When a botnet operator names their payload after your team, you check the diff.

libcyn.so → deepfield.so
Custom cipher → wolfSSL TLS 1.3 (same stack as earlier Kimwolf)

C2 domains, floods, targets: all unchanged.

9a28696774d9ef6754540633daeef668767df5efa1804138abd35e1a6b31523e

#drifter #threatintel #ddos

“I had a dream about you last night... It was about a dreamer and a drifter walking into a bar. They start talking and swapping stories. No matter what the drifter says the dreamer always one-upped him. The drifter then woke up and realized he was the dreamer.”
― Marshall Ramsay

#Bot #Quote #Bar #Conversation #Dreaming #Dreams #Drifter #OneUp #Stories

New, from our @deepfield ERT: found a new botnet dressing its C2 traffic as camera management.

#Drifter names its domains after Hikvision products, blending with surveillance traffic on the same VLAN as the Android TV boxes it infects. DNS queries go through an Australian resolver, which somewhat undermines the cover if your bot is in São Paulo.

71 KB binary, already linked to attacks exceeding 2 Tbps from 80k sources. At least six operators are now competing for the same devices.

https://github.com/deepfield/public-research/blob/main/drifter/report.md

#threatintel #ddos

In celebration of Sylvia’s 1982 Country Cross-over smash-hit “Nobody” just recently hitting 10 million views on YouTube; I created a few collages featuring her incredible music career.

#sylvia #nobody #youtube #80s #vinylcommunity #music #countrymusic #artist #legend #drifter #rcarecords #snapshot #naturechild #musicislife 

I suspect that great kilt is called that not because size of the cloth, but bcs it's just a great piece of kit. It's a garmet, it's a blanket, it's a tent. Drifter's best friend i'd say.

#drifter