Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.

Key insights

1. Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure.
2. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods.
3. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted away from media organizations toward a wider array of industry targets, including consumer services, Internet infrastructure, and adult entertainment.

Q3 by the numbers: 8,200 DDoS attacks every hour

Across its network in the third quarter of 2026, Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests. That works out to approximately 8,226 network-layer DDoS attacks per hour, or about 197,400 per day — one attack every 0.44 seconds. The quarter's mitigated traffic totaled 272.6 PB at the network layer and 95.1 PB at the HTTP layer.

More swarms, fewer giants

Short-burst, mid-range, high-count attacks — the operational signature of DDoS-for-hire "booter" services — accelerated this quarter. These attacks primarily targeted computer software, gambling and casinos, and information technology industries. Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks in Q3 2026, a +208% increase from the same quarter in 2025:

• 96% ended in under 10 minutes
• 98% stayed under 1 Gbps, more than enough to overwhelm a server or website

On the other hand, network-level hyper-volumetric attacks (those exceeding 1 Tbps) reversed course, dropping to 251 attacks in Q3 from 805 in Q2 — coinciding with law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.

Still, IoT-based botnets remain a durable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot. Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of all mitigated network-layer bytes in Q3, including four days — August 16, 19, 23, and 25 — that each cleared three petabytes. The quarter's longest sustained Mirai attack ran 49.7 hours between August 19 and August 21.

Vector shifts: the collapse of CLDAP and rise of UDP

The most dramatic vector shift of the quarter was downward. CLDAP (Connectionless Lightweight Directory Access Protocol) attacks — where small queries with a forged victim IP address trick public domain controllers (UDP 389) into reflecting massive, amplified responses back at the target — experienced a dramatic +580% quarter-over-quarter surge in the first half of the year before collapsing to just 0.05% of attacks in Q3.

Meanwhile, DNS amplification surged 215% to account for 3.43% of all network-layer attacks, exploiting open DNS resolvers in a similar reflection-and-amplification pattern to CLDAP: small spoofed queries, large replies directed at the victim. Other UDP floods climbed from 14.06% to 31.31% of network-layer attacks. UDP is a connectionless transport protocol, which makes it a convenient vehicle for raw volumetric attacks: attackers send large numbers of UDP packets to random or specific ports on the target, forcing the target to check for a listening application and respond, consuming its network and compute resources.

Most-attacked industry

While Media, Production & Publishing remained the most-attacked industry in Q3 2026, its overall share is roughly a quarter of its Q2 level, and the focus has moved across a wider set of industries. Internet rose from outside the top 10 to #6; Consumer Services and Adult Entertainment also climbed in, reaching #8 and #9 respectively.

Most-attacked locations

Geographic surges: Canada and Israel climb the ranks

Adding to an already turbulent period of bilateral trade disputes, Canada jumped from #16 to #6, driven by attacks against its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising industries.

Israel moved 7 spots to take #10 as a result of sustained DDoS activity in mid-September. While this period was marked by contentious decisions ahead of parliamentary elections and the Rosh Hashanah holiday, there was also a massive, documented surge in hostile cyber warfare targeting Israel this year.

Top 10

The United States was the most-attacked location in Q3 2026, while China was number #2 and Indonesia rose into the top three at 2.93% of total attacks. The U.S.-China pairing at the top is consistent with the first half of 2026, when China finished #1 and the U.S. #2; the countries have traded positions as attention and attacker preferences shift.

Strengthening global defenses and helping to defend the Internet

Cloudflare's network is designed to absorb this kind of growth in DDoS threats. Every service on our network is protected by free, unmetered DDoS protection that runs at every one of our 330+ cities globally, backed by 500 Tbps of network capacity. Autonomy is the point: our systems detect and mitigate attacks without human intervention. And they need to, because as this quarter's distributions make clear, most attacks end long before a human analyst could see the alert, and the largest attacks still regularly exceed 1 Tbps at a cadence measured in hundreds per quarter.

To help hosting providers, cloud computing platforms, and Internet service providers identify and take down the abusive IP addresses and accounts that launch these attacks, we leverage Cloudflare's unique vantage point on DDoS attacks to provide a free DDoS Botnet Threat Feed for Service Providers.

