Loading story…
Kaspersky reported that TDL-4, an advanced evolution of the TDSS malware family, combined bootkit persistence, a powerful rootkit, and custom-encrypted HTTPS communications to create one of the most resilient malware platforms of its time. The malware hid itself and other payloads, removed competing malware from infected systems, and blocked rival botnet infrastructure, while also supporting monetization through proxy services, search-result manipulation, and advertising fraud. Kaspersky’s analysis of backend databases indicated that 4,524,488 computers were infected in the first three months of 2011, with nearly one-third of victims located in the United States.
A key innovation was TDL-4’s use of the public Kad peer-to-peer network through the kad.dll module, allowing operators to distribute commands and maintain control even if traditional command-and-control servers were taken down. Additional components such as Socks.dll enabled proxy functionality and cmd64.dll added 64-bit support, extending the botnet’s reach and durability. Researchers said the architecture was designed to make the botnet effectively indestructible, underscoring how TDL-4 raised the bar for stealth, survivability, and criminal monetization in large-scale malware operations.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
By May 2011, analysis showed TDL-4 had evolved into a highly sophisticated TDSS variant using bootkit functionality, rootkit stealth, encrypted HTTPS communications, and the public Kad P2P network via kad.dll for command and control. The malware also monetized infections through proxy services, search-result manipulation, ad fraud, and included 64-bit support while removing competing malware.
Kaspersky Lab's analysis of backend databases found that TDL-4 infected 4,524,488 computers during the first three months of 2011, with nearly one-third of infections located in the United States. This established the scale of the botnet's global spread.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 75 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The TDSS malware family developed from the early `TDL-1` variant into increasingly advanced rootkits that hid files, registry keys, ports, and injected modules while strengthening persistence and anti-analysis capabilities. Later versions infected kernel components and critical disk drivers such as `atapi.sys`, with some payloads stored as encrypted data in the final sectors of the disk, allowing the malware to survive detection and maintain deep control over compromised systems. Researchers reported that TDSS also operated as a commercialized botnet platform, using affiliate distribution models, partner IDs, and pay-per-install schemes to spread through fake codecs, key generators, drive-by downloads, and other botnets. Its infrastructure communicated with command-and-control servers over HTTPS with `RC4`- and `BASE64`-protected requests, and its common payload, `tdlcmd.dll`, enabled command execution, download-and-execute activity, click fraud, search-result manipulation, blackhat SEO, and browser traffic redirection; at its height, the botnet was estimated to control roughly 3 million infected machines, with many victims in the United States.
Jun 29, 2026
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 21, 2026
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026