#DDoSattacks hashtag - Bluesky

DanaBot Malware Network Disrupted After Researchers Discover Key Flaw In a major breakthrough, cybersecurity experts uncovered a major weakness in the DanaBot malware system that ultimately led to the disruption of its operations and criminal charges against its operators. DanaBot, which has been active since 2018, is known for being sold as a service to carry out cybercrimes like banking fraud, stealing personal information, carrying out remote attacks, and launching distributed denial-of-service (DDoS) attacks. The malware remained a persistent threat until recent enforcement actions successfully targeted its infrastructure. Discovery of the DanaBot Weakness Researchers from Zscaler’s ThreatLabz team identified a serious flaw in DanaBot’s system in a version released in June 2022. This flaw, later called "DanaBleed," exposed the internal workings of the malware to security professionals without the attackers realizing it. The issue stemmed from changes made to DanaBot’s communication system, known as the command and control (C2) protocol. The updated system failed to properly handle random data in its responses, accidentally revealing leftover information stored in the malware’s memory. Because of this memory leak, security experts were able to repeatedly collect sensitive fragments from DanaBot’s servers over time. This flaw is similar to the infamous HeartBleed vulnerability that affected OpenSSL in 2014 and caused serious security concerns worldwide. What the Flaw Exposed Through careful analysis, researchers were able to access highly valuable information, including: • Details about the malware operators, such as usernames and IP addresses • Locations of DanaBot’s servers and websites • Stolen victim data, including login credentials • Records of malware updates and internal changes • Private cryptographic keys used for security • Internal system logs and SQL database activity • Parts of the malware’s management dashboard For more than three years, DanaBot continued to operate with this hidden security hole, giving investigators a rare opportunity to quietly monitor the criminals and gather detailed evidence. Law Enforcement Action After collecting enough proof, international law enforcement teams launched a coordinated operation called "Operation Endgame" to shut down DanaBot’s network. This effort led to the takedown of key servers, the seizure of over 650 domains connected to the malware, and the recovery of nearly $4 million in cryptocurrency. While the core group of attackers, mainly located in Russia, has been formally charged, no arrests have been reported so far. However, the removal of DanaBot’s infrastructure has significantly reduced the threat. Final Thoughts This case highlights the importance of careful cybersecurity monitoring and how even well-established criminal groups can be exposed by overlooked technical mistakes. Staying updated on the latest security research is essential, as malware groups often release new versions and fixes that may change the threat landscape quickly.

9 months ago

DanaBot Malware Network Disrupted After Researchers Discover Key Flaw #cryptocurrency #DanaBot #DDOSAttacks

0 0 0 0

India Experiences Hacktivist Group Activity Amid Military Tensions 40+ hacktivist groups united in cyberattacks against India after a terror attack in the Indian state of Jammu & Kashmir and India’s retaliatory strikes.

10 months ago

#Anonymous 40 hacktivist groups united in cyberattacks against India after a terror attack in the Indian state of Jammu
#CyberSecurity #DDoSAttacks #India #Pakistan
cyble.com/blog/india-e...

11 3 0 0

Russian Hacktivists Disrupt Dutch Institutions with DDoS Attacks Several Dutch public and private organizations have experienced significant service outages this week following a wave of distributed denial-of-service (DDoS) attacks linked to pro-Russian hacktivists. The Netherlands’ National Cyber Security Center (NCSC), part of the Ministry of Justice, confirmed that the attacks affected multiple sectors and regions across the country. The NCSC disclosed that both government and private entities were targeted in what it described as large-scale cyber disruptions. While the full scope is still being assessed, municipalities and provinces including Groningen, Noord-Holland, Drenthe, Overijssel, Zeeland, Noord-Brabant, and cities like Nijmegen, Apeldoorn, Breda, and Tilburg reported that public portals were intermittently inaccessible. A pro-Russian threat group calling itself NoName057(16) has claimed responsibility for the cyberattacks through its Telegram channel. Though the NCSC did not confirm the motive, the group posted that the attacks were a response to the Netherlands’ recent €6 billion military aid commitment to Ukraine, as well as future support amounting to €3.5 billion expected in 2026. Despite the widespread disruptions, authorities have stated that no internal systems or sensitive data were compromised. The issue appears confined to access-related outages caused by overwhelming traffic directed at the affected servers — a hallmark of DDoS tactics. NoName057(16) has been a known actor in the European cybersecurity landscape since early 2022. It has targeted various Western governments and institutions, often in retaliation for political or military actions perceived as anti-Russian. The group also operates DDoSIA, a decentralized platform where users can participate in attacks in exchange for cryptocurrency payments. This model has enabled them to recruit thousands of volunteers and sustain persistent campaigns against European targets. While law enforcement in Spain arrested three alleged DDoSIA participants last year and confiscated their devices, key figures behind the platform remain unidentified and at large. The lack of major indictments has allowed the group to continue its operations relatively unimpeded. The NCSC has urged organizations to remain vigilant and maintain strong cybersecurity protocols to withstand potential follow-up attacks. With geopolitical tensions remaining high, experts warn that such politically motivated cyber operations are likely to increase in frequency and sophistication. As of now, restoration efforts are ongoing, and the government continues to monitor the digital landscape for further signs of coordinated threats.

