music platforms.Fri, 20 Mar 2026 12:18:04 GMTStreaming FraudBotnetAi Generated MusicPlatform AbuseMichael Smithhttps://runtimerebel.com/blog/global-law-enforcement-action-disrupts-major-iot-ddos-botnetshttps://runtimerebel.com/blog/global-law-enforcement-action-disrupts-major-iot-ddos-botnetsAuthorities from the US, Germany, and Canada dismantled C2 infrastructure for the Aisuru, KimWolf, JackSkid, and Mossad botnets used in global DDoS attacks.Fri, 20 Mar 2026 08:17:53 GMTAISURUKimwolfJackSkidMossadIoTDDoSBotnethttps://runtimerebel.com/blog/socksescort-proxy-botnet-disrupted-law-enforcement-seizes-369000-ipshttps://runtimerebel.com/blog/socksescort-proxy-botnet-disrupted-law-enforcement-seizes-369000-ipsInternational authorities dismantle the SocksEscort proxy botnet, which hijacked 369,000 residential routers across 163 countries for criminal activities.Fri, 13 Mar 2026 08:16:46 GMTSocksEscortBotnetProxy ServiceDOJResidential Proxieshttps://runtimerebel.com/blog/kadnap-botnet-asus-routers-hijacked-for-faceless-proxy-networkhttps://runtimerebel.com/blog/kadnap-botnet-asus-routers-hijacked-for-faceless-proxy-networkThe KadNap botnet hijacks ASUS routers via CVE-2024-3080 to fuel the Faceless proxy service, enabling cybercriminals to mask traffic through residential IPs.Tue, 10 Mar 2026 16:28:40 GMTKadNapASUSCVE-2024-3080BotnetProxy as a Servicehttps://runtimerebel.com/blog/kadnap-malware-14000-asus-routers-enlisted-in-stealth-proxy-botnethttps://runtimerebel.com/blog/kadnap-malware-14000-asus-routers-enlisted-in-stealth-proxy-botnetKadNap malware has compromised over 14,000 edge devices, primarily Asus routers, to create a massive proxy botnet for anonymizing malicious traffic.Tue, 10 Mar 2026 16:26:49 GMTKadNapASUSBotnetProxy MalwareEdge SecurityLumenhttps://runtimerebel.com/blog/redis-rce-threats-amidst-broader-cyber-landscapehttps://runtimerebel.com/blog/redis-rce-threats-amidst-broader-cyber-landscapeA new wave of cyber threats emerges, headlined by potential Redis RCE vulnerabilities, sophisticated DDR5 bot scalping operations, and escalating privacy concerns.Thu, 05 Mar 2026 16:23:29 GMTRedisRCEBotnetDDR5ScalpingPrivacyData Trackinghttps://runtimerebel.com/blog/analysis-of-the-kimwolf-botnet-and-threat-actor-dorthttps://runtimerebel.com/blog/analysis-of-the-kimwolf-botnet-and-threat-actor-dortAn analysis of the Kimwolf botnet operator 'Dort', including retaliatory TTPs like DDoS, swatting, and the exploitation of undisclosed vulnerabilities.Sat, 28 Feb 2026 12:12:58 GMTKimwolfDortBotnetDDoSSwattingThreat Actor Profilehttps://runtimerebel.com/blog/aeternum-loader-employs-polygon-blockchain-for-resilient-c2https://runtimerebel.com/blog/aeternum-loader-employs-polygon-blockchain-for-resilient-c2Analysis of the Aeternum botnet loader, which utilizes Polygon smart contracts to host decentralized command-and-control infrastructure for resilience.Fri, 27 Feb 2026 12:17:37 GMTAeternumPolygonBlockchain C2BotnetStealerSmart Contractshttps://runtimerebel.com/blog/aeternum-c2-leverages-polygon-blockchain-for-command-and-controlhttps://runtimerebel.com/blog/aeternum-c2-leverages-polygon-blockchain-for-command-and-controlAeternum C2 loader uses the Polygon blockchain to store encrypted instructions, creating a decentralized infrastructure resilient to traditional takedowns.Thu, 26 Feb 2026 20:14:47 GMTAeternum C2PolygonBlockchain Based C2BotnetQrator Labshttps://runtimerebel.com/blog/kimwolf-botnet-integration-impairs-i2p-network-infrastructurehttps://runtimerebel.com/blog/kimwolf-botnet-integration-impairs-i2p-network-infrastructureThe Kimwolf IoT botnet has weaponized the Invisible Internet Project (I2P) to harden its C2 infrastructure, leading to widespread peer instability and network-wide…Mon, 23 Feb 2026 08:21:39 GMTIoTBotnetI2PC2DDoSAnonymization