Over 800 networks worldwide have signed up for this feed, and we've already seen great collaboration across the community to take down botnet nodes. For a continuously-updated view of attack trends across the Internet, visit Cloudflare Radar.    

About Cloudforce One

Driven by a mission to help defend the Internet, Cloudforce One draws on telemetry from Cloudflare's global network — which protects more than 20% of the web — to drive threat research and operational response, protecting critical systems for millions of organizations worldwide.

Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline.

Kentik’s internet analysis director Doug Madory linked the outages to sudden traffic floods from Vietnam, the Philippines, Venezuela, and other countries. The traffic began at 02:01 UTC on October 20, making the country’s websites unreachable.

The disruption affected more than 40 websites using North Korea’s .kp domain, including the Ministry of Foreign Affairs and the Korean Central News Agency.

Access remained unstable for roughly 32 hours. South Korean reporting indicated that services returned around 7 p.m. local time on October 21, after repeated downtime and brief recoveries.

North Korea Hit by Multiple DDoS Attacks

In Doug Madory public findings, Madory said aggregate traffic data showed several waves of incoming traffic rather than one continuous surge. That timing helped connect the website failures to a distributed denial-of-service attack, which overwhelms a target with traffic and prevents normal users from reaching it.

“This traffic all started at the same time, and it is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters, according to its report published by AsiaOne. Kentik cautioned that its analysis covered only part of the traffic heading toward North Korea.

The countries in the traffic records do not identify who ordered the attacks. Kentik has not identified the people responsible. Although compromised devices can generate traffic from many locations, no specific botnet has been publicly linked to this incident.

Looks like the North Koreans changed how 175.45.176.0/24 was transited in the past few hours going via Cenbong (AS134544) to Transtelecom (AS20485) in Russia. pic.twitter.com/9jtL9bQfUw

— Doug Madory (also on Bluesky) (@DougMadory) October 21, 2026

Madory’s accompanying observations identified repeated downtime affecting 175.45.176.0/24, a network block containing name servers for .kp domains.

These servers help translate website names into internet addresses. Their loss can leave multiple sites unreachable, even when individual web servers remain online.

His route observations also described changes involving North Korea’s AS131279 network. The 175.45.176.0/24 block moved from Cenbong to Russia’s TTK, while 175.45.178.0/24 switched to TTK before returning to Cenbong. The other two listed blocks retained their respective providers.

Those observations describe how traffic paths changed during the incident. They do not establish whether operators deliberately changed routes to reduce the attack’s impact.

Early coverage considered power problems or telecommunications faults as possible explanations. Kentik’s later findings added direct traffic evidence supporting a DDoS explanation.

However, the available reports do not identify the attack method, peak traffic volume, or tools used. Related reporting on the Dysphoria botnet explains how compromised routers and cameras can generate coordinated traffic floods.

For now, the strongest evidence is the close match between incoming traffic spikes and service failures. The incident shows why outage investigations need traffic measurements alongside website checks, while the attacker’s identity and the operation’s full scale remain unresolved.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea appeared first on Cyber Security News.

Gear of War: E-Day players faced login failures, sudden disconnects, and other online service problems after distributed denial-of-service attacks targeted the game’s online services.

The official Gears Community account confirmed the cause on X, linking the disruption to DDoS activity and ending speculation about the source of the failures.

The Gears Community reported attacks on its online services that caused intermittent disconnects, login issues, and other disruptions, but did not identify the attackers, disclose traffic figures, or specify affected services, limiting details about the attack’s scale and method.

A separate update from the same account said the login issue had been resolved and that the team would continue closely monitoring services.

Earlier messaging had flagged extended login times and said the issue was improving. The updates show progress toward recovery, but the login fix should not be read as proof that every reported service problem had ended.

Gears of War: E-Day Hit by DDoS Attack

Players may experience delayed or failed logins, intermittent disconnections, and difficulty reconnecting, symptoms confirmed by the Gears Community during the online service disruption.

The available statement does not establish that the attacker accessed player accounts or stole personal information. It describes an attack against service availability. Reporting the incident as a confirmed data breach would go beyond the evidence released by the Gears Community team.

A DDoS attack uses multiple machines to overwhelm a target with traffic or requests. The aim is to make a system or network unavailable to legitimate users. Compromised devices can form a botnet, allowing attackers to send traffic from many sources at once, according to CISA’s DDoS response guidance.

