Buckets:
| [ | |
| { | |
| "id": "botnet-real-001", | |
| "scenario": "Mirai Botnet - IoT DDoS Attack (2016)", | |
| "instruction": "Analyze the Mirai botnet DDoS attack on Dyn DNS.", | |
| "input": "Botnet: Mirai\nDate: October 2016\nTarget: Dyn DNS provider\nImpact: Major websites down\n\nAttack Details:\n\n1. Botnet Size:\n - 100,000+ IoT devices\n - DVRs, cameras, routers\n - Default credentials\n\n2. Attack Type:\n - DNS amplification\n - UDP flood\n - TCP flood\n - HTTP flood\n\n3. Attack Volume:\n - Peak: 1.2 Tbps\n - Duration: Several hours\n - Source: Global IoT devices\n\n4. Impact:\n - Twitter down\n - Netflix down\n - Reddit down\n - GitHub down\n - Major outage\n\n5. Technical Details:\n - Scanning: Telnet port 23\n - Credentials: 62 default pairs\n - C2: IRC-based\n - DDoS: Multiple vectors\n\nIndicators:\n- Telnet scanning\n- Default credentials\n- IRC C2\n- High bandwidth traffic\n\nMitigation:\n1. Change default credentials\n2. Disable Telnet\n3. Network segmentation\n4. DDoS protection services\n5. ISP-level filtering", | |
| "output": "## Mirai Botnet DDoS Attack Analysis\n\n### Attack Summary\n- **Botnet**: Mirai\n- **Target**: Dyn DNS\n- **Volume**: 1.2 Tbps\n- **Year**: 2016\n\n### Attack Details\n\n#### Botnet Size\n```\n100,000+ IoT devices\nDVRs, cameras, routers\nDefault credentials\n```\n\n#### Attack Vectors\n```\nDNS amplification\nUDP flood\nTCP flood\nHTTP flood\n```\n\n#### Attack Volume\n```\nPeak: 1.2 Tbps\nDuration: Several hours\nSource: Global IoT devices\n```\n\n### Impact\n- Twitter down\n- Netflix down\n- Reddit down\n- GitHub down\n- Major internet outage\n\n### Technical Details\n```\nScanning: Telnet port 23\nCredentials: 62 default pairs\nC2: IRC-based\nDDoS: Multiple vectors\n```\n\n### IOCs\n```\nPort: 23 (Telnet)\nCredentials: Default pairs\nC2: IRC servers\nTraffic: High bandwidth\n```\n\n### MITRE ATT&CK Mapping\n- T1110.001: Password Guessing\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### Mitigation\n1. Change default credentials\n2. Disable Telnet\n3. Network segmentation\n4. DDoS protection services\n5. ISP-level filtering", | |
| "metadata": { | |
| "botnet": "Mirai", | |
| "attack": "DDoS", | |
| "target": "Dyn DNS", | |
| "year": 2016, | |
| "category": "botnet-ddos-real" | |
| } | |
| }, | |
| { | |
| "id": "botnet-real-002", | |
| "scenario": "Meris Botnet - DDoS Attack (2021)", | |
| "instruction": "Analyze the Meris botnet DDoS attack.", | |
| "input": "Botnet: Meris\nDate: September 2021\nTarget: Yandex\nImpact: Record-breaking DDoS\n\nAttack Details:\n\n1. Botnet Size:\n - 30,000+ devices\n - MikroTik routers\n - Vulnerable firmware\n\n2. Attack Type:\n - HTTP pipelining\n - UDP flood\n - TCP flood\n - DNS amplification\n\n3. Attack Volume:\n - Peak: 21.8 million RPS\n - Record: Largest HTTP DDoS\n - Duration: Several days\n\n4. Target:\n - Yandex (Russian search engine)\n - Multiple US companies\n - Financial institutions\n\n5. Technical Details:\n - Vulnerability: CVE-2018-14847\n - Affected: MikroTik routers\n - Method: HTTP pipelining\n - C2: Unknown\n\nIndicators:\n- MikroTik devices\n- HTTP pipelining\n- High RPS traffic\n- Specific vulnerability\n\nMitigation:\n1. Patch MikroTik devices\n2. DDoS protection\n3. Network filtering\n4. ISP cooperation\n5. Traffic analysis", | |
