[
  {
    "id": "botnet-real-001",
    "scenario": "Mirai Botnet - IoT DDoS Attack (2016)",
    "instruction": "Analyze the Mirai botnet DDoS attack on Dyn DNS.",
    "input": "Botnet: Mirai\nDate: October 2016\nTarget: Dyn DNS provider\nImpact: Major websites down\n\nAttack Details:\n\n1. Botnet Size:\n   - 100,000+ IoT devices\n   - DVRs, cameras, routers\n   - Default credentials\n\n2. Attack Type:\n   - DNS amplification\n   - UDP flood\n   - TCP flood\n   - HTTP flood\n\n3. Attack Volume:\n   - Peak: 1.2 Tbps\n   - Duration: Several hours\n   - Source: Global IoT devices\n\n4. Impact:\n   - Twitter down\n   - Netflix down\n   - Reddit down\n   - GitHub down\n   - Major outage\n\n5. Technical Details:\n   - Scanning: Telnet port 23\n   - Credentials: 62 default pairs\n   - C2: IRC-based\n   - DDoS: Multiple vectors\n\nIndicators:\n- Telnet scanning\n- Default credentials\n- IRC C2\n- High bandwidth traffic\n\nMitigation:\n1. Change default credentials\n2. Disable Telnet\n3. Network segmentation\n4. DDoS protection services\n5. ISP-level filtering",
    "output": "## Mirai Botnet DDoS Attack Analysis\n\n### Attack Summary\n- **Botnet**: Mirai\n- **Target**: Dyn DNS\n- **Volume**: 1.2 Tbps\n- **Year**: 2016\n\n### Attack Details\n\n#### Botnet Size\n```\n100,000+ IoT devices\nDVRs, cameras, routers\nDefault credentials\n```\n\n#### Attack Vectors\n```\nDNS amplification\nUDP flood\nTCP flood\nHTTP flood\n```\n\n#### Attack Volume\n```\nPeak: 1.2 Tbps\nDuration: Several hours\nSource: Global IoT devices\n```\n\n### Impact\n- Twitter down\n- Netflix down\n- Reddit down\n- GitHub down\n- Major internet outage\n\n### Technical Details\n```\nScanning: Telnet port 23\nCredentials: 62 default pairs\nC2: IRC-based\nDDoS: Multiple vectors\n```\n\n### IOCs\n```\nPort: 23 (Telnet)\nCredentials: Default pairs\nC2: IRC servers\nTraffic: High bandwidth\n```\n\n### MITRE ATT&CK Mapping\n- T1110.001: Password Guessing\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### Mitigation\n1. Change default credentials\n2. Disable Telnet\n3. Network segmentation\n4. DDoS protection services\n5. ISP-level filtering",
    "metadata": {
      "botnet": "Mirai",
      "attack": "DDoS",
      "target": "Dyn DNS",
      "year": 2016,
      "category": "botnet-ddos-real"
    }
  },
  {
    "id": "botnet-real-002",
    "scenario": "Meris Botnet - DDoS Attack (2021)",
    "instruction": "Analyze the Meris botnet DDoS attack.",
    "input": "Botnet: Meris\nDate: September 2021\nTarget: Yandex\nImpact: Record-breaking DDoS\n\nAttack Details:\n\n1. Botnet Size:\n   - 30,000+ devices\n   - MikroTik routers\n   - Vulnerable firmware\n\n2. Attack Type:\n   - HTTP pipelining\n   - UDP flood\n   - TCP flood\n   - DNS amplification\n\n3. Attack Volume:\n   - Peak: 21.8 million RPS\n   - Record: Largest HTTP DDoS\n   - Duration: Several days\n\n4. Target:\n   - Yandex (Russian search engine)\n   - Multiple US companies\n   - Financial institutions\n\n5. Technical Details:\n   - Vulnerability: CVE-2018-14847\n   - Affected: MikroTik routers\n   - Method: HTTP pipelining\n   - C2: Unknown\n\nIndicators:\n- MikroTik devices\n- HTTP pipelining\n- High RPS traffic\n- Specific vulnerability\n\nMitigation:\n1. Patch MikroTik devices\n2. DDoS protection\n3. Network filtering\n4. ISP cooperation\n5. Traffic analysis",
    "output": "## Meris Botnet DDoS Attack Analysis\n\n### Attack Summary\n- **Botnet**: Meris\n- **Target**: Yandex\n- **Volume**: 21.8 million RPS\n- **Year**: 2021\n\n### Attack Details\n\n#### Botnet Size\n```\n30,000+ devices\nMikroTik routers\nVulnerable firmware\n```\n\n#### Attack Vectors\n```\nHTTP pipelining\nUDP flood\nTCP flood\nDNS amplification\n```\n\n#### Attack Volume\n```\nPeak: 21.8 million RPS\nRecord: Largest HTTP DDoS\nDuration: Several days\n```\n\n### Technical Details\n```\nVulnerability: CVE-2018-14847\nAffected: MikroTik routers\nMethod: HTTP pipelining\nC2: Unknown\n```\n\n### IOCs\n```\nDevices: MikroTik routers\nTraffic: HTTP pipelining\nRPS: 21.8 million\nVulnerability: CVE-2018-14847\n```\n\n### MITRE ATT&CK Mapping\n- T1190: Exploit Public-Facing Application\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### Mitigation\n1. Patch MikroTik devices\n2. DDoS protection services\n3. Network filtering\n4. ISP cooperation\n5. Traffic analysis",
    "metadata": {
      "botnet": "Meris",
      "attack": "DDoS",
      "target": "Yandex",
      "year": 2021,
      "category": "botnet-ddos-real"
    }
  },
  {
    "id": "botnet-real-003",
    "scenario": "Memcached Amplification DDoS on GitHub (2018)",
    "instruction": "Analyze the memcached amplification DDoS attack on GitHub.",
