RapperBot

RapperBot is an IoT-focused DDoS botnet and DDoS-for-hire malware family active since at least 2021. Reporting in the provided content describes it as responsible for large-scale disruptive attacks against more than 18,000 victims in over 80 countries, with more than 370,000 DDoS attacks attributed to the operation. U.S. authorities said the botnet typically controlled roughly 65,000 to 95,000 infected devices and had attack capacity estimated at 2 to 6 Tbps; the botnet was disrupted by U.S. law enforcement in August 2025. The content also states RapperBot was used to target Pentagon networks on at least three occasions.

RapperBot primarily infected internet-exposed IoT and embedded Linux devices, especially home routers, DVRs, and network cameras; one source also notes infections observed in Taiwan, the United States, and Japan. Technical reporting in the content says RapperBot malware was used in exclusive brute-force attacks on SSH servers and could replace victims' ~/.ssh/authorized_keys, while later related samples reused RapperBot’s distinctive C2 protocol but shifted to Telnet-based self-propagation using embedded default IoT credentials and device-prompt fingerprinting. After compromise, the malware reported the credentials used, victim IP, and architecture to its C2 on port 5123, determined architecture by parsing /bin/busybox, and downloaded an architecture-matched ELF payload. Reported target architectures included ARM, MIPS, PowerPC, SH4, and SPARC, with checks to avoid Intel systems.

The malware’s core purpose was DDoS. Reported attack methods included UDP flood, TCP SYN flood, TCP ACK flood, TCP STOMP flood, generic TCP flood, GRE Ethernet flood, GRE IP flood, and a UDP flood tailored to Grand Theft Auto: San Andreas Multi Player (SA:MP), indicating at least one campaign focused on game-server disruption. Additional reporting in the content mentions concentrated DDoS attacks against online game-related servers in China and a correlation discussed by one presenter between RapperBot DDoS timing and intermittent service disruptions affecting X in March 2025. The content also notes a blacklist function associated with preventing repeat attacks.

FortiGuard Labs assessed that October 2022 samples using the same distinctive RapperBot C2 protocol were either operated by the same threat actor as RapperBot or by actors sharing privately distributed source code. Security detections referenced in the content include FortiGuard antivirus classifications such as ELF/Mirai, Linux/Mirai, and ELF/Gafgyt, and an IPS signature named Rapper.Botnet for RapperBot C2 activity.