HNS (Hide aNd Seek) botnet targets IoT (generally a blind spot for IT Security folks. It supports 7 exploiting methods and it adds a cpuminer mining program

It has huge processing power in view of the capacity to scan some vital exploitation.

These might include 

• 23 Telnet
• 8080 http web services
• 80 HTTP Web Service
• 5984 CouchDB 
• 2480 OrientDB 
• 5984 CouchDB

Popularly known as Hide-N-Seek, the Botnet is being deployed by the attackers to target the internet of things computing devices within a short spell of time.

Within less than a year since the experts identified it,HNS was said to have infected many internet of things devices leaving the users in huge confusion.


http://www.ehackingnews.com/2018/07/new-botnet-posing-threat-to-internet.html

Build your own BOT (and sell , if needed) for $50

In its beta form but promising the ability to allow  customers to open their own botshop allowing the purchaser  to rebuild the bot to sell access to others, creating  their own clientele.

Kardon appears to be a rebrand of the ZeroCool botnet, which was previously developed by the same actor.

“Pretty much every element of cyber-crime is now part of a broader ecosystem, with hackers specializing in certain areas and then selling those skills or capabilities on the dark web to others who can then use that for a broader cyber-crime campaign.”


https://www.scmagazine.com/50-kardon-beta-malware-allows-customers-to-build-own-botnets/article/776002/

Did you know: 20% of Web traffic is from Bad Bots, About 74% could evade detection and Account takeover attacks occur two to three times per month on the average website,

• Gambling companies and airlines suffer from higher proportions of bad bot traffic than other industries, with 53.1% and 43.9%.
• About 74% of bad bot traffic is made up of moderate or sophisticated bots, which evade detection by distributing their attacks over multiple IP addresses or simulating human behavior such as mouse movements and mobile swipes.
• E-commerce, healthcare and ticketing websites meanwhile suffer from highly sophisticated bots, which are difficult to detect.

https://www.infosecurity-magazine.com/news/bad-bots-make-up-a-fifth-of-all/

Facebook messenger users may want to read this - You might be victimized by a mining bot called Digmine

Facebook Messenger is the launching pad for a new Monero-cryptocurrency mining bot called Digmine

Once downloaded onto a computer, Digmine's first operation is to install an autostart mechanism and launch Chrome with a malicious extension. It then starts mining and finally connects with the Facebook account's friend list via Messenger and begins to spread.

In order to keep the victim unaware, a video file is streamed from a website that is controlled by the cybercriminal and contains additional components for the malware.

For More:
https://www.scmagazine.com/digmine-cryptocurrency-botnet-spreading-through-facebook-messenger/article/720451/

Could this be true or is it scaremongering - 100,000-strong botnet built on router 0-day could strike at any time

What sets this latest variant apart is its ability to exploit a recently discovered zeroday vulnerability to infect two widely used lines of home and small-office routers even when they're secured with strong passwords or have remote administration turned off altogether.




More Here:
https://arstechnica.com/information-technology/2017/12/100000-strong-botnet-built-on-router-0-day-could-strike-at-any-time

If you are using ZyXEL device and haven't changed the default password , your device might be compromised

An uptick in botnet activity associated with a variant of Mirai. Targeted are ports 23 and 2323 on internet-connected devices made by ZyXEL Communications that are using default credentials.

In October 2016, Mirai malware spread itself to IoT devices gaining access via default password and usernames. The malware then roped affected devices into a botnet and carried out distributed denial of service (DDoS) attacks


For More:
https://threatpost.com/newly-published-exploit-code-used-to-spread-marai-variant/128998/

Single SpamBot had 711 million records of which 80 million are credentials

“Just for a sense of scale, that’s almost one address for every single man, woman and child in all of Europe,” Hunt wrote

The spambot is called Onliner and it’s been around since 2016 and is best known for spreading the Ursnif banking Trojan.


For more info:
https://threatpost.com/spambot-contains-mind-boggling-amount-of-email-smtp-credentials/127722/

Smart Guys - Created a Botnet that exploits default username /passwords

Are there drivers that do not know how to adjust their car mirrors or the seats ?

If there are (almost) none, how come we still have users that do not change the default passwords

The vendors could  force us  change the default password when we configure the system the first time but, they are not responsible for our security so, they don't care. (after all, even we don't seem to care)

From the article:

Incapsula discovered a botnet, still largely active, that primarily consists of routers manufactured by the California-based networking company Ubiquiti Networks. While the firm initially assumed the routers suffered from a shared firmware flaw, researchers were able to determine that all units are remotely accessible via HTTP and SSH on their default ports, and could also be accessed via vendor-provided default login credentials. 

The botnet scans for other routers that may have been misconfigured and executes shell scripts to access their SSH ports via default credentials.

“For perpetrators, this is like shooting fish in a barrel, which makes each of the scans that much more effective,” the firm said in a report released Tuesday,

Follow the link below for more details

https://threatpost.com/default-credentials-lead-to-massive-ddos-for-hire-botnet/112767

Putting Windows XP to full use - By creating 500,000 PC Botnet

Well, Someone is putting it to good use

From the Article

What the attackers are after is online banking logins, which form half the business, and PCs that can be sold on to other criminals as compromised machines inside interesting organisations. These can also then be used a proxies for third-party attacks

Perhaps the real story is the incredible ease with which Qbot has found victims, 75 percent of which are based in the US. Significantly, 52 percent of these are running Windows XP, 39 percent Windows 7 with 7 percent Windows Vista.

