DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

Pulse ID: 69f25f09e5c3a33611f7cb16
Pulse Link: https://otx.alienvault.com/pulse/69f25f09e5c3a33611f7cb16
Pulse Author: AlienVault
Created: 2026-04-29 19:42:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

Hackers are hijacking corporate #XWiki servers using flaw CVE-2025-24893 to install cryptominers and gain full server access. Patch now. 🔒

Read: https://hackread.com/hackers-hijack-xwiki-servers-crypto-mining/

#CyberSecurity #RCE #Cryptojacking #XWiki #InfoSec

⚠️ LunoBotnet: A modular Linux botnet with cryptomining + DDoS-for-hire.
✔️ Self-healing watchdogs
✔️ System binary replacement
✔️ Targets Roblox, Minecraft, Valve
✔️ Markets services via Telegram
Experts call it a criminal infrastructure platform for long-term monetization.

💬 How do you rate the detection difficulty here? Follow @technadu for analysis.

#Cyble #LunoBotnet #LinuxMalware #Cryptojacking #DDoS #Botnet #SelfHealing #Malware #CyberThreatIntel

Misconfigured Docker APIs are a hacker’s gateway to secret crypto-mining—thanks to Tor, stopping them is tougher than ever. Is your cloud truly secure?

https://thedefendopsdiaries.com/securing-docker-apis-navigating-the-threat-landscape/

#dockersecurity
#cybersecurity
#cloudsecurity
#cryptojacking
#tor

Watch Out: A new malware hijacking Windows Character Map to mine #crypto on a targeted device, exposing risks of attacks in everyday software processes.

Read: https://hackread.com/new-malware-uses-windows-character-map-cryptomining/

#CyberSecurity #Malware #Cryptomining #Cryptojacking #Windows