This can exhaust network capacity or system resources, preventing the system from handling normal requests. However, the Gears update does not identify a botnet, a traffic flood type, or an attack rate. There is no published basis in that statement for assigning the incident to a known group or connecting it to another campaign.

Gaming infrastructure has faced similar availability threats before. Cybersecurity News previously covered DDoS malware targeting Valve Source Engine game servers, with several supported attack methods. That report provides useful background on game-server threats. However, it does not link to the E-Day disruption.

Another report examined a 3.15-billion-packets-per-second attack against a Minecraft server. The case shows why packet volume matters alongside bandwidth when assessing attacks. No comparable measurements have been shared in the available Gears statement.

CISA recommends confirming DDoS activity through network monitoring and traffic analysis, then applying measures such as traffic filtering and rate limits. These are general defensive steps, not confirmed details of the Gears team’s response.

Official updates confirm the reported cause, player impact, and login recovery, but leave the attack’s scale and technical handling undisclosed. The team’s stated recovery approach still includes monitoring after the service disruption.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Gears of War: E-Day Hit by DDoS Attack, Causing Login Failures and Disconnects appeared first on Cyber Security News.

Contents The AhnLab SEcurity intelligence Center (ASEC) collected attack logs targeting poorly managed Linux SSH servers through honeypots. This report compiles statistics by categorizing the attack sources identified in the third quarter of 2026, the attacks carried out from those sources, and the malware used. The report also provides a classification of the malware used […]

Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online.

Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the attack on October 8 through a post on the Ubuntu Discourse forum.

“Canonical’s websites are under a sustained distributed denial of service attack. Our team is working diligently to resolve the incident. Please refer to our status page for up-to-date information. Some services may be intermittently unavailable.” the company states.

At this time, no cybercrime or hacktivist group has claimed responsibility

The attack affected Canonical’s main public websites, including ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and the security advisory pages and API. Users may have been unable to access security advisories or read the blog during the attack.

“It was recently revealed that Canonical’s web infrastructure and the Ubuntu ecosystem suffered a massive and sustained distributed denial-of-service (DDoS) attack that caused its main portals and services to crash and be intermittent for more than four hours.” states the company blog. “Regarding the attack, it is mentioned that it directly affected the most visible institutional domains, including canonical.com and ubuntu.com, as well as the official blog, the developer portal, assets.ubuntu.com, academy.canonical.com and sites linked to enterprise technologies such as jaas.ai and maas.io.”

However, Launchpad and the Snap Store remained online throughout the incident. These services allow developers and system administrators to manage and install software.

Canonical acknowledged the outage on its status page and Ubuntu Discourse while engineers worked to limit the impact. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, affecting tools used to check security advisories and apply kernel patches without restarting systems. However, Canonical’s distributed infrastructure helped contain the damage. Software repositories and mirror servers remained available, allowing users to install updates. Launchpad, the Snap Store, disk image servers and Ubuntu Single Sign-On also continued to work.

As a result, users could continue downloading and installing packages even while Canonical’s public websites were disrupted.

The overall outage lasted a little over four hours, causing real disruption.

This attack differs from the April one, which caused greater disruption by taking down Launchpad and the Snap Store and preventing some users from installing Ubuntu updates. At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility.

Canonical described the April incident as a sustained, cross-border attack, language that suggested distributed infrastructure spanning multiple countries. Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DDoS) 

Note The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified. Major Issues Some hacktivist groups claimed responsibility for DDoS attacks targeting the […]

Italy’s Foreign Ministry is defending its website against a cyberattack, checking embassy sites and pushing for EU action to identify attackers.

On the morning of October 8, Italy’s Ministry of Foreign Affairs said its website was being attacked. According to the ministry’s own statement, its protection systems have mitigated the attack so far, with no disruption. The statement doesn’t say who is behind it, or what kind of attack it is.

The ministry is monitoring the situation with the Polo Strategico Nazionale, the country’s national cloud hub, and with the competent authorities.

“Cybersecurity is a central element of the reform of the Foreign Ministry approved last year. In recent months, we have strengthened our capabilities to prevent, monitor and respond to threats, adopting all necessary countermeasures, including on the technological side,” Foreign Minister Antonio Tajani said.

