Spammers are constantly seeking new ways to reach the widest audience possible while dodging email filters — all to ensure their “tempting” offers land in your inbox rather than the spam folder. To pull this off, bad actors are increasingly pivoting to legitimate platforms, dreaming up sophisticated ways to weaponize them for their own gain.

We’ve previously covered scam attacks using Google Forms, where fraudulent emails were sent directly from Google’s mail servers. In those cases, links were shielded by the reputable forms.gle domain, allowing them to breeze past spam filters. Now, a similar tactic has been implemented using Yandex Surveys. Here’s a look at how this new scam works, and how you can stay safe.

Everything looks fine at first glance…

Online survey tools are fairly common these days. Marketing professionals use them to gather feedback, HR departments use them for employee engagement, and researchers use them to study target audiences. But how are scammers getting in on the action?

They create a survey, embed links to fraudulent websites within the body, and blast out emails containing the survey link to their mailing lists. Standard anti-spam filters see URLs like yandex.com/poll/… as legitimate. Recipients often have the same reaction, reasonably assuming, “It’s a link to a well-known service — what could go wrong?”

Our experts have tracked a massive spike in these emails. In January, Kaspersky Premium blocked just over 2200 of these messages; by February, that number soared to over 32 000. We’re looking at aggressive scaling here — nearly a 15-fold increase in just one month.

Spammers distribute these survey links through their own channels, often hijacking website feedback forms that lack sender verification. The fact that the message originates from a legitimate network provides yet another green flag for anti-spam filters to let these emails slide right through.

The most popular themes for this type of spam currently involve crypto scams — promising users a windfall in digital currency — and links to sketchy dating sites.

How scammers exploit Yandex Surveys

To build a survey that doesn’t actually look like one, attackers take advantage of the platform’s extended survey mode.

Yandex Surveys allows users to swap out a simple question for a text block, which can include descriptions, images, or videos. This is exactly where scammers embed their pitch and the link to their phishing site. They use the built-in “Upload media” feature to add official-looking logos and other embellishments that sell the illusion.

To make sure the victim doesn’t see the “Next” button or the standard disclaimer — which warns that surveys are created by third parties and that Yandex isn’t responsible for the content — the scammers pad the space below the scam block with invisible characters. For instance, they might add dozens of lines of transparent emojis; you can’t see them, but they still take up screen real estate. Further down, past the point where most people would stop scrolling, they simply drop in punctuation marks, one per line.

The result? The user sees nothing but the fraudulent offer and the link, while everything else is pushed off-screen. It’s the same technique we’ve seen used with Google Forms.

Beyond the benefit of using legitimate URLs, another perk for the scammers is that this method doesn’t cost them a dime. They aren’t paying the service for promotion, or using the built-in targeting tools; they simply blast the link to their own database. In this scenario, the service is essentially being used as good-reputation web page hosting.

To top it off, the scammers can jump into the “Statistics” section of the survey to track click-through rates in real-time and then export the data into a spreadsheet. This is basically a turnkey analytics suite.

Once a victim clicks the link in the survey and lands on the attackers’ website, they are greeted by a professional-looking site running a classic “prize giveaway” scheme.

How to avoid taking the bait:

• Don’t blindly trust “reputable domain names”. Seeing yandex.com or forms.gle in the address bar is no longer a guarantee that the content is safe. Anyone can create a survey at those addresses.
• Stay alert if you receive an unexpected email. Be especially wary if it promises a payout, a prize, or asks you to “confirm” something urgently. These are scammers’ tricks of choice.
• Always scroll to the bottom of the page. If the content abruptly cuts off and you’re left with a wall of empty space, that should set off alarm bells. Check the footer — you’ll often find service disclaimers or other clues that prove you’re looking at a fraudulent survey.
• Don’t click links in suspicious surveys. If you do happen to click through, never enter any personal or financial information on the resulting site.
• Use a trusted security tool. Kaspersky Premium detects these fraudulent sites and blocks access before you have a chance to hand over your data or risk infecting your device through a zero-click vulnerability.

Finally, it’s worth noting that scammers didn’t actually hack Yandex Surveys; instead, they took a creative — albeit malicious — approach to repurposing the tool for their own ends. Since Yandex Surveys is scheduled to shut down on April 6, 2026, this specific scheme will soon hit a dead end. Still, scammers are constantly hunting for the next loophole to exploit. Your best defense remains a healthy dose of skepticism toward any unexpected email — even if the links point to a domain you know and trust.

Other tricks spammers use:

• Beware of Google Forms bearing crypto gifts
• Phishing and spam: the wildest campaigns of 2025
• Spam 101: what is spam, and how to defeat it
• How phishers and scammers use AI
• Fifty shades of sextortion

Kaspersky official blog – ​Read More

ANY.RUN has been recognized at Global InfoSec Awards 2026 by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine.

We’re especially proud and grateful that our impact for the industry has been acknowledged in two categories at once: 

• Innovative Malware Analysis for Sandbox 

• Market Leader Threat Intelligence  

This dual recognition reflects the approach to cybersecurity we prioritize: supporting the full SOC workflow by combining advanced malware and phishing analysis with integrated threat intelligence. 

What Made This Possible 

As highlighted by the award founders at CDM, ANY.RUN matched the values they looked for in participants:  

“ANY.RUN embodies three major features we judges look for to become winners: understanding tomorrow’s threats, today, providing a cost-effective solution and innovating in unexpected ways that can help mitigate cyber risk and get one step ahead of the next breach.”

Gary S. Miliefsky, Publisher of Cyber Defense Magazine. 

We believe that ANY.RUN’s repeated presence high in industry rankings reflects its ability to address operational challenges across the investigation cycle. Our solutions support enterprise security teams as they successfully: 

• Unify SOC Workflow: ANY.RUN offers a single ecosystem that streamlines monitoring, triage, and incident response without tool switching. 

• Accelerate Decision-Making: Interactive malware analysis combined with contextual threat intelligence delivers immediate insights, no external double-checking needed. 

• Scale Operations for SOCs and MSSPs: Standardized workflows and integrated intelligence empower teams of any size. 

Community Trust in Numbers 

ANY.RUN is used broadly by organizations with high security requirements, including the world’s largest enterprises: 

• We support 15,000+ SOCs and 600,000+ analysts in accelerating investigations, reducing risk, and improving operational outcomes across industries. 

• 74% of Fortune 100 companies rely on ANY.RUN for malware analysis and threat investigation workflows.   

We’re deeply thankful for customers, partners, and community for their continued trust. We appreciate every contribution and piece of feedback and process them to maintain high standards we set for our solutions. 

More on Global InfoSec Awards 2026  

Global InfoSec Awards 2026 is organized by Cyber Defense Magazine, a premier source of cyber security news and information for InfoSec professions in business and government. 

With a mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry, they deliver monthly magazines, as well as special editions for the RSAC Conferences.    

The award’s judges are CISSP, FMDHS, CEH, certified security professionals who voted based on their independent review of the company submitted materials on the website of each submission including but not limited to data sheets, white papers, product literature and other market variables. 

About ANY.RUN 

ANY.RUN provides interactive malware analysis and actionable threat intelligence that enable security teams worldwide to investigate threats faster, understand attacker behavior more clearly, and respond with greater confidence. 

We prioritize: 

• Maintaining SOC 2 Type II certification and commitment to protect customer data. 

• Constantly improving Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds for support across monitoring, triage, and response SOC processes. 

• Helping SOC and MSSP teams accelerate analysis, gain deeper context during investