Botnet C&C

Botnet Threat Update January to June 2024

Operation Endgame | Botnets disrupted after international action

On Thursday, May 30th, 2024, a coalition of international law enforcement agencies announced "Operation Endgame". This effort targeted multiple botnets, such as IcedID, Smokeloader, SystemBC, Pikabot, and Bumblebee, as well as their operators, and Spamhaus is assisting with the remediation efforts.

Botnet Threat Update Q4 2023

Botnet Threat Update Q3 2023

Qakbot - the takedown and the remediation

Writing "Qakbot" and "takedown" in the same sentence is quite something. Usually, Spamhaus is bemoaning the ever-growing numbers of compromised IPs associated with this malware. But, on Tuesday, August 29th, 2023, the Federal Bureau of Investigation (FBI) announced that it coordinated an international group...

Botnet Threat Update Q2 2023

Botnet Threat Update Q1 2023

Neutralizing Tofsee Spambot – Part 3 | Network-based kill switch

In part three, we focus on using a network kill switch - causing an out-of-bounds read error, leading to Tofsee crashing.

Neutralizing Tofsee Spambot - Part 2 | InMemoryConfig store vaccine

In part two, learn about a second malware vaccine our team has produced, focused on polluting Tofsee's internal configuration store.

Botnet Threat Update, Q4 2022

Annual Botnet Threat Update 2022

Neutralizing Tofsee Spambot – Part 1 | Binary file vaccine

The Spamhaus Malware Researchers have been busy in their lairs, reverse engineering Tofsee malware to provide you with the code required for two malware vaccines and a network-based kill switch. A hat trick of protection against this spambot! This is the first in this three-part series, and looks at how to inject a malware vaccine into the binary file.

Botnet Threat Update Q3 2022

Botnet Threat Update Q2 2022

Botnet Threat Update Q1 2022