New Udados Botnet Launches Massive HTTP Flood DDoS Attacks Targeting Tech Sector
A new botnet malware family named "Udados" has been identified as a significant threat to the Technology and Telecommunications sectors. This malware orchestrates high-volume HTTP flood Distributed Denial-of-Service (DDoS) attacks.
A new botnet malware family named "Udados" has been identified as a significant threat to the Technology and Telecommunications sectors. This malware orchestrates high-volume HTTP flood Distributed Denial-of-Service (DDoS) attacks.
The botnet utilizes infected hosts to execute sustained denial-of-service campaigns, disrupting business continuity by overwhelming target servers with legitimate-looking traffic, as analyzed by the ANY.RUN sandbox.
The Udados malware communicates with a Command and Control (C2) server to receive attack instructions. Infected hosts send structured JSON data to the C2, including system metadata such as user ID (Uid), task execution status (St), bot version (Bv), and privilege level (Priv). This data allows the operator to manage the botnet's resources effectively.
Upon check-in, the C2 server provides specific attack commands. The primary directive observed is !httppost , which triggers the DDoS module. This command specifies attack duration, the number of concurrent threads, and a Base64-encoded payload with random data.
The use of HTTP POST requests enables the attack traffic to blend with legitimate web traffic, complicating detection and mitigation for network defenders.
A new botnet malware family named "Udados" has been identified as a significant threat to the Technology and Telecommunications sectors.
The botnet's infrastructure is hosted within Autonomous System AS214943, known as RAILNET, which has gained a reputation for malicious activity. Recent intelligence reports indicate that RAILNET hosted infrastructure for over 30 distinct malware families, including Remcos and Amadey.
The specific C2 server involved in this campaign is located at IP address 178.16.54[.]87 . The malware communicates via the URI /uda/ph.php , serving as a critical indicator for network monitoring. Defenders can detect potential infections by inspecting outbound HTTP traffic for this specific path and the characteristic JSON parameters (uid, st, msg, tid) in the request body.
Organizations are advised to block traffic to the identified C2 infrastructure and monitor the following indicators:
SHA256: 7e2350cda89ffedc7bd060962533ff1591424cd2aa19cd0bef219ebd576566bb SHA256: 770d78f34395c72191c8b865c08b08908dff6ac572ade06396d175530b0403b8 IPv4: 178.16.54[.]87 (Hosted on RAILNET) Domain: ryxuz[.]com URI Path: /uda/ph.php
Network administrators should also inspect short-term spikes in outbound HTTP traffic from individual hosts, as this behavior often precedes the high-volume flood orchestrated by the C2.
Based on reporting by Cyber Security News.