| "output": "## Meris Botnet DDoS Attack Analysis\n\n### Attack Summary\n- **Botnet**: Meris\n- **Target**: Yandex\n- **Volume**: 21.8 million RPS\n- **Year**: 2021\n\n### Attack Details\n\n#### Botnet Size\n```\n30,000+ devices\nMikroTik routers\nVulnerable firmware\n```\n\n#### Attack Vectors\n```\nHTTP pipelining\nUDP flood\nTCP flood\nDNS amplification\n```\n\n#### Attack Volume\n```\nPeak: 21.8 million RPS\nRecord: Largest HTTP DDoS\nDuration: Several days\n```\n\n### Technical Details\n```\nVulnerability: CVE-2018-14847\nAffected: MikroTik routers\nMethod: HTTP pipelining\nC2: Unknown\n```\n\n### IOCs\n```\nDevices: MikroTik routers\nTraffic: HTTP pipelining\nRPS: 21.8 million\nVulnerability: CVE-2018-14847\n```\n\n### MITRE ATT&CK Mapping\n- T1190: Exploit Public-Facing Application\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### Mitigation\n1. Patch MikroTik devices\n2. DDoS protection services\n3. Network filtering\n4. ISP cooperation\n5. Traffic analysis", | |
| "metadata": { | |
| "botnet": "Meris", | |
| "attack": "DDoS", | |
| "target": "Yandex", | |
| "year": 2021, | |
| "category": "botnet-ddos-real" | |
| } | |
| }, | |
| { | |
| "id": "botnet-real-003", | |
| "scenario": "Memcached Amplification DDoS on GitHub (2018)", | |
| "instruction": "Analyze the memcached amplification DDoS attack on GitHub.", | |
| "input": "Incident: Memcached amplification attack\nDate: February 2018\nTarget: GitHub\nImpact: 1.35 Tbps DDoS\n\nAttack Details:\n\n1. Vector:\n - UDP amplification via memcached servers\n - Spoofed source IPs\n - Massive reflection factor\n\n2. Attack Volume:\n - Peak: 1.35 Tbps\n - Duration: minutes\n - Global reflection sources\n\n3. Root Cause:\n - Exposed memcached instances on UDP 11211\n - No authentication\n - Spoofable UDP traffic\n\nIndicators:\n- UDP traffic from memcached hosts\n- High packet rate\n- Spoofed source IPs\n\nMitigation:\n1. Disable UDP on memcached\n2. Patch and secure memcached\n3. Anti-spoofing (BCP38)\n4. DDoS protection services\n5. ISP filtering", | |
| "output": "## Memcached Amplification DDoS Analysis\n\n### Attack Summary\n- **Target**: GitHub\n- **Year**: 2018\n- **Peak**: 1.35 Tbps\n- **Vector**: UDP amplification\n\n### Root Cause\n```\nExposed memcached UDP services\nNo auth on 11211/UDP\nIP spoofing enabled by networks\n```\n\n### Impact\n- Short, record-breaking DDoS burst\n- Service disruption risk\n\n### Prevention\n1. Disable UDP on memcached\n2. Enforce access controls\n3. Apply BCP38 anti-spoofing\n4. Use DDoS scrubbing\n5. Monitor for reflection abuse\n\n### MITRE ATT&CK Mapping\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- GitHub DDoS report (Feb 2018)", | |
| "metadata": { | |
| "botnet": "Memcached reflection", | |
| "attack": "DDoS", | |
| "target": "GitHub", | |
| "year": 2018, | |
| "category": "botnet-ddos-real" | |
| } | |
| }, | |
| { | |
| "id": "botnet-real-004", | |
| "scenario": "Mantis Botnet - HTTP/2 DDoS (2022)", | |
| "instruction": "Analyze the Mantis botnet HTTP/2 DDoS attacks.", | |
