T1571 — ATT&CK technique | State of the Attack

The DDoS Zombie That Won't Let Go

A device we operate, presenting as a Jenkins build server, was broken into twice through its unauthenticated Script Console. Both times the operator dropped a Mirai-derived DDoS bot that locks the machine down first: it kills SSH/Telnet, zeroes permissions on every download tool, poisons /etc/hosts against AV vendors, kills analysis tools on launch, and wipes the logs — so the box stops behaving like one you own before it ever floods a target. Full kill chain, IOCs, and defensive checks inside.

2026-09-10

Skynet Lost the War in 2013. Its Malware Still Doesn't Know It.

A 2013 dropper for the Skynet ZeuS botnet, distributed via a fake lossless-audio release on Usenet, is still being downloaded today. The packed wrapper was absent from every public malware repository for thirteen years, until it surfaced on VirusTotal in late August 2026. Five packer/anti-analysis layers, full IOCs, and behavioural detection guidance inside.

2026-08-29