Loading story…
Researchers documented BillGates as a Linux malware family built primarily for distributed denial-of-service attacks, with variants capable of launching TCP, UDP, ICMP, HTTP, DNS flood, and DNS amplification campaigns. Analyses of multiple samples showed a modular design, command-and-control communications, and persistence through cron jobs and init scripts, while newer variants added stronger process monitoring and self-reinstallation behavior. Beyond DDoS activity, the malware also provided limited backdoor and rootkit functionality, including remote command execution, component updates, and the ability to download additional payloads.
Subsequent reporting tied BillGates to the broader ChinaZ threat ecosystem, where investigators observed the malware deployed alongside Windows-based tools including Gh0st RAT variants and a DDoS client, suggesting a unified botnet spanning Linux and Windows hosts. Researchers linked the activity through shared infrastructure, honeypot observations, and hosted attack tooling, while defenders were advised to hunt for filesystem artifacts, lock files, startup entries, altered system binaries, and cron-based persistence, then remove malicious processes, restore legitimate utilities, scan for follow-on malware, and rotate credentials after cleanup.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
Intezer published research linking ChinaZ to BillGates, Gh0st RAT variants, ChinaZ.DDoSClient, and related tooling hosted on Chinese HFS servers. The report also noted overlaps with Nitol, ServStart, MrBlack, and a Gh0st RAT RC4 key previously seen in Iron Tiger's Operation PZCHAO.
Bart Blaze published a practical overview of Linux/BillGates describing its DDoS, rootkit, and backdoor capabilities along with filesystem artifacts, persistence locations, and cleanup steps. The post highlighted indicators such as /etc/cmd.n, /etc/conf.n, /etc/init.d/DbSecuritySpt, lock files in /tmp, and replaced system utilities.
MalwareMustDie published research on a new ChinaZ-linked malware variant named ELF Linux/BillGates.Lite. The report indicates continued development of the BillGates malware family beyond earlier documented variants.
The Intezer report states that ChinaZ, a Chinese threat actor, has been deploying DDoS botnets since at least November 2014. The group targeted both Linux and Windows systems.
A Russian IT website published an article in February 2014 describing the BillGates Linux botnet as a Trojan with versatile DDoS functionality. This is the earliest dated public reference to the malware in the provided sources.
Investigators used the shared C2 domain ak-74.top with RiskIQ and Shodan to identify additional ChinaZ-linked HFS servers. Those servers hosted more Windows malware plus a 7z archive containing Python-based port scanning and DDoS tooling.
After one day, the same ChinaZ HFS panel was updated with two ChinaZ.DDoSClient samples compiled for x86 and x86_64 systems. This showed active refresh of hosted malware on the operational server.
Researchers found a transient Chinese HFS server hosting Linux BillGates binaries and a Windows Gh0st RAT sample named BX.exe. The BillGates and Gh0st RAT samples decoded to the same command-and-control address, indicating a unified botnet targeting Linux and Windows systems.
Intezer researchers reported increased attack volume from BillGates attributed to ChinaZ. They observed intrusions using SSH and Telnet brute-force attacks followed by a bash downloader that executed implants from /root or /tmp.
Securelist analyzed BillGates samples detected as Backdoor.Linux.Mayday.f and Backdoor.Linux.Ganiw.a, documenting modular Linux DDoS malware with cron and init-script persistence, C2 communications, and multiple flood capabilities. The analysis covered simpler atddd-family samples and the more advanced cupsdd/cupsddh pair.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
intezer.com
Open sourcebartblaze.blogspot.com
Open sourceblog.malwaremustdie.org
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
New threat research described two distinct botnet operations expanding through mass compromise. Flare reported a previously undocumented Linux botnet it dubbed **SSHStalker**, observed via an SSH honeypot and characterized by *IRC-based* command-and-control with multiple bot variants (including legacy families such as **Tsunami** and **Keiten**), automated scanning and staging (including a Golang scanner masquerading as `nmap` behavior and a compile-and-run workflow), and noisy but effective persistence via `cron` jobs that can re-establish the bot within roughly a minute if not fully removed. The tooling also included log-tampering artifacts (e.g., `utmp/wtmp/lastlog` manipulation) and a “back-catalog” of older Linux 2.6-era exploits, suggesting the operator is targeting long-tail, poorly maintained infrastructure; Flare noted playbook similarities to **Outlaw/Maxlas**-style operations but did not claim definitive attribution. Separately, reporting on a Silent Push analysis described a large **SystemBC** (aka **Coroxy/DroxiDat**) botnet comprising **10,000+** infected IPs globally, with notable concentrations in the US and additional presence across Europe and Asia. SystemBC is described as **SOCKS5 proxy malware** commonly used by threat actors to mask downstream activity and historically associated with enabling ransomware deployment; the report highlighted infections linked to **government-related domains** based on passive DNS observations, indicating potential exposure of sensitive environments even when immediate follow-on payloads were not directly observed. A third article provided general technical background on how internet-wide scanners (e.g., Shodan/Censys-style platforms) perform active service identification and banner grabbing; it is contextual but does not report on either botnet operation specifically.
Jun 29, 2026