FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

RapperBot: infection β†’ DDoS in seconds (deep dive write-up)

Just published a breakdown of RapperBot. Quick hits:

Uses DNS TXT records to hide rotating C2s.

Multi-arch payloads (MIPS, ARM, x86), stripped/encrypted, self-deleting.

Custom base56 + RC4-ish routine just to extract C2 IPs (decryptor included).

Infra shifts fast: scanners moving countries, repos/FTP/NFS hosting binaries.

Timeline lines up neatly with DOJ’s Operation PowerOFF takedown.

Full post: https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second

Curious if anyone’s still seeing RapperBot traffic after the takedown, or if it’s really gone quiet.

submitted by /u/JollyCartoonist3702
[link] [comments]
❌