    "input": "Incident: Memcached amplification attack\nDate: February 2018\nTarget: GitHub\nImpact: 1.35 Tbps DDoS\n\nAttack Details:\n\n1. Vector:\n   - UDP amplification via memcached servers\n   - Spoofed source IPs\n   - Massive reflection factor\n\n2. Attack Volume:\n   - Peak: 1.35 Tbps\n   - Duration: minutes\n   - Global reflection sources\n\n3. Root Cause:\n   - Exposed memcached instances on UDP 11211\n   - No authentication\n   - Spoofable UDP traffic\n\nIndicators:\n- UDP traffic from memcached hosts\n- High packet rate\n- Spoofed source IPs\n\nMitigation:\n1. Disable UDP on memcached\n2. Patch and secure memcached\n3. Anti-spoofing (BCP38)\n4. DDoS protection services\n5. ISP filtering",
    "output": "## Memcached Amplification DDoS Analysis\n\n### Attack Summary\n- **Target**: GitHub\n- **Year**: 2018\n- **Peak**: 1.35 Tbps\n- **Vector**: UDP amplification\n\n### Root Cause\n```\nExposed memcached UDP services\nNo auth on 11211/UDP\nIP spoofing enabled by networks\n```\n\n### Impact\n- Short, record-breaking DDoS burst\n- Service disruption risk\n\n### Prevention\n1. Disable UDP on memcached\n2. Enforce access controls\n3. Apply BCP38 anti-spoofing\n4. Use DDoS scrubbing\n5. Monitor for reflection abuse\n\n### MITRE ATT&CK Mapping\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- GitHub DDoS report (Feb 2018)",
    "metadata": {
      "botnet": "Memcached reflection",
      "attack": "DDoS",
      "target": "GitHub",
      "year": 2018,
      "category": "botnet-ddos-real"
    }
  },
  {
    "id": "botnet-real-004",
    "scenario": "Mantis Botnet - HTTP/2 DDoS (2022)",
    "instruction": "Analyze the Mantis botnet HTTP/2 DDoS attacks.",
    "input": "Botnet: Mantis\nDate: June 2022\nTargets: Multiple organizations\nImpact: Record-scale HTTP/2 DDoS\n\nAttack Details:\n\n1. Botnet Type:\n   - IoT-based botnet\n   - Massive HTTP/2 request floods\n\n2. Attack Volume:\n   - Peaks above 20 million RPS\n   - Short, high-intensity bursts\n\n3. Technique:\n   - HTTP/2 multiplexing abuse\n   - Layer 7 saturation\n\nIndicators:\n- Very high RPS\n- HTTP/2 requests from IoT devices\n- Short burst patterns\n\nMitigation:\n1. Enable HTTP/2-aware DDoS protection\n2. Rate limit by client and path\n3. Use bot mitigation and WAF\n4. Block abusive IP ranges",
    "output": "## Mantis Botnet DDoS Analysis\n\n### Attack Summary\n- **Botnet**: Mantis\n- **Year**: 2022\n- **Vector**: HTTP/2 request floods\n\n### Root Cause\n```\nAbuse of HTTP/2 multiplexing\nInsufficient layer 7 rate limiting\n```\n\n### Impact\n- Extreme RPS spikes\n- Service degradation and outages\n\n### Prevention\n1. HTTP/2-aware DDoS defenses\n2. Layer 7 rate limiting\n3. Bot detection and blocking\n4. Continuous traffic monitoring\n\n### MITRE ATT&CK Mapping\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- Public reports on HTTP/2 DDoS (2022)",
    "metadata": {
      "botnet": "Mantis",
      "attack": "DDoS",
      "target": "Multiple",
      "year": 2022,
      "category": "botnet-ddos-real"
    }
  },
  {
    "id": "botnet-real-005",
    "scenario": "Mozi IoT Botnet Takedown (2019-2021)",
    "instruction": "Analyze the Mozi botnet and the 2021 disruption operation.",
    "input": "Botnet: Mozi\nDate: 2019-2021\nTargets: IoT devices worldwide\nImpact: Large-scale DDoS capability\n\nAttack Details:\n\n1. Infection:\n   - Exploited weak passwords and known router flaws\n   - Compromised DVRs, routers, cameras\n\n2. Capabilities:\n   - DDoS attacks\n   - Proxy services\n   - Lateral movement within networks\n\n3. Disruption:\n   - 2021 law enforcement and vendor actions\n   - Command and control disruption\n\nIndicators:\n- Telnet scanning\n- Default credential attempts\n- Unusual outbound connections\n\nMitigation:\n1. Patch router firmware\n2. Change default passwords\n3. Disable remote admin access\n4. ISP and vendor coordination",
    "output": "## Mozi Botnet Analysis\n\n### Attack Summary\n- **Botnet**: Mozi\n- **Years**: 2019-2021\n- **Vector**: IoT device compromise\n\n### Root Cause\n```\nWeak device credentials\nUnpatched router vulnerabilities\nLarge exposed IoT footprint\n```\n\n### Impact\n- DDoS capability at scale\n- Persistent IoT compromise\n\n### Prevention\n1. Patch and harden IoT devices\n2. Enforce strong passwords\n3. Disable unnecessary services\n4. Monitor for scanning activity\n\n### MITRE ATT&CK Mapping\n- T1110.001: Password Guessing\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- Public reports on Mozi takedown (2021)",
    "metadata": {
      "botnet": "Mozi",
      "attack": "DDoS",
      "target": "IoT devices",
      "year": "2019-2021",
      "category": "botnet-ddos-real"
    }
  }
]