Anyone who uses XP and still can't patch the old software on their system is probably beyond reach

Follow this link for additional details:

http://www.csoonline.com/article/2692528/cyber-attacks-espionage/windows-xp-flaws-help-russian-qbot-gang-build-500000-pc-botnet.html

Built a free botnet that generates $US1750 a week using free cloud: -

This is not fiction, 2 researches actually did it.

Moral of the story:

Cyberattacks might become more common

Security is still our problem not cloud provider's.

(From the article)

They used automatic tools and processes to spread a currency-mining botnet across some 150 popular free services that each generated about 25 cents a day -- all on the providers' electricity bill.

The bot was bult on free and fast tools including Mandrill and FreeDNS.afraid.org for email address registration, variations on public data breach databases, a custom program on Google App Engine, and the Python Fabric to manage scripts controlling the hundreds of cloud instances.

The link below has more information:-

http://www.theregister.co.uk/2014/07/25/boffins_build_free_supercomputer_from_signup_trials/

New kid in the block - SANDROID - Android Botnet

Targets Android smartphone users who bank at financial institutions in the Middle East.

Infected more than 2,700 phones, and has intercepted at least 28,000 text messages.


According to the article:- 

bundled with Android apps made to look like mobile two-factor authentication modules for various banks, including Riyad Bank, SAAB (formerly the Saudi British Bank), AlAhliOnline (National Commercial Bank), Al Rajhi Bank, and Arab National Bank.



The link below has more information:-
http://krebsonsecurity.com/2014/04/android-botnet-targets-middle-east-banks/

Looks like botnet market is getting competitive - BOT authors are advertising about its capability even before it is full ready

As per a March 18 update, Zorenium – which first popped up on the scene in January and allegedly also works on Windows and Linux machines – will now run on Apple mobile devices running iOS 5 through iOS 7

The strange part about this article is that Zorenium (Bot) is supposed to be multi-platform and they now claim they can compromise iOS.

The stranger part is no one was able to get a single piece of this code for analysis

Like vendors producing vapour-ware  could this be a vapour-bot?

According to the article:- 

Zorenium is still in beta, but its author claims it has many capabilities, including distributing banking trojans, carrying out distributed denial-of-service (DDoS) attacks, form grabbing, and Bitcoin mining, according to the post, which explains how the malware is well-protected against anti-virus and anti-malware solutions.

The bot is also said to feature fake shutdown modules, which trick victims into thinking they are shutting down their hardware. In reality, Zorenium is using fake shutdown images, dropping the device into standby, and delaying the fans to create the illusion the device is off.

The links below has more information:

http://www.scmagazine.com/zorenium-bot-said-to-be-updated-for-ios-capable-of-various-attacks/article/339732/

Heard of "Operation Windigo" ? - What about 25000 servers controlled by a Trojan

There are two elements that could surprise you

1. Apparently it has been active for more than 2.5 years.
2. The servers include UNIX servers (false sense of security or missing layered security?)

According to the article:- 

The attack, which has been dubbed "Operation Windigo" by security experts, hijacks servers, infects the computers that visit them and steals information from victims. The infected servers are then used to redirect half a million web visitors to malicious content on a daily basis. Servers located throughout the U.S., Germany, France and the UK are all among those infected.

 ESET researchers are warning webmasters and system administrators to check their systems to see if they have been compromised. 

 Operating systems altered by the spam component include Linux, FreeBSD, OpenBSD, OS X and Windows

The links below has more information:

http://www.darkreading.com/attacks-breaches/malware-used-to-attack-more-than-500000/240166689

Why re-invent the wheel, when you can steal from others - NSA Hijacks Botnets.

SNIPPETS from the Article:-

NSA isn’t just building its own botnet. Since August 2007 it’s had a program called QUANTUMBOT dedicated to taking over the command-and-control systems of existing, but idle, bots. One top secret slide describes the program as “highly successful” with “over 140,000 bots co-opted.”

 Computer security researcher Nicholas Weaver theorizes the agency could use bot software as a “deniable implant” – if you find your computer slaved to a known hacker botnet, you’re not likely to suspect the most sophisticated intelligence agency in the world is behind it. At least, not until now.

The links below has more information:

http://www.wired.com/threatlevel/2014/03/nsa-botnet/

Can you to legally build a Botnet using Cloud services without paying a dime?

This is not an idea , this was actually demonstrated in the RSA Conference.

The researchers simply automated the process of signing up for the free IaaS and PaaS services.

Much of the abuse the pair tested was made possible due to poor verification of users during the trial account creation process. Even when some services tried to limit accounts by limiting Internet access to those accounts, the researchers were easily able to break the accounts from those bonds through quick workarounds. 

Of the 150 different PaaS and IaaS sites the duo tested, two-thirds of them were not doing any CAPTCHAs, SMS verification or credit card verification beyond simple email account verification.

The link below has more details:

http://www.darkreading.com/researchers-create-legal-botnet-abusing/240166428