Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QTBotnet: This platform is composed of a main controller server, secondary level control servers, and compromised devices... The control server can launch DDOS attacks, view nodes, import nodes, run commands on compromised IoT devices, and manage the level 2 servers.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet-control platform used to manage compromised devices through primary and secondary control servers. Its controller can execute commands on infected nodes and launch DDoS attacks.
A multi-tier botnet platform comprising a main controller, secondary control servers, and compromised devices. It supports node management, command execution on compromised IoT devices, and DDoS attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.