Fodcha

Fodcha is a multi-architecture DDoS botnet first observed in 2022 that targets internet-exposed devices through a combination of known vulnerabilities and Telnet/SSH weak-credential attacks. It has been associated with large-scale distributed denial-of-service operations against organizations in sectors including healthcare, communications, and cloud services, and has shown substantial scale with tens of thousands of active bots and terabit-class attack capacity. Victimology has been concentrated in China and the United States, while infections and attack activity have also been observed across other global regions.

The malware targets Linux-based embedded and server environments across architectures including MIPS, ARM, and x86. It has been documented exploiting exposed services and multiple device and application vulnerabilities, including Android Debug Bridge exposure, GitLab CVE-2021-22205, Realtek Jungle SDK JAWS Webserver CVE-2021-35394, and remote code execution flaws affecting DVRs and routers. Operators have also used a dedicated brute-force component to identify devices accessible via weak Telnet credentials.

Fodcha evolved across multiple versions while retaining its core botnet role. Early and later variants differed mainly in command-and-control handling and infrastructure resilience. Later versions adopted encrypted command-and-control communications and more distributed backend infrastructure to complicate analysis and takedown. The malware decrypts embedded configuration data at runtime, performs a staged registration handshake with its controllers, and can disguise its process name. It has also been observed exiting when launched without expected parameters, consistent with a simple anti-analysis measure.

Its primary operational capability is DDoS attack execution, with command support also including heartbeat and termination control. Later reporting indicates the botnet expanded its monetization model by embedding extortion demands directly into attack traffic, demanding payment to halt attacks. Fodcha has also been assessed as a rentable DDoS-for-hire capability. The botnet’s infrastructure and protocol design emphasize resilience, scale, and defense evasion, making it a persistent threat to exposed internet-connected systems.