“Tajani had also had the opportunity to explain the technical capabilities of the CSIRT Operations Room to German Foreign Minister Johann Wadephul during his recent visit to Rome.” “In this context, Italy has decided to work with Romania and other EU member states to include proposals in upcoming European meetings to designate the actors responsible for cyberattacks, including attacks targeting Italian institutions.” reads the statement published by Italy’s Foreign Ministry.

Analysts are also checking the websites of Italian embassies and consulates abroad for similar attempts. That detail matters, and I’ll come back to it.

Minister Antonio Tajani tied the response to last year’s reform of the Farnesina, which made cybersecurity a central piece. He said prevention, monitoring and response capabilities have been strengthened in recent months, including on the technology side.

The statement ends on diplomacy. Italy will work with Romania and other member states to put proposals on the agenda of upcoming EU meetings, aimed at naming those responsible for cyberattacks, including attacks on Italian institutions. A blocked page is forgotten in a day, while a name on an official list is harder to shrug off.

Nobody has claimed this attack, but the pattern is familiar. NoName057(16) is a pro-Russian group that declared itself in March 2022 and announces its targets on Telegram. Avast researchers saw it using the Bobik botnet for DDoS attacks as early as September 2022.

Later, the DDoSia Project (aka DDosia), a crowdsourced DDoS operation linked to the pro-Russian hacktivist group NoName057(16), made the headlines beacuse its involvement in DDoS attacks again governments that supported Ukraine.

Italy has been a regular target. Over a weekend in January 2025, as Zelensky visited Rome, the group hit ministries and government sites on Saturday, then banks including Intesa and Monte dei Paschi di Siena and the ports of Taranto and Trieste on Sunday. At the end of December 2024 it had gone after Malpensa and Linate airports, and in February 2025 it tied a new wave to a speech by President Mattarella, according to Infosecurity Magazine. The timing follows politics, which isn’t a coincidence.

The ministry itself has been here before. ANSA reported that Russian hackers took its website down in late December 2024, and Tajani said it was back up the next day. DDoS attacks hit availability, not data, so the site goes dark and comes back. A loud attack can also pull attention away from a quiet one, which is a reason to look closer, not a claim about this case.

Now the embassies, and this part is my analysis. A ministry homepage going dark is embarrassing. An embassy or consulate site going dark is a problem for real people, because it’s where citizens abroad look for appointments, contacts and instructions, and the worst moment for an outage is a crisis abroad. Every one of those sites is also a surface to defend, and a lookalike page is an easy way to scam someone who’s already stressed.

Giving a look to the list of targets shared on DDosia today I can confirm that administrators planned attacks against the Farnesina, five Italian embassy sites, several Interior and Defence Ministry services, and other Italian organizations.

• attiva.fastweb.it
• sind.it
• whs.activenetwork.it
• bp.activenetwork.it
• sistemagalileo.it
• www.activenetwork.it
• webtop.we-com.it
• www.fastweb.it
• agenzie.interno.gov.it
• ambbruxelles.esteri.it
• ambbucarest.esteri.it
• ambcopenaghen.esteri.it
• ambdublino.esteri.it
• ambhelsinki.esteri.it
• concorsi.difesa.it
• constoronto.esteri.it
• idserver.servizicie.interno.gov.it
• sondaggi.bimedia.it
• www.aeronautica.difesa.it
• www.cartaidentita.interno.gov.it
• www.esteri.it
• www.giorgiameloni.it
• www.istitutospiov.it
• www.marina.difesa.it
• www.prenotazionicie.interno.gov.it
• www.uni.com

There is a precedent. In 2017, The Guardian reported a months-long intrusion into the Foreign Ministry’s systems. Italian media later reported that the attackers had targeted staff email accounts at the ministry and Italian embassies, rather than the encrypted system used for sensitive communications. A senior ministry security official said that attacks often happen before important events for Italy, while the Kremlin denied any involvement.

That’s why checking embassy websites is more than routine work. If someone wants to damage Italy’s image at little cost, the diplomatic network offers a large and highly visible target. The ministry is responding by strengthening its technical defenses and pushing at the EU level for “proposals to designate actors responsible for cyber attacks”, as the Farnesina’s statement puts it. That could make attribution more costly for attackers than simply taking a website offline.

DDoS attacks should not be underestimated, especially when they target government institutions and diplomatic services. They can disrupt public services, create pressure and attract significant media attention. But from a technical perspective, they are not usually complex offensive operations for a state to neutralize, especially when the target has adequate DDoS protection and network capacity.

