Loading story…
Researchers analyzed NULLZEREPTOOL, a Python-based attack framework exposed in Pastebin posts, and found a Telegram-controlled platform focused primarily on distributed denial-of-service operations. The tool links two source-code variants through shared credentials and core logic: an earlier build centered on DDoS and proxy management, and a later version that retained the same attack engine while expanding into additional modules. Analysis showed support for 20 DDoS methods, Telegram-based command and control, proxy harvesting and validation, a Flask API, key management, and logging tied to payment-card data, with evidence that the framework was tested against several websites.
The newer code also introduced wireless attack functions, credential-related features, and a hierarchical botnet tasking model, but researchers said many of those additions appear incomplete or unproven. Flare found that the DDoS engine, Telegram C2, and proxy pipeline were implemented in source, while the WiFi, Bluetooth, credential-theft, and broader botnet capabilities appeared to depend on missing client artifacts or external tooling. The assessment concludes that NULLZEREPTOOL is best understood as a low-tier, Telegram-managed DDoS panel showing signs of malware-as-a-service feature expansion rather than a confirmed advanced botnet or wireless exploitation platform.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Analysis of the exposed code found NULLZEREPTOOL to be a Telegram-controlled attack framework with DDoS orchestration, rotating proxies, and related infrastructure. Researchers linked the later code to the earlier variant through shared credentials and core logic, while assessing many expanded features as unconfirmed or immature.
A second Pastebin post on April 29, 2026 exposed a later NULLZEREPTOOL code variant. It retained the DDoS core while adding wireless attack modules, credential-related functions, and a hierarchical botnet tasking model in server-side code.
Researchers identified an earlier Python-based NULLZEREPTOOL variant from a Pastebin post on April 27, 2026. This version was centered on DDoS functionality and proxy management.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 21, 2026
Researchers reported multiple malware families abusing **Telegram** as a command-and-control and exfiltration channel, highlighting how attackers are repurposing the messaging platform’s bot infrastructure for low-cost, resilient operations. Check Point detailed **ToxicEye**, a multi-function remote access trojan delivered through phishing emails with malicious executables or documents, and said it was observed in more than 130 attacks over a three-month period. Once installed, ToxicEye can steal data, manipulate files, terminate processes, log keystrokes, capture clipboard contents, hijack microphones and cameras, and encrypt files in a ransomware-like manner. The reporting also linked ToxicEye to a broader pattern that includes **Masad Stealer**, another malware family using Telegram to move stolen information and receive operator commands. By relying on a legitimate cloud service, attackers can blend malicious traffic with normal user activity, manage infected hosts anonymously through Telegram bots, and even administer campaigns from mobile devices. The cases underscore a continuing shift toward abuse of trusted consumer platforms to simplify malware deployment, remote control, and data theft.
Aug 15, 2026