Security news aggregator

Latest coverage for Botnet

Stay informed on botnet trends, attacks, and defenses. Get the latest updates and expert insights on botnet threats in information security.

7 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

A botnet is a network of compromised internet-connected devices controlled remotely by an attacker through malware. These devices, known as bots, receive commands from centralized or decentralized command-and-control (C2) servers to perform coordinated actions such as launching Distributed Denial of Service (DDoS) attacks, sending spam, or distributing additional malware. Botnets vary in size and complexity, often leveraging vulnerabilities in devices or weak authentication to propagate.

In information security, botnets pose significant risks including large-scale service disruptions from DDoS attacks and the unauthorized use of infected devices for malicious activities. Detecting botnet activity involves monitoring network traffic for unusual patterns and identifying communication with known C2 infrastructure. Effective defense includes timely patching of vulnerable systems, blocking C2 domains or IPs based on threat intelligence, and isolating infected hosts to prevent further spread or damage. Coordinated efforts to disrupt botnet infrastructure can reduce their operational impact.

Volume over time

Weekly headline count for the current query.

Showing 7 most recent headlines Filtered view

TuxBot v3, an AI-built IoT botnet for 17 architectures, shipped with LLM bugs and safety disclaimers the developer never removed. Palo Alto Networks’ Unit 42 identified a previously undocumented modular IoT botnet framework called TuxBot v3 Evolution, and it comes with an unusual detail: the developer used a large language model to write significant portions […]

Security Affairs 16 Jul 2026, 11:13 p.m. Incident · 2 stories Artificial Intelligence Botnet Framework IoT Palo Alto Networks

RustDuck is a small, evolving DDoS botnet migrating to Rust. It uses advanced encryption, anti-analysis evasion, and exploits known IoT flaws. Since February 2026, researchers at QiAnXin’s XLab have been tracking a new malware family, called RustDuck, that hijacks routers, cameras, Android set-top boxes, and exposed servers, then uses them to flood targets with junk […]

Security Affairs 1 Jul 2026, 10:25 p.m. Theme · 2 stories Android Botnet DoS Encryption Evasion Exploit Exposure Flaw IoT Malware Research Routers

JDY botnet scans SOHO/IoT devices globally to map services and targets, especially US military networks. Lumen’s Black Lotus Labs reported the resurgence of the JDY botnet, a covert reconnaissance network tied to Chinese state-sponsored hacking groups including Volt Typhoon. The network was first spotted in late 2023 as a cluster inside KV-botnet. The U.S. government […]

Security Affairs 11 Jun 2026, 7:46 p.m. Theme · 3 stories America Botnet China Critical Infrastructure Government Hacking IoT Military Nation State
Security Affairs 1 month, 1 week ago

IoT Botnet C0XMO Adds Competitor-Killing Capability

C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoS attacks. In March 2026, FortiGuard Labs discovered a new variant of the Gafgyt botnet, dubbed C0XMO, which is noticeably more capable than its predecessors. The malware spreads through CVE-2021-27137, a stack buffer overflow in […]

Security Affairs 8 Jun 2026, 7:03 p.m. Incident · 2 stories CVE-2021-27137 Botnet CVE DoS Flaw Fortinet IoT Malware Routers
Security Affairs 1 month, 2 weeks ago

Botnet of 17 Million Devices Dismantled in the Netherlands

Dutch authorities seized 200 servers running a 17-million-device botnet linked to proxy service Asocks. Dutch authorities have taken offline a massive botnet of at least 17 million devices and seized more than 200 servers at a local provider that supported the operation. Infected devices included computers, tablets, and smartphones. The action was carried out following […]

Security Affairs 30 May 2026, 8:16 p.m. Incident · 5 stories Botnet Infection Mobile Netherlands Outage Proxy
Security Affairs 1 month, 2 weeks ago

Botnet of 17 Million Devices Dismantled in the Netherlands

Dutch authorities seized 200 servers running a 17-million-device botnet linked to proxy service Asocks. Dutch authorities have taken offline a massive botnet of at least 17 million devices and seized more than 200 servers at a local provider that supported the operation. Infected devices included computers, tablets, and smartphones. The action was carried out following […]

Security Affairs 30 May 2026, 8:16 p.m. Incident · 5 stories Botnet Infection Mobile Netherlands Outage Proxy

Glassworm infected developers through poisoned tools and packages until a coordinated takedown killed all four of its C2 channels at once. On May 26, 2026, at 14:00 UTC, CrowdStrike Counter Adversary Operations team, working with Google and the Shadowserver Foundation, killed all four command-and-control channels of the Glassworm botnet at the same time. The timing […]

Security Affairs 27 May 2026, 11:35 p.m. Incident · 7 stories Botnet Command and Control Crowdstrike Google Infection