The more important question is what sits behind the noise. Authorities need to determine whether these attacks are simply disruptive actions designed to attract attention, or whether they are being used to distract defenders while more sophisticated operations take place elsewhere. If there is no evidence of intrusion, data theft or compromise, the DDoS activity may be little more than a public demonstration of intent.

That distinction matters because a long list of targets can create the impression of a much more serious threat than the technical impact actually suggests. For people outside the cybersecurity community, a website being attacked can easily be interpreted as evidence that a government has been seriously compromised. In reality, it may be a relatively simple operation whose main objective is visibility.

The risk, therefore, is not only the attack itself, but the narrative built around it. DDoS campaigns can become a useful propaganda tool, creating fear and uncertainty while requiring relatively limited technical resources. The challenge for governments is to defend against the disruption without giving a sterile attack more strategic value than it deserves, while at the same time making sure that the noise is not hiding something more serious.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy’s Foreign Ministry)

Em 2026, o proprietário de um roteador doméstico comum, de uma smart TV ou de uma TV box é um alvo de grande interesse para os cibercriminosos. Esses dispositivos são facilmente recrutados para botnets e redes de proxy residencial, sobre as quais já falamos anteriormente.

Os criminosos “sublicenciam” o dispositivo infectado, permitindo que terceiros paguem para acessar qualquer site usando o endereço IP da vítima, fazendo parecer que é o proprietário do dispositivo quem está realizando os acessos. Esse serviço é procurado para todo tipo de esquema ilícito: desde fraude publicitária e campanhas de spam até tentativas de descoberta de senhas por força bruta e invasão de contas. Em nosso artigo anterior, explicamos como os roteadores domésticos são recrutados para essas redes de proxy; hoje, vamos analisar uma categoria de dispositivos ainda mais vulnerável e igualmente onipresente: smart TVs e TV boxes.

Esses dispositivos atraem os criminosos por dois motivos. Primeiro, ao contrário de computadores e smartphones, as TVs quase sempre ficam conectadas à tomada e têm uma conexão rápida com a Internet. Uma tela apagada não significa que o dispositivo esteja desligado. Além disso, a interface de usuário e as ferramentas de monitoramento limitadas fazem com que processos suspeitos executados em segundo plano possam passar facilmente despercebidos pelos usuários.

A ameaça está evoluindo e se tornando mais agressiva. Um estudo recente constatou que, quando um proxyware chega a um set-top box, os riscos para o proprietário vão muito além de ter o próprio tráfego desviado.

Anatomia da infecção

Os pesquisadores se concentraram em uma popular TV box da SuperBox, que já abordamos anteriormente no artigo Sua TV box virou uma porta de entrada para terceiros?

A estratégia de marketing da SuperBox se baseia fortemente na promessa de oferecer milhares de canais de TV sem assinatura nem mensalidades. No entanto, assim que sai da caixa, o dispositivo não é capaz de fazer nada disso. Para ter acesso a conteúdo pirata, é necessário instalar a loja de aplicativos proprietária da marca.

Quando você a abre e instala aplicativos adicionais, os milhares de canais de TV realmente aparecem. Enquanto isso, nos bastidores, sem nenhum aviso ou solicitação de permissão, o dispositivo inunda sites externos com solicitações não autorizadas, e o tráfego de rede aumenta drasticamente.

Os pesquisadores descobriram vários fatos alarmantes. Primeiro, a vítima pode ser incluída simultaneamente em até cinco botnets. A SuperBox executa clientes de várias redes de proxyware ao mesmo tempo, que chegam a competir entre si, bloqueando a instalação de softwares concorrentes.

Mas o verdadeiro choque foram os ataques à rede interna. O proxyware da TV box não impõe nenhuma limitação ao que seus “clientes” pagantes podem fazer na rede. Eles podem acessar não apenas sites externos, mas também dispositivos dentro da sua rede doméstica.

