Just published a breakdown of RapperBot. Quick hits:
Uses DNS TXT records to hide rotating C2s.
Multi-arch payloads (MIPS, ARM, x86), stripped/encrypted, self-deleting.
Custom base56 + RC4-ish routine just to extract C2 IPs (decryptor included).
Infra shifts fast: scanners moving countries, repos/FTP/NFS hosting binaries.
Timeline lines up neatly with DOJβs Operation PowerOFF takedown.
Full post: https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second
Curious if anyoneβs still seeing RapperBot traffic after the takedown, or if itβs really gone quiet.