xlabs_v1 DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

CrowdStrike and partners disrupted the Sality P2P botnet on August 31, 2026 via peer-to-peer sinkholing, cutting command channels that had let the 20-year-old malware task 33,000+ infected machines.

Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.