‼️ BREAKING: Unauthenticated attackers are hijacking Plex Media Servers. Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began. A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.

> be chinese financially motivated threat actor > create big ass fuck off botnet > botnet transforms machines into proxies > sell proxies on IPweb > make big money > millions of dollars > accidentally push source code of botnet to GitHub > accidentally push source code of botnet to GitHub > @synthient finds it > hello mr synthient can i have the goop code? > "sure?" > gives > download it thank you mysterious group of chinese people for accidentally uploading your botnet code to github. i have goop code now

Chinese-speaking proxy services are often grouped together as belonging to IPIDEA or Kookeey. In reality, the ecosystem is incredibly diverse and includes a number of custom botnets. This report focuses on one of those providers: IPWeb.

In our latest research, we reveal the inner workings of APSolo, one of the largest Chinese proxy botnets. The botnet continues to fuel DDoS attacks, fraud, and other cybercrime. Using multiple source-code and infrastructure pivots, we linked it to the Chinese proxy provider IPWeb. Provider: IPWeb Malware Family: Proxyware.APSolo Size: 800K - 1.2 million daily active IPs Full Story: synthient.com/blog/ipweb-pee…

#Sysorbit is an Android DDoS botnet disguised as "Google Play Service." It is derived from the Mirai family but has been thoroughly adapted for the Android environment. apk hash: 6b926acb42e6519747d72ddb0bfecb8f4e346d28 cnc: tblcxmo.duckdns[.org udpatetbl.duckdns[.org