Between February and August, the #Eleven11 was on the news. Using the parallel #DNS root #OpenNIC was nothing new for a botnet. Yet, this botnet was the first known botnet of it's size using the OpenNIC system.
We summarized insights in a new blog post: 161 Days of Eleven11
Quick nod to the brilliant folks at @nicter_jp and @xlab_qax: their latest research shows #Eleven11bot is really the next #Rapperbot evolution, leveraging a brand‑new device family.
Teamwork in action 👉 https://blog.nicter.jp/2025/06/rapperbot_2025_2g/ | https://blog.xlab.qianxin.com/rapperbot-en/
About this X DDoS campaign: I've seen reports of attribution to Ukraine, and at least based on attack data at network level — I just don't see it. (And I should note: attribution is hard, so I am generally skeptical.)
Top contributors are 🇺🇸🇲🇽🇪🇸🇮🇹🇧🇷, and as with most botnets: very geographically distributed.
Most of the source IPs intersect with #Eleven11bot as we started seeing them on 26 February.
OK, now back to regularly scheduled skiing.
Ein neu entdecktes Botnetz, das aus rund 30.000 gehackten Überwachungskameras und Videorekordern besteht, sorgt aktuell für beispiellose DDoS-Angriffe. Laut eines Sicherheitsexperten von Nokia handelt es sich sogar um die bisher größten Attacken dieser Art.
A Brand New #Botnet Is Delivering Record-Size #DDoS Attacks
#Eleven11bot infects #webcams and video recorders, with a large concentration in the US.
#security
https://www.wired.com/story/eleven11bot-botnet-record-size-ddos-attacks/
A new botnet dubbed "Eleven11bot" has emerged, delivering what security researchers believe are the largest distributed denial-of-service (DDoS) attacks ever recorded.
https://www.computing.co.uk/news/2025/security/new-botnet-unleashes-record-breaking-ddos-attacks
#ddos #cybersecurity #infosec #technews #botnet #eleven11bot
We'd like to really thank the folks over at @greynoise and @censys for providing additional insights and context: https://www.greynoise.io/blog/new-ddos-botnet-discovered
Max Resing
Deepfield
Marcel SIneM(S)US
Jérôme Meyer
Scripter 
PrivacyDigest
John Leonard
securityaffairs
