A few months ago our Attack Vector Miner discovered a new botnet, that we simply call „Hello Peppa botnet”. Now, this botnet welcomes the new year in a new mask.
Its behaviour stayed the same, like what we mentioned in the case of the Hello Peppa:
The Post Data is changed from die(“Hello, Peppa!”) to die(@md5(J4nur4ry). The hackers couldn’t even write “January” correctly – they made a little typo with the extra r. Here is an example log from our Dashboard:
The botnet is a bit impatient because the „January botnet” didn’t wait until January; it started on 21st December. This chart shows you clearly how it was spreading:
It shows the number of stopped „January botnet” attacks between 20th Dec and 27th Dec 2018. During this period, we perceived almost 400,000 attempts.
You don’t have to worry, as the 404001 and 404002 WAF rules (which are part of the safe minimum ruleset) provide you powerful protection against this botnet.
So, if the WAF 2.0 is enabled on your servers, instead of having a headache because of the „January botnet”, all you have to do is open a bottle of champagne and celebrate the start of the new year! Let’s welcome January while your servers are safe. 😉
Have questions? Ninjas are always glad to help you, so feel free to leave a comment under this article or contact us at [email protected].
Start the 7-day free trial with full functionality without spending a cent.
After the “Hello, Peppa!” zero-day botnet, our Attack Vector Miner detected another zero-day...
At the end of the last year, we made...