Normalmente, as configurações do seu roteador doméstico e do provedor de serviços de Internet (ISP) protegem você contra ataques externos. Mas o proxyware contorna essas barreiras porque opera de dentro da rede. Durante um experimento, os pesquisadores confirmaram que um invasor na Internet pode facilmente usar o set-top box infectado para abrir o painel de administração de um roteador doméstico, como um Linksys, que deveria estar acessível apenas ao proprietário quando conectado à rede Wi-Fi doméstica. Isso significa que os hackers podem tentar roubar dados de outros dispositivos da mesma residência ou até mesmo criptografar o armazenamento de rede doméstico (NAS).

Ao mesmo tempo, falhas no firmware de fábrica da SuperBox permitem que hackers instalem e executem remotamente qualquer aplicativo com privilégios de superusuário, e essa ameaça está longe de ser apenas hipotética. Durante três semanas de monitoramento, o set-top box usado no teste sofreu mais de 1.300 ataques por meio da rede de proxy doméstica. Os invasores instalaram três tipos diferentes de malware, incluindo um módulo para realizar ataques DDoS.

O malware usa vários métodos para obter acesso ao sistema e permanece ativo mesmo após reinicializações e quedas de energia.

Como saber se seu set-top box está trabalhando para os hackers

Se você tem um set-top box barato ou uma Android TV de uma marca pouco conhecida, vale a pena verificar se há alguma anomalia.

O método mais confiável é analisar o tráfego de rede. Use as estatísticas disponíveis no painel de controle do seu roteador, mas observe que alguns modelos de baixo custo podem não oferecer esse recurso. Nos roteadores Asus, esse recurso é chamado de Traffic Analyzer; nos TP-Link, de Traffic Usage; e nos Keenetic, de Traffic Monitor. Encontre sua TV ou set-top box na lista de dispositivos e verifique a proporção entre os dados baixados e enviados. Esses dispositivos devem consumir muito tráfego para baixar vídeos, mas enviar pouquíssimos dados. Se seu set-top box estiver silenciosamente enviando gigabytes de dados ou permanecer ativo na rede mesmo quando estiver ocioso, esse é um sinal claro de que ele pode estar infectado.

Se as estatísticas de tráfego não estiverem disponíveis, procure sinais indiretos:

• Os LEDs de atividade da rede e da memória não param de piscar, mesmo quando ninguém está usando o dispositivo.
• O gabinete do set-top box fica constantemente morno ou quente.
• A interface apresenta atraso em relação ao controle remoto, e o set-top box trava aleatoriamente, sem relação com a reprodução de vídeos pesados.
• A velocidade da Internet nos outros dispositivos (computadores ou celulares) sofre uma queda significativa.
• Ao tentar acessar sites conhecidos pela rede Wi-Fi doméstica, você se depara constantemente com um CAPTCHA, um sinal de que sua rede pode estar comprometida e ter sido identificada como fonte de spam.
• O suporte técnico do seu provedor de serviços de Internet entra em contato para perguntar sobre um volume de tráfego de rede suspeito.

O que fazer com um dispositivo infectado

A melhor solução é desconectar o dispositivo da Internet e descartá-lo. Se precisar continuar usando-o, siga estas etapas para minimizar os riscos:

1. Realize uma redefinição de fábrica (hard reset). Restaure o set-top box ao estado original.
2. Deixe-o desconectado da Internet antes de configurá-lo novamente. Na primeira vez que ligá-lo após a redefinição, ignore a etapa de configuração do Wi-Fi e não conecte o cabo Ethernet.
3. Bloqueie a instalação de aplicativos. Acesse as configurações do Android e desative a instalação de aplicativos de fontes desconhecidas. Não se esqueça de desativar todos os recursos de depuração que estiverem ativados: depuração USB, depuração sem fio e ADB. Os nomes dos itens de menu podem variar de acordo com a versão do Android e o fabricante do dispositivo.
4. Isole-o na rede. Configure uma rede Wi-Fi para convidados no roteador e conecte a TV box a ela. Ative o isolamento de clientes (Client Isolation) nas configurações do roteador, se esse recurso estiver disponível. Isso impedirá que a TV box detecte outros dispositivos da sua rede doméstica, protegendo seus computadores e o armazenamento de rede.
5. Verifique se há atualizações. Depois que a TV box estiver conectada à rede para convidados, verifique se há atualizações oficiais de firmware. Às vezes, os fabricantes corrigem vulnerabilidades conhecidas, embora não seja recomendável contar com isso no caso de marcas pouco conhecidas.

