Loading story…
Darktrace reported that a threat actor exploited a weakly protected Jenkins honeypot by abusing the scriptText endpoint for remote code execution, then deployed a cross-platform botnet designed to attack online game infrastructure. The intrusion used a single IP address, 103[.]177.110.202, for payload delivery, initial access support, and command-and-control—an unusual consolidation of attacker infrastructure. The malicious Jenkins script delivered separate Windows and Linux payloads, with the Windows variant adding a firewall rule for TCP port 5444 and the Linux variant establishing stealth and persistence after execution.
Analysis of the Linux malware showed it deleted its original executable, renamed itself to resemble legitimate kernel worker processes, daemonized itself, suppressed I/O, and ignored termination signals, including using Jenkins-specific environment variables to avoid being killed. The botnet accepted commands such as PING, !stop, and !update, and supported several denial-of-service techniques including UDP floods, TCP push floods, HTTP floods, and Valve Source Engine query abuse aimed at gaming servers. Darktrace assessed the activity as opportunistic exploitation of exposed or misconfigured internet-facing Jenkins systems to build DDoS capacity against the gaming sector.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Darktrace publicly reported technical details of the intrusion, including use of 103.177.110.202 for payload delivery, initial access support, and command-and-control, plus Windows and Linux payload behavior and DDoS capabilities. The analysis highlighted game-server-focused attack methods such as Valve Source Engine query abuse and assessed the activity as opportunistic exploitation of exposed misconfigurations.
On 2026-03-18, Darktrace observed a threat actor exploit the scriptText endpoint on its intentionally weak Jenkins honeypot to achieve remote code execution and deploy malware. The activity was aimed at building a botnet for DDoS attacks against online video game servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcedarktrace.com
Open sourcedarktrace.com
Open sourcedarktrace.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **`xlabs_v1`**, a Mirai-derived botnet that compromises internet-exposed Android and IoT devices with **ADB enabled on TCP port `5555`** and repurposes them for **DDoS-for-hire** attacks, with a strong focus on **Minecraft and other game servers**. Hunt.io traced the operation to bulletproof-hosted infrastructure in the Netherlands, including an exposed server at **`176.65.139[.]44`** and a control panel tied to **`xlabslover[.]lol`**. The malware drops a bot binary into **`/data/local/tmp/`**, disguises itself as **`/bin/bash`**, decrypts configuration data with **ChaCha20**, and communicates with command-and-control over **TCP port `35342`**. Analysts also found an embedded operator handle, **"Tadashi,"** though attribution remains unconfirmed. The botnet supports **21 flood methods** across TCP, UDP, and raw protocols, including a **RakNet flood** capability tailored to disrupt Minecraft services, and it even serves its bot binary over **TCP port `25565`**, the default Minecraft server port. Hunt.io said the malware profiles victim bandwidth by opening **8,192 parallel TCP sockets** to nearby Speedtest servers, likely to sort infected devices into service tiers for customers. The malware also includes a built-in killer to remove competing malware and a fallback access path on **TCP port `26721`**, but it lacks persistence and must reinfect devices through the same exposed ADB route. Separately, Darktrace reported threat actors abusing a deliberately misconfigured Jenkins honeypot to deploy another DDoS botnet, underscoring continued targeting of gaming-related infrastructure.
Jun 29, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026