Loading story…
U.S. prosecutors in Chicago charged Turkish national Izzet Mert Ozek with directing a distributed denial-of-service attack against a Chicago-based multinational hospitality company, alleging he used the WireX botnet to overwhelm the company’s website and disrupt hotel bookings. The indictment says the August 2017 attack targeted a luxury hotel and resort operator whose web servers were hosted in northern Illinois, and authorities said Ozek is believed to be in Turkey, where an arrest warrant is expected.
WireX was previously dismantled through a joint effort by technology and security firms after researchers linked the botnet to roughly 300 malicious Android apps distributed through Google Play. The malware infected at least 70,000 devices—and telemetry suggested as many as 130,000 to 160,000 unique IP addresses participated in attacks across more than 100 countries—while using headless browser activity and SSL-encrypted traffic to make malicious requests resemble legitimate mobile web traffic, complicating mitigation efforts.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Federal prosecutors in Chicago announced an indictment charging Turkish national Izzet Mert Ozek with directing a WireX-based DDoS attack against a multinational hospitality company. The charge alleges he intentionally caused damage to a protected computer and that a warrant for his arrest would be issued.
On August 17, 2017, multiple CDNs and content providers were hit by significant application-layer DDoS attacks attributed to the WireX Android botnet. Researchers said the attacks involved at least 70,000 concurrent IP addresses from more than 100 countries.
Researchers first saw a small number of compromised Android devices conducting relatively small DDoS attacks, marking the initial emergence of the WireX botnet. This was the first explicit observation of the campaign in the source material.
During August 2017, WireX was used to disrupt several large hospitality-sector websites. A later U.S. indictment alleged one of these attacks targeted a Chicago-based multinational hospitality company and interfered with hotel bookings.
In less than two weeks after first surfacing, WireX grew from a small cluster of infected devices into a botnet of tens of thousands of compromised Android systems. Researchers later estimated at least 70,000 infected devices, with some telemetry showing 130,000 to 160,000 unique IPs in attacks.
Technology and security companies jointly announced that they had dismantled the WireX Android DDoS botnet. The public disclosure tied the botnet to roughly 300 malicious Google Play apps and described attacks originating from devices in more than 100 countries.
Google said it identified about 300 Android apps associated with WireX, blocked them from Google Play, and began removing them from affected devices. The apps appeared benign while secretly installing malware that connected phones to command-and-control servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcetherecord.media
Open sourcekrebsonsecurity.com
Open sourceblog.cloudflare.com
Open sourceflashpoint-intel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. and Canadian authorities arrested 23-year-old Ottawa resident Jacob Butler, also known as **"Dort,"** and unsealed charges alleging he was a principal administrator of the **Kimwolf** DDoS botnet. Prosecutors said Kimwolf was a variant of the **Aisuru** botnet and part of a broader ecosystem that hijacked millions of internet-connected devices, including more than 2 million Android TV devices and other IoT hardware such as webcams and digital photo frames. Investigators said the botnet enabled hundreds of thousands of attacks, issued more than 25,000 attack commands, and was linked to DDoS activity reaching nearly **30 Tbps**, including attacks affecting Department of Defense network IP ranges. Authorities said Butler was identified through overlapping IP usage, Google account artifacts, machine cookies, Discord and messaging records, transaction data, and other account information. Canadian officials arrested him on a U.S. extradition warrant while also filing domestic computer crime charges, and the Justice Department said law enforcement had already seized infrastructure tied to **Kimwolf**, **Aisuru**, **JackSkid**, and **Mossad** in March. Court records and reporting indicate Kimwolf resumed operations after that takedown, and the case also includes allegations that Butler harassed security researchers and claimed responsibility for swatting attacks against Synthient founder Ben Brundage after the company helped mitigate a flaw that Kimwolf had exploited for rapid spread.
Jun 29, 2026
U.S., Croatian, and Swiss authorities disrupted the long-running **NetWire** remote access trojan operation by seizing the `worldwiredlabs[.]com` sales domain, arresting alleged operator Mario Zanko in Croatia, and taking related infrastructure offline in Switzerland. The U.S. Department of Justice said the FBI investigated the malware distributor from 2020, including undercover purchases and analysis of NetWire’s builder tool, before obtaining the seizure warrant. NetWire had been marketed since 2012 as cross-platform remote administration software, but investigators said it was widely used for credential theft, keystroke logging, remote device control, fraud, data breaches, and intrusions affecting sectors including healthcare and banking. Security research tied NetWire to multiple criminal campaigns and customized variants long before the takedown. Avast documented **WiryJMPer**, an obfuscated dropper disguised as cryptocurrency wallet software that decrypted and launched a NetWire payload while establishing persistence on infected Windows systems. VMware also analyzed a **HYDSEVEN** variant that altered NetWire’s command-and-control authentication and encryption, showing how threat actors adapted the malware for tailored operations. The malware had also targeted macOS users and appeared in broader phishing and exploit-driven campaigns, underscoring NetWire’s longevity and flexibility across platforms.
Aug 15, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026