Family
XorDDoS
Walks in over SSH on guessed passwords, poses as a system service and XOR-encrypts its command servers. Behind it sits a product for sale, with its own builder and versions.
XorDDoS surfaced in 2014, exposed by MalwareMustDie. It’s a denial-of-service trojan for Linux: it guesses its way in over SSH, installs itself as if it were a system service and sits there waiting for orders.
Its birthmark is the one that gives it its name: the list of command servers travels XOR-encrypted inside the binary, with a sixteen-byte key that hasn’t changed since 2014. That key is what cracks the case open — and what, by turning up somewhere unexpected, led all the way to the operator behind it.
What you can’t see from the binary is that there’s no hobbyist behind it: there’s a product for sale, with its builder, its Chinese-language control panel and its versions. That’s what pulling the thread is after.
- 01
Someone brought their malware to my house
I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.
XorDDoS
2026-08 - 02
Cracking XorDDoS open with Ghidra
In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.
XorDDoS
2026-08 - 16
The tenant who'd been there eleven years
A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 — one I'd had in my hands from day one.
XorDDoS
2026-08