SecuriTricks - iot botnet

DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 …

minecraft

mirai

game server targeting

mirai-derived

vltrig

xlabs_v1

Published: April 29, 2026

Downloadable IOCs: 10

Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 arc…

mirai

CVE-2017-17215

CVE-2024-3721

persistence mechanisms

credential brute-force

ddos attacks

nexcorium

tbk dvr exploitation

Published: April 17, 2026

Linked vulnerabilities : CVE-2017-17215, CVE-2024-3721

Downloadable IOCs: 14

A look at PolarEdge Adjacent Infrastructure

This analysis examines the infrastructure associated with PolarEdge, an IoT botnet that exploits CVE-2023-20118. The investigation reveals connections between various certificates and services, including a WebRTC e-book certificate and suspicious PolarSSL certificates. A key discovery is the RPX se…

Published: September 1, 2025

Linked vulnerabilities : CVE-2023-20118

Downloadable IOCs: 4

Tag: iot botnet

Attack reports

DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

A look at PolarEdge Adjacent Infrastructure