Suas medidas de proteção mais confiáveis

Comprar dispositivos baratos com recursos de streaming de conteúdo pirata e instalar softwares de fontes duvidosas é uma maneira praticamente certa de comprometer sua rede doméstica. Seu endereço IP se tornará uma fonte de atividade maliciosa, o que, na melhor das hipóteses, fará com que seu provedor de serviços de Internet bloqueie seu acesso e, na pior das hipóteses, fará com que você entre no radar das autoridades policiais. Além disso, os hackers podem usar a TV box como ponto de partida para atacar seus computadores e NAS domésticos, o que pode levar ao roubo de dados pessoais ou a um ataque de ransomware.

A melhor proteção é comprar dispositivos de marcas confiáveis e pagar por conteúdo legal. Além disso, para evitar que alguém assuma o controle da sua rede, certifique-se de que o painel de administração do roteador e os outros dispositivos domésticos estejam protegidos por senhas fortes e exclusivas. Para não precisar memorizar todas elas, use um gerenciador de senhas confiável, como o Kaspersky Password Manager. Além disso, o recurso Smart Home Monitor incluído no Kaspersky Premium permite manter todos os seus dispositivos sob controle.

Talvez haja outras coisas que você não saiba sobre seus dispositivos de casa inteligente:

• Sua TV box virou uma porta de entrada para terceiros?
• A sua TV, seu smartphone e seus alto-falantes inteligentes estão espionando você?
• Cinco regras para impedir que câmeras IP espionem você
• Os riscos ocultos de usar dispositivos Android baratos
• Seu roteador está trabalhando secretamente para inteligências estrangeiras?

The DOJ seized domains behind NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks since 2022, as part of Operation PowerOFF.

Renting a DDoS attack used to be as easy as renting a movie. Pick a target, pay a few dollars, watch the site go dark. The Justice Department just made that a little harder by seizing the domains behind NightmareStresser, one of the longest-running services in that business.

“The Justice Department today announced the court-authorized seizure of internet domains associated with one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services known as “NightmareStresser.” ” states DoJ.

“Federal law enforcement has seized websites maintained by criminal service providers that allow paying customers to launch powerful DDoS attacks targeting victims in the District of Alaska and worldwide as part of coordinated actions to disrupt so called “Booter” or “Stresser” operators.”

The announcement came from the District of Alaska, which may seem like an unusual place for a DDoS takedown. But Anchorage prosecutors have been investigating and fighting DDoS-for-hire services for almost a decade.

Federal authorities seized the websites under a court-approved warrant, preventing customers from using the service to launch attacks against targets in Alaska and around the world. These services are often called “booters” or “stressers,” names that make renting a DDoS attack sound like a simple online service.

It’s tempting to file DDoS attacks under “annoying but harmless.” The DOJ’s own description of the victim pool argues otherwise.

“Booter services such as those named in this action allegedly facilitate attacks on a wide array of victims in the United States and abroad, including educational institutions, government agencies, gaming platforms and millions of people. In addition to affecting targeted victims, these attacks can significantly degrade internet services and can completely disrupt internet connections.” continues DoJ. “According to the seizure warrant affidavit, the NightmareStresser Booter service targeted in this operation was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022. “

A school district losing internet access during exam week, a city government portal going dark, a gaming server getting flooded mid-match: none of that is abstract to the people dealing with it in the moment.

These attacks can slow down internet services or completely take them offline. The impact can also go beyond the main target, affecting other users and services that rely on the same network infrastructure.

NightmareStresser wasn’t a small operation running a handful of scripts for hobbyists.

“According to the seizure warrant affidavit, the NightmareStresser Booter service targeted in this operation was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022.” states DoJ.

That’s over three years of near-continuous rental attacks, on a service that markets itself with a name straight out of a horror movie.

The FBI’s Anchorage Field Office ran the technical side with help from the Royal Canadian Mounted Police’s Federal Policing Northwest Region. It’s a reminder that DDoS-for-hire crime doesn’t respect borders, so neither does the response to it.

This seizure sits inside Operation PowerOFF, the ongoing international campaign that’s been dismantling DDoS-for-hire infrastructure and going after the people running it for years. Just this past April, a coordinated action across 21 countries took down 53 domains, arrested four operators, and sent warning letters to more than 75,000 identified users of these platforms. Before that, in December 2024, another PowerOFF sweep knocked out 27 booter sites in one go.