10 months ago

Russian Hacktivists Disrupt Dutch Institutions with DDoS Attacks #CyberAttacks #DDoS #DDOSAttacks

0 0 0 0

💥Cybercrimeinfo | Ptr Lhss💥

@cybercrimeinfo.bsky.social

1 year ago

Nieuwsbrief 358 Cybercrimeinfo (ccinfo.nl) / Nieuwsbrief berichten / Nieuwsbrief archief / Menu Nieuws & Trends | Cybercrimeinfo In nieuwsbrief 358 lees je over cybercrime-as-a-service, AI in cyberoorlog, NIS2, DDoS-aanvallen, darkweb-trends en hulp via slimme AI-chatbots.

🇬🇧In #Newsletter358 from #Cybercrimeinfo, you’ll read about #CybercrimeAsAService, the role of #AI in #Cyberwarfare, the impact of the #NIS2 directive, the rise in #DDoSattacks, new #Darkweb trends ➡️ www-ccinfo-nl.translate.goog/menu-nieuws-...

2 0 0 0

1 year ago

Israeli Gilat Satellite Company website taken Offline..
#TangoDown
gilat.com
by #MysteriousTeam
#OpIsrael
#Anonymous
#DDoSAttacks
check-host.net/check-report...

5 1 0 0

X hit by ‘massive cyberattack’ amid Dark Storm’s DDoS claims The Dark Storm hacktivist group claims to be behind DDoS attacks causing multiple X worldwide outages on Monday, leading the company to enable DDoS protections from Cloudflare.

1 year ago

#Anonymous
Dark Storm hacktivist group claims to be behind DDoS attacks causing multiple #X worldwide outages on Monday, leading the company to enable DDoS protections from Cloudflare.
#DarkStormTeam #DDoSAttacks
www.bleepingcomputer.com/news/securit...

496 103 23 9

Malware Attack on Android TV Devices Affects Over 1.6 Million Users Cybersecurity researchers have discovered a new form of malware that is spreading through Android TV devices across the globe. This malware, known as Vo1d, has already infected over 1.6 million devices, turning them into remote-controlled bots…

1 year ago

Malware Attack on Android TV Devices Affects Over 1.6 Million Users #AndroidTV #DDOSAttacks #malware

0 0 0 0

Russian Telecom Company "Beeline" Hit, Users Face Internet Outage Internet outage in, telecom provider attacked Users in Russia faced an internet outage in a targeted DDoS attack on Russian telecom company Beeline. This is the second major attack on the Moscow-based company in recent weeks; the provider has over 44…

1 year ago

Russian Telecom Company "Beeline" Hit, Users Face Internet Outage #Beeline #CyberAttacks #DDOSAttacks

0 0 0 0

OpRevenge: A Mysterious Team Magyarországot támadta A támadások nemcsak technikai fenyegetést jelentettek, hanem politikai üzenetet is közvetítettek, emlékeztetve arra, hogy a hacktivista csoportok folyamatos tényezői maradnak a kibertérnek.

1 year ago

#MysteriousTeam Bangladesh hacktivista csoport három napon át támadta Magyarország egyes kormányzati és infrastruktúrához kapcsolódó weboldalait az #OpRevenge kampány részeként. #CyberAttacks #Hackers #DDoSAttacks #Anonymous www.cyberthreat.report/p/oprevenge-...

6 4 0 0