Family
Legea
A Go DDoS bot with a control plane, carefully built on the inside and with its fallback infrastructure barely set up.
Go DDoS bot with a control plane
first seen 2026
2 chapters
Legea is the word the bot asks for all its orders with, Romanian for “the law”, and the only one of his own its author left behind: no banner, no alias, no version. It appears zero times in the file and 124 in the running process, because the obfuscator encrypts its strings and they only decrypt on startup. The name comes from there, from a string in its own code, and it says nothing about who wrote it.
On its own it does nothing: it sleeps until its command server talks to it. Then it offers nine attacks across layers 3, 4 and 7 and four control orders: a fully privileged remote shell, self-repairing persistence, immutability on the system directories and a killer for rivals. Mirai lineage, rewritten in Go. Inside it’s built with care; outside it arrived burned, with six of its seven fallback domains unregistered.
- 01
Someone brought their malware to my house
I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.
XorDDoS
2026-08 - 02
Cracking XorDDoS open with Ghidra
In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole - but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.
XorDDoS
2026-08 - 03
The botnet that left its code out in the open
Another one walks in and drops its critter. But this one left a door open on its own delivery server - and inside was the source code. A multi-architecture Mirai, caught red-handed.
Mirai
2026-08 - 04
Mirai laid bare: 16 methods and a one-byte XOR
The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal - without handing out weapons.
Mirai
2026-08 - 05
The intruder who brought his own key
The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.
RedTail
2026-08 - 06
The miner that hides its wallet
We unpack RedTail's miner and crack it open in Ghidra hunting for the pool and the wallet. What we find is more interesting than a number: the data is in there, embedded and encrypted - and nobody has published how to crack it.
RedTail
2026-08 - 07
The one that came in through the debug cable
The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.
Sysorbit
2026-08 - 08
Sysorbit laid bare: three layers to hide one address
We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face - until I came back another way and it opened.
Sysorbit
2026-08 - 09
The one who wanted me to pay for their calls
This time no binary landed. A fraud did: for two hours, fifteen machines tried to make my PBX place 3,457 international calls - the trial run of an International Revenue Share Fraud (IRSF), with the bill in my name. A chapter with no Ghidra: just protocol, money and OSINT.
VoIP
2026-08 - 10
A miner that got a bit lost
Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago - and which today, without knowing it, warns its own victims.
Trinity
2026-08 - 11
The bot that bragged - and couldn't be bothered
A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit - and the first thing I saw was that it had a few characters too many.
KHserver
2026-08 - 12
Nikki, you are loved
The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.
KHserver
2026-08 - 13
Three locks, and the key left in
In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing - armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.
Trinity
2026-08 - 14
The call factory
In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.
VoIP
2026-08 - 15
I went back for RedTail, and RedTail already had an owner
I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom (somewhere it never occurred to me to look) and that the piece I thought I'd decrypted was for something else.
RedTail
2026-08 - 16
The tenant who'd been there eleven years
A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 - one I'd had in my hands from day one.
XorDDoS
2026-08 - 17
Fresh out of the oven
A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster - an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
Mirai
2026-08 - 18
Nothing to file
An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants - they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.
Cling
2026-09 - 19
A Mirai that couldn't attack?
I pulled down the three binaries from the previous chapter expecting the usual DDoS arsenal. It wasn't there: not one attack function. What it does instead (and above all, the channel its orders arrive on) is the strangest thing that has come through the honeypot. A bug designed, top to bottom, not to be seen.
Cling
2026-09 - 20
Twelve alibis and a mailbox
The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox (because the bot announces its ports only to those thirteen, to nobody else) and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.
Cling
2026-09 - 21
Introduced by its enemy
An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family (IranBot, a Mirai fork with a public dossier) it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.
IranBot
2026-09 - 22
The twin I was missing
A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none - and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.
IranBot
2026-09 - 23
The command that lies
I left a password sitting on a decoy and, one Sunday, something came through it three times. I neutralised what it brought; what I didn't see until later was what it left planted - a line in .bashrc that makes «top» lie and hide the very process eating the machine. A rootkit without a rootkit. And putting two frozen disks side by side turned up the detail that changes everything: the same line, with a different number.
DIICOT
2026-09 - 24
The line nobody wrote
The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up - a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.
DIICOT
2026-09 - 25
Twenty-odd dollars a day
The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up - but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.
DIICOT
2026-09 - 26
Sixty-six seconds
The family from the previous chapter didn't stand still: there's a newer build going around, and I caught it from the first second. It brute-forces its way in over SSH, sizes the machine up, evicts the competition (its own older version included), uploads sixteen megabytes in a single file and fires. All in a little over a minute. And then it walks straight into one line of fstab.
DIICOT
2026-09 - 27
Only the leader talks
The kit sat still on the disk, so I switched it on myself in a cage with no way out. Inside there's a bot that insists on knowing its own address before anything else, joins a mesh of up to two thousand nodes, holds an election and crowns itself leader - and only then opens a Telegram chat. The operator never logs into any machine: he sends a message to the head of the pack. And when you burn the chat, the botnet heals itself.
DIICOT
2026-09 - 28
The wallet that never travels
The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it - the mining config never travels inside the critter, it gets downloaded afterwards - and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.
DIICOT
2026-09 - 29
It told me its name three times
Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.
shem
2026-10 - 30
The C2's Landlord
Last chapter I opened shem up from the inside, but one thing nagged at me: its command centre is a bare IP, no domain, so I couldn't follow the operator. I pulled on that IP anyway. And what turns up at the other end isn't the operator - it's his landlord: a bulletproof hosting block that swaps its name and its plates to stay out of reach, rents to half a dozen botnets at once, and throws the server away after ten days.
shem
2026-10 - 31
One door, three visitors
Forty megabytes of binary that won't open: the decompiler takes one look and refuses. Before forcing that door, the boring part that has to come first - who brought them here.
Legea
2026-10 - 32
It encrypted a broken message too
Three lying bytes keep the decompiler out, and behind them there's a second wall: the author's strings aren't in the file at all. By the time I finally got it talking, it had spent a while saying yes to seven orders that don't exist.
Legea
2026-10