Alaska’s own contribution to that broader effort goes back further than most people would guess.

“In previous law enforcement actions involving prosecutors and investigators in Anchorage and Los Angeles over the last eight years, the Justice Department charged twelve defendants who facilitated DDoS-for hire services and seized more than 100 internet domains associated with DDoS-for-hire services.” continues DoJ. “The multi-prong investigation announced today builds on the success of the prior cases by targeting all known booter sites, shutting down as many as possible, and undertaking a public education campaign.”

Twelve people and a hundred domains later, they’re still finding new ones to shut down.

Booter services are difficult to eliminate completely. When one is taken down, another can quickly appear, often using similar business models. The DOJ says these services have continued to grow because they make it easy for people with little technical knowledge to launch DDoS attacks.

Users don’t need to write code or understand how networks work. They can simply visit a website, pay for the service, often using cryptocurrency, and choose their target. This low barrier to entry has made DDoS-for-hire services accessible to a much wider group of cybercriminals.

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney are prosecuting the case out of the District of Alaska. The DOJ was explicit that this investigation isn’t a one-off strike but part of a wider plan to target every known booter site it can find, shut down as many as possible, and keep running public education alongside the legal action.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation PowerOFF)

Note The August 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—active on the deep web and dark web. It is noted that the accuracy of some information could not be verified. Major Issues NoName057(16), BD Anonymous, and Dark Storm Team claimed responsibility for repeated DDoS attacks targeting websites of […]

A newly observed IoT malware family dubbed KATARU targets internet-exposed devices through Telnet credential brute-forcing, then attempts to gain root privileges with publicly available Linux kernel exploits before enrolling compromised systems in a DDoS botnet. The sample combines familiar Mirai-style flooding functions with encrypted command-and-control, broad persistence logic, anti-analysis checks and decoy network activity designed […]

The post New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

When a chap called Matt noticed his Bluetooth headphones wouldn't switch to his phone, he was surprised to realise the reason was a single AliExpress webpage sitting open in his browser - playing nothing at all, at zero volume. And yet somehow his hardware could hear it. Audio fingerprinting is one of the sneakiest tracking tricks on the web. Meanwhile, the intelligence agencies of the "Five Eyes" (not Five Guys) have got together and published advice on how companies should communicate after a cyber attack. The summary? For the love of God, stop calling every breach "sophisticated." All this and more in episode 484 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

A newly analyzed Linux malware sample, dubbed Tengu, combines Mirai-style botnet tradecraft with broad persistence, DDoS, SSH probing, and proxy capabilities. The stripped 32-bit ELF masquerades as a Linux kernel worker process while targeting servers, embedded devices, and IoT-adjacent systems. It has no symbols, uses NX protection and partial RELRO, and carries a SHA-256 hash […]

The post Tengu Mirai-Style Linux Bot Hides as Kernel Worker to Launch DDoS and Proxy Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

ASEC Blog publishes Ransom & Dark Web Issues Week 4, August2026           Saudi Arabian Digital Entertainment Streaming Service User Data Offered for Sale SAFEPAY Ransomware Attack on a South Korean Industrial Gas Manufacturer and Supplier NoName057(16) and BD Anonymous Claim DDoS Attacks Against Major Japanese Organizations and Companies [1] [2] [3] […]

Note The July 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—active on the deep web and dark web. It is explicitly noted that the factual accuracy of some content could not be verified. Major Issues Handala claimed to have compromised the core infrastructure of an Internet service provider in […]

Cisco Talos found hackers using simple authorization claims to bypass AI guardrails, build DDoS attack tools, steal credentials and access live camera services.

Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly.

Note The June 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—operating on the deep web and dark web. It is noted that the accuracy of some information could not be verified. Major Issues In Malaysia, a series of website defacement and compromise incidents targeting local development agencies and public […]

Content In the second quarter of 2026, the AhnLab SEcurity intelligence Center (ASEC) collected and analyzed attack logs targeting poorly managed Linux SSH servers through honeypots. The scope of the analysis covers attack sources that progressed to executing actual malware installation commands, as well as statistics on the malware used in those attacks. Purpose and […]

Spanish police and the FBI arrested an alleged Cyber Army of Russia Reborn member as international efforts against pro Russia cyberattacks continue worldwide.