Family
KHserver
A booter for hire, built to drop other people's matches. A descendant of SBIDIOT: it inherited the 2021 skeleton, the commands — and something you'd never guess.
KHserver has no name in any repository: antivirus engines file it as gafgyt/tsunami and that is where its record ends. I name it after the two marks its own author left compiled inside the binary, KHserverHACKER and KHcommSOCK, because those survive even when the files it hands out are renamed.
What sets it apart from Mirai or XorDDoS is not the technique — the skeleton is the usual one — but the business. Its command list includes FORTNITE, COD, R6, RUST and VSE, plus two commands aimed at OVH and NFOservers, the two big game-server hosts. This is not used for whatever comes up: it is rented by the hour so that somebody’s match goes down.
Its other face is the arsenal. It carries fifteen functions named after exploits, most with a CVE number, from 2016 to 2025 — among them React2Shell, the React Server Components code execution that scored a perfect 10 this year and had half the internet patching in a hurry. On paper, a router botnet capable of taking down modern web servers.
On paper. In chapter 12 I open them one by one.
It is not original either. It shares with SBIDIOT — documented back in 2021 — part of its vocabulary and, above all, the exact same string inside the packets it fires. What landed in the honeypot is no creation: it is a descendant, with new exploits glued on top of a five-year-old skeleton. What that string actually says, and what it gives away about whoever copied it, is in chapter 12.
- 11
The bot that bragged — and couldn't be bothered
A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit — and the first thing I saw was that it had a few characters too many.
KHserver
2026-08 - 12
Nikki, you are loved
The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.
KHserver
2026-08