Unmasking the new XorDDoS controller and infrastructure
Summary: Cisco Talos reports that the XorDDoS Linux DDoS trojan, first identified in 2014, spread via SSH brute-force attacks and expanded to Docker servers, with nearly 50 percent of successfully compromised victims between November 2023 and February 2025 located in the United States. Talos also found a new "VIP" version of the XorDDoS sub-controller in 2024 and a new "central controller" that injects a DLL to manage multiple sub-controllers at once, and assessed the toolset is a product suite built for sale.
Bottom line: The United States accounted for over 70 percent of attempted XorDDoS attacks Talos observed, and the central controller lets one actor push DDoS commands to many controllers simultaneously - a force multiplier for anyone whose Linux and Docker hosts still accept root logins over SSH.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026