RapperBot
RapperBot is an IoT-focused DDoS botnet (first named and tracked by NSFOCUS’s Fuying Lab) that primarily targets DVRs and network cameras. Reporting describes RapperBot as propagating via multiple scanners and being operated through a command-and-control (C2) infrastructure used to conduct large-scale DDoS attacks. Investigation activity referenced in the content began in 2022 and leveraged darknet monitoring and honeypot data, identifying infections in Taiwan, the United States, and Japan. Operational reporting notes concentrated DDoS activity against online game-related servers in China and a reported timing correlation between RapperBot DDoS events and intermittent service disruptions affecting X (formerly Twitter) in March 2025. A described blacklist function was used to prevent repeat attacks; it was also associated (in the reporting) with cessation of communications and the operator’s arrest. In August 2025, the U.S. Department of Justice charged a 22-year-old Oregon man for operating RapperBot, alleging the botnet conducted more than 370,000 DDoS attacks against 18,000 victims across more than 80 countries, controlled approximately 65,000–95,000 infected devices, and had an estimated attack capacity of 2–6 Tbps. The content does not attribute RapperBot to a nation-state actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Media & Entertainment
Where they target
Geographies tied to known operations.
- 🇹🇼 Taiwan
- 🇺🇸 United States
- 🇯🇵 Japan
- 🇨🇳 China
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
IoT DDoS botnet with active C2 infrastructure; propagates via multiple scanners; observed infections in multiple regions and linked (timing correlation) to service disruptions and attacks on online game-related servers; operator reportedly arrested after C2 communications ceased.
RapperBot is a botnet used to conduct large-scale DDoS attacks globally, leveraging tens of thousands of infected devices to overwhelm targets with high-volume traffic.
RapperBot is a botnet involved in large-scale DDoS attacks, particularly against AI infrastructure and social media platforms. It is notable for its stealth, command-and-control sophistication, and effectiveness in overwhelming targets.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.