Fortifying DevOps: Understand and Fight Botnets Threats
summary
Research analyzes Mirai-derived families and finds 32,000 Mirai samples and over a thousand C2 servers, plus a rebirth variant rebirth sold via Telegram with tiered pricing as low as ~$15/month. Targets include IoT, exposed containers and Kubernetes workloads exploiting CVEs like Log4Shell and ActiveMQ; attackers chain scanners, SSH harvesting and crypto miners, sometimes adding ransomware. Detection sees attacks within 24–48 hours of exposure; recommended mitigation is runtime behavioral monitoring, e.g. use Falco for runtime detection, network egress controls and rapid patching.
AI-written summary · about
chapters (8)
- 0:00Introduction to botnets
- 4:36How botnets recruit zombies
- 9:16Mirai botnet explained
- 13:53Advanced botnet variants
- 19:17Botnet architecture deep dive
- 23:16Buying botnets as a service
- 26:31Who uses botnets and why
- 30:00Key takeaways and defenses
related talks
29mUnderstanding the Mirai Botnet
29mAttack of the Clone Army
01h 00mIoT Lockdown - Battling Bot Net Builders
03mThe world will see (and just saw) an Internet zombie apocalypse
37mAnatomy of a DDoS
23mThe Rise of the Eternal Botnet
32mCommon Attacks on IoT Devices
49mDDoS attacks: tectonic changes in 2016–2017