Looks like that ddos against sourcehut is still ongoing. It really sucks seeing petty destructive actions like this. Support to all the staff working on containing it.

#sourcehut #ddos #hugops

Masjesu Botnet neu unterwegs: DDoS-for-Hire via Telegram, infiziert IoT (Router/Gateways, multi-arch). Hohe Persistence, vermeidet Blacklists/CI. Default-Passwörter killen! THN: https://thehackernews.com/2026/04/masjesu-botnet-emerges-as-ddos-for-hire.html #IoTSec #DDoS
Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

Masjesu botnet drives global DDoS attacks since 2023, with nearly 50% traffic from Vietnam, threatening enterprises and IoT devices.

The Hacker News

Evasive Masjesu DDoS Botnet Targets IoT Devices

Focused on persistence, the botnet does not engage in widespread infection and avoids blacklisted IPs and critical infrastructure entities.
#Botnet #Iot #CyberAttacks #DDos

https://www.securityweek.com/evasive-masjesu-ddos-botnet-targets-iot-devices/?utm_source=dlvr.it&utm_medium=threads

Evasive Masjesu DDoS Botnet Targets IoT Devices

The DDoS-capable Masjesu botnet focuses on evasion and persistence, but targets a broad range of IoT devices to spread.

SecurityWeek
🚨 CRITICAL Masjesu DDoS botnet targets IoT devices with persistence and evasion — avoiding blacklisted IPs & critical infra. No known exploits in the wild. No patches yet — monitor for anomalies. https://radar.offseq.com/threat/evasive-masjesu-ddos-botnet-targets-iot-devices-aef686d5 #OffSeq #IoTSecurity #DDoS #Botnet

DDoS attack hits Rostelecom
• Banks, govt portal offline
• Telegram, Steam disrupted
• Mitigation triggered wider outage
Infrastructure-level attacks at scale.

https://www.technadu.com/rostelecom-ddos-attack-triggers-major-russian-network-outage-impacting-banks-government-portal-games/625525/

#Infosec #Cybersecurity #DDoS

When a botnet operator names their payload after your team, you check the diff.

libcyn.so → deepfield.so
Custom cipher → wolfSSL TLS 1.3 (same stack as earlier Kimwolf)

C2 domains, floods, targets: all unchanged.

9a28696774d9ef6754540633daeef668767df5efa1804138abd35e1a6b31523e

#drifter #threatintel #ddos

My blog #BurgeonLab relies on #SourceHut Git and Builds. They’ve been down and at first I couldn’t deploy my site to my static host, #Bunnynet.

This triggered me to create a local script that runs all the fetch/build steps as an alternative pathway to upload directly from my Mac instead of using the CI runner.

View full note: https://burgeonlab.com/notes/2026/0408-3421

Syndicated with #Indiekit

#CICD #CI #Githubctions #srht #ddos #gitforge #git #continuousintegration #bash #script #statichost #statichosting

Oh... #sourcehut is down because of #ddos.

https://status.sr.ht/issues/2026-04-06-ddos-attack/

I can't git push my weeknote to my repo for #cicd

Hope the devs manage to fix it soon (thanks for the hard work)

#srht

📢 Démantèlement du botnet Kimwolf : 26 000 attaques DDoS via des proxies résidentiels compromis
📝 ## 🗞️ Contexte

Article publié le 2 avril 2026 par le Wall Street Journal, relatant l'investigation ayant conduit au...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-04-demantelement-du-botnet-kimwolf-26-000-attaques-ddos-via-des-proxies-residentiels-compromis/
🌐 source : https://www.wsj.com/tech/kimwolf-hack-residential-proxy-networks-a712ab59
#Android #DDoS #Cyberveille

Démantèlement du botnet Kimwolf : 26 000 attaques DDoS via des proxies résidentiels compromis

🗞️ Contexte Article publié le 2 avril 2026 par le Wall Street Journal, relatant l’investigation ayant conduit au démantèlement du botnet Kimwolf, l’un des plus puissants jamais observés sur internet. L’opération de police fédérale américaine a été annoncée le 19 mars 2026. 🎯 Le botnet Kimwolf Kimwolf est un botnet de type DDoS-as-a-service ayant lancé plus de 26 000 attaques DDoS ciblant plus de 8 000 victimes. À son apogée, il comptait environ 2 millions d’appareils compromis, avec des dizaines de milliers de nouveaux appareils ajoutés quotidiennement. Les opérateurs dépensaient environ 30 000 dollars par mois pour les serveurs de commande et contrôle.

CyberVeille

Our servers have been attacked by large corporations (it's very easy to actually guess the names). Initial report is written by one of our webmasters on LinkedIn: https://www.linkedin.com/posts/codingthunder_openai-share-7446088418696278016-ELwc?utm_source=share&utm_medium=member_desktop&rcm=ACoAADMaVGQBMie9fjqAkNXeVEioLRp8xlgIrDY

#ddos #termux #android #openai #ai #aislop

I wanna apologize for sending an external link to LinkedIn, but I just don't have the bandwidth to rewrite it here with formatting after spending a considerable time yesterday fixing the wiki while I should have been sleeping.

#openai | Yaksh Bariya

I'm not sure how long this "AI bubble" is going to last, but as a webmaster I'm now very tired with OpenAI, ByteDance, and other AI companies absolutely wrecking a chaos on public internet. Their crawlers don't give a shit about how many requests they do in a second. Yesterday it has come into my account that #openai's crawlers have moved from using "OpenAI" string in their user agent to "Intel MacOS" useragent to bypass people trying to protect their sites from rampant crawling. The server running MediaWiki for wiki.termux.dev was hit from 27k+ ip addresses in the past 12 hour window coming all from different IP ranges. Also what's surprising is that ByteDance IP ranges changed the user agent string the same time as OpenAI's crawlers. This can't be a coincidence, but seems like the entire AI industry is run by bunch of people who don't want to be responsible for their actions and want to make money off of blatant scraping and forcing a lot of small community sites and forms to shutdown. It is surely not a coincidence that a we started receiving bot requests from both ByteDance's crawlers and OpenAI's with the same user agent? Also a good chunk of these requests are coming from residental IPs. It is very likely that a bunch of ISPs are either giving their residental IPs to these AI companies, or they have resorted to buying residental connections for large scale scraping. Generally DDoS from residental IP ranges means that the attack is carried down by some script kiddie or some wannabe "cool hacker" who is operating a botnet and wants to demonstrate the scale of their attack to potential clients. There are also a lot of requests which seem to be coming from no-name ASNs which have no information available publicaly about what they do. Which is too fishy for such a large number of requests. This is not the full report, I'm planning to do a full report about this soon. Just wanted to rant out my frustration with me spending around 2-3 hours yesterday when I should be sleeping just because some people don't believe in the collective good use of internet bandwidth. I'm pretty sure there are a lot of other people as well who are dealing with this nonsense of AI crawlers

LinkedIn