Who is the GovRAT Author and Mirai Botmaster ‘Bestbuy’?
Summary: A 29-year-old U.K. man was arrested in February 2017 on suspicion of using a Mirai botnet variant to knock more than 900,000 Deutsche Telekom customers offline in late November 2016, and investigators had not released his name. Krebs traced the handle "Bestbuy" through a shared server at 62.113.238.138 hosting both the Mirai controller and the GovRAT keystroke-logging trojan, leaked vDOS databases, and domain records to a Daniel Kaye of Egham, U.K., who did not respond to requests for comment.
Why it matters: One server IP hosted both a botnet controller and a malware sales operation, and a leaked DDoS-for-hire database tied the same email addresses to accounts named "bestbuy" - the kind of infrastructure reuse that lets investigators, and attackers, connect identities across campaigns.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026