| "input": "Botnet: Mantis\nDate: June 2022\nTargets: Multiple organizations\nImpact: Record-scale HTTP/2 DDoS\n\nAttack Details:\n\n1. Botnet Type:\n - IoT-based botnet\n - Massive HTTP/2 request floods\n\n2. Attack Volume:\n - Peaks above 20 million RPS\n - Short, high-intensity bursts\n\n3. Technique:\n - HTTP/2 multiplexing abuse\n - Layer 7 saturation\n\nIndicators:\n- Very high RPS\n- HTTP/2 requests from IoT devices\n- Short burst patterns\n\nMitigation:\n1. Enable HTTP/2-aware DDoS protection\n2. Rate limit by client and path\n3. Use bot mitigation and WAF\n4. Block abusive IP ranges", | |
| "output": "## Mantis Botnet DDoS Analysis\n\n### Attack Summary\n- **Botnet**: Mantis\n- **Year**: 2022\n- **Vector**: HTTP/2 request floods\n\n### Root Cause\n```\nAbuse of HTTP/2 multiplexing\nInsufficient layer 7 rate limiting\n```\n\n### Impact\n- Extreme RPS spikes\n- Service degradation and outages\n\n### Prevention\n1. HTTP/2-aware DDoS defenses\n2. Layer 7 rate limiting\n3. Bot detection and blocking\n4. Continuous traffic monitoring\n\n### MITRE ATT&CK Mapping\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- Public reports on HTTP/2 DDoS (2022)", | |
| "metadata": { | |
| "botnet": "Mantis", | |
| "attack": "DDoS", | |
| "target": "Multiple", | |
| "year": 2022, | |
| "category": "botnet-ddos-real" | |
| } | |
| }, | |
| { | |
| "id": "botnet-real-005", | |
| "scenario": "Mozi IoT Botnet Takedown (2019-2021)", | |
| "instruction": "Analyze the Mozi botnet and the 2021 disruption operation.", | |
| "input": "Botnet: Mozi\nDate: 2019-2021\nTargets: IoT devices worldwide\nImpact: Large-scale DDoS capability\n\nAttack Details:\n\n1. Infection:\n - Exploited weak passwords and known router flaws\n - Compromised DVRs, routers, cameras\n\n2. Capabilities:\n - DDoS attacks\n - Proxy services\n - Lateral movement within networks\n\n3. Disruption:\n - 2021 law enforcement and vendor actions\n - Command and control disruption\n\nIndicators:\n- Telnet scanning\n- Default credential attempts\n- Unusual outbound connections\n\nMitigation:\n1. Patch router firmware\n2. Change default passwords\n3. Disable remote admin access\n4. ISP and vendor coordination", | |
| "output": "## Mozi Botnet Analysis\n\n### Attack Summary\n- **Botnet**: Mozi\n- **Years**: 2019-2021\n- **Vector**: IoT device compromise\n\n### Root Cause\n```\nWeak device credentials\nUnpatched router vulnerabilities\nLarge exposed IoT footprint\n```\n\n### Impact\n- DDoS capability at scale\n- Persistent IoT compromise\n\n### Prevention\n1. Patch and harden IoT devices\n2. Enforce strong passwords\n3. Disable unnecessary services\n4. Monitor for scanning activity\n\n### MITRE ATT&CK Mapping\n- T1110.001: Password Guessing\n- T1498: Network Denial of Service\n- T1583.005: Botnet\n\n### References\n- Public reports on Mozi takedown (2021)", | |
| "metadata": { | |
| "botnet": "Mozi", | |
| "attack": "DDoS", | |
| "target": "IoT devices", | |
| "year": "2019-2021", | |
| "category": "botnet-ddos-real" | |
| } | |
| } | |
| ] |
Xet Storage Details
- Size:
- 9.51 kB
- Xet hash:
- 69ceab10b00d231b7150be0fe052628871cb2fd4c134f6febc64fca49afb6bcd
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.