Network Security Research Lab at 360
Beijing
Joined January 2018
- Tweets423
- Following12
- Followers4.6K
- Likes55
Our latest blog, a malware based on CIA’s HIVE attack kit has been observed by us.
blog.netlab.360.com/headsup_…
So, we published our Fodcha botnet blog two days ago, and the author behind this botnet pushed an updated new sample with the following message inside....🤪
What are the most active P2P based botnets on the internet now, and what are their sizes? We(360netlab) have a tracking system in place for a while and here are some basic information about Pink,Mozi,Hajime,FritzFrog and Panchan.
blog.netlab.360.com/p2p-botn…
New version of Fodcha is bigger and probably better, and attacking various websites like there is no tomorrow. (in previous version, the author left a note saying "Netlab pls leave me alone I surrender", it does not seem so) blog.netlab.360.com/fodcha-i…
We have noticed that some malware authors pay attention to who downloads their malwares from their downloader servers, aka, they do their security data analysis, if a device other than their own bots connect to their downloader, they DDoS these device IPs.
Our latest blog is about a new Monroe coin mining botnet Orchard, among other things, this botnet uses Satoshi Nakamoto's Bitcoin account transaction information to generate DGA domain names to evade detection. blog.netlab.360.com/a-new-bo…
A new updated fbot have been attacking various big names, it is now one of the most active DDos botnets that we have observed recently, more details can be found from our recently published blog blog.netlab.360.com/botnet-g… (in Chinese, but google translate will do the trick).
360 Netlab retweeted
Analysing hundreds of billions of daily DNS queries to produce actionable threat intelligence. #Skidmap and malicious DNS data mining by @360Netlab's Zhang Zaifeng: blog.apnic.net/2021/04/19/sk…
#Malware #threatintelligence #Throwback
360 Netlab retweeted
Here at Quad9, we saw fridgexperts[.]cc skyrocket to our top blocked site with a whopping 30M+ blocks in just under 24 hours--starting ~noon UTC on the 14th!
#Fodcha #DDoS #botnet #DNS
New Fodcha DDoS botnet targets over 100 victims every day - @serghei
bleepingcomputer.com/news/se…
Our latest blog, a new DDoS botnet Fodcha, which is big, and very active attacking various targets, some of the victims are the world top popular domains(top 10 companies) blog.netlab.360.com/fodcha-a…
👍
We're at 868M blocks this week so about 12.6% growth week over week. Thanks to our top 5 #threatintel partners @DomainTools @threatstop @360Netlab @IBMSecurity #xforce @mnemonicorg
#DNS #security #privacy
Our latest blog, blog.netlab.360.com/b1txor20… B1txor20, a new Linux backdoor rides on the Log4J vulnerability and uses DNS tunnel for C2 communications.
We observed that ripprbot botnet has instructed its bots to attack targets 147.237.0.0, 147.237.64.0 and 147.237.68.0, all belong to Israeli Government Network
A DDoS attack today against Israel reportedly took down the country's government websites.
@kentikinc observed a DDoS attack focused primarily against AS8867 (Israeli E-Government Project) beginning just before 15:30 UTC (5:30pm local).
haaretz.com/israel-news/.pre…
Our latest blog about the recent Ukraine and Russia DDoS attacks, takeaway: botnets are actively been recruited for attacks on both sides and Russia actually receives more DDoS than Ukraine does. blog.netlab.360.com/some_det…
We also see multiple botnets related DDos targeting Russian websites, for example, kremlin.ru, fsb.ru, digital.gov.ru, baltbank.ru got attacked about 2 hours ago, and duma.gov.ru is being DDosed right now
More updates on Ukraine related DDos attacks, so far we have seen 15 C2s being used to launch DDos attacks. Some targets appear to make sense(attacks targeting banks and mil.gov.ua websites just few hours ago), some are little strange(pizza site and taxi site???)
