360 Netlab @360Netlab

Network Security Research Lab at 360 blog.netlab.360.com Beijing Joined January 2018

Tweets

423
Followers

5K
Following

12
Likes

55

360 Netlab @360Netlab

3 years ago

Our latest blog, a malware based on CIA’s HIVE attack kit has been observed by us. blog.netlab.360.com/headsup_xdr33_…

1 29 67 17K 9

360 Netlab @360Netlab

3 years ago

So, we published our Fodcha botnet blog two days ago, and the author behind this botnet pushed an updated new sample with the following message inside....🤪

1 3 24 0 2

Download Image

What are the most active P2P based botnets on the internet now, and what are their sizes? We(360netlab) have a tracking system in place for a while and here are some basic information about Pink,Mozi,Hajime,FritzFrog and Panchan. blog.netlab.360.com/p2p-botnets-re…

0 6 6 0 1

360 Netlab @360Netlab

3 years ago

New version of Fodcha is bigger and probably better, and attacking various websites like there is no tomorrow. (in previous version, the author left a note saying "Netlab pls leave me alone I surrender", it does not seem so) blog.netlab.360.com/fodcha-is-comi…

0 7 9 0 1

360 Netlab @360Netlab

3 years ago

We have noticed that some malware authors pay attention to who downloads their malwares from their downloader servers, aka, they do their security data analysis, if a device other than their own bots connect to their downloader, they DDoS these device IPs.

1 3 13 0 2

360 Netlab @360Netlab

3 years ago

Our latest blog is about a new Monroe coin mining botnet Orchard, among other things, this botnet uses Satoshi Nakamoto's Bitcoin account transaction information to generate DGA domain names to evade detection. blog.netlab.360.com/a-new-botnet-o…

0 5 8 0 1

360 Netlab @360Netlab

3 years ago

Okay, one botnet author has this written in his new program..🤪

1 4 54 0 1

Download Image

360 Netlab @360Netlab

3 years ago

A new updated fbot have been attacking various big names, it is now one of the most active DDos botnets that we have observed recently, more details can be found from our recently published blog blog.netlab.360.com/botnet-group-b… (in Chinese, but google translate will do the trick).

0 5 12 0 0

Download Image

APNIC @apnic

3 years ago

Analysing hundreds of billions of daily DNS queries to produce actionable threat intelligence. #Skidmap and malicious DNS data mining by @360Netlab's Zhang Zaifeng: blog.apnic.net/2021/04/19/ski… #Malware #threatintelligence #Throwback

1 3 6 0 2

Download Image

Quad9 @Quad9DNS

3 years ago

Here at Quad9, we saw fridgexperts[.]cc skyrocket to our top blocked site with a whopping 30M+ blocks in just under 24 hours--starting ~noon UTC on the 14th! #Fodcha #DDoS #botnet #DNS

BleepingComputer @BleepinComputer

3 years ago

Here at Quad9, we saw fridgexperts[.]cc skyrocket to our top blocked site with a whopping 30M+ blocks in just under 24 hours--starting ~noon UTC on the 14th! #Fodcha #DDoS #botnet #DNS

0 14 22 0 2

0 4 13 0 1

360 Netlab @360Netlab

3 years ago

Fodcha author on the move again after we published our blog. The C2 IPs have changed.

哈德兔比利 @xuy1202

3 years ago

Fodcha author on the move again after we published our blog. The C2 IPs have changed.

0 1 6 0 0

Download Image

0 0 5 0 1

360 Netlab @360Netlab

3 years ago

Our latest blog, a new DDoS botnet Fodcha, which is big, and very active attacking various targets, some of the victims are the world top popular domains(top 10 companies) blog.netlab.360.com/fodcha-a-new-d…

0 5 12 0 4

360 Netlab @360Netlab

3 years ago

👍

Quad9 @Quad9DNS

3 years ago

👍

0 5 22 0 0

Download Image

0 0 4 0 0

360 Netlab @360Netlab

4 years ago

Our latest blog, blog.netlab.360.com/b1txor20-use-o… B1txor20, a new Linux backdoor rides on the Log4J vulnerability and uses DNS tunnel for C2 communications.

1 57 149 0 32

Download Image

360 Netlab @360Netlab

4 years ago

We observed that ripprbot botnet has instructed its bots to attack targets 147.237.0.0, 147.237.64.0 and 147.237.68.0, all belong to Israeli Government Network

Doug Madory (also on Bluesky) @DougMadory

4 years ago

We observed that ripprbot botnet has instructed its bots to attack targets 147.237.0.0, 147.237.64.0 and 147.237.68.0, all belong to Israeli Government Network https://t.co/f1XZMlko8M

2 20 35 0 2

Download Image

1 8 22 0 1

Download Image

360 Netlab @360Netlab

4 years ago

Our latest blog about the recent Ukraine and Russia DDoS attacks, takeaway: botnets are actively been recruited for attacks on both sides and Russia actually receives more DDoS than Ukraine does. blog.netlab.360.com/some_details_o…

1 13 25 0 2

360 Netlab @360Netlab

4 years ago

We also see multiple botnets related DDos targeting Russian websites, for example, kremlin.ru, fsb.ru, digital.gov.ru, baltbank.ru got attacked about 2 hours ago, and duma.gov.ru is being DDosed right now

0 5 18 0 1

Download Image

360 Netlab @360Netlab

4 years ago

More updates on Ukraine related DDos attacks, so far we have seen 15 C2s being used to launch DDos attacks. Some targets appear to make sense(attacks targeting banks and mil.gov.ua websites just few hours ago), some are little strange(pizza site and taxi site???)

0 11 16 0 1

Download Image

LIU Ya @liuya0904

4 years ago

The following 5 #Emotet C2s have been keeping active since Dec, 2021. 131.100.24.199 8080 176.31.163.17 8080 51.178.186.134 443 51.79.205.117 8080 51.91.142.158 80

0 1 1 0 0

360 Netlab @360Netlab

4 years ago

An update for the Ukraine related DDos attacks, so far we have seen 4 different types of botnets(mirai, gafgyt, ircbot,ripprbot), nine unique C2 IPs, as well as daily NTP amp attacks. We have shared more detailed info to the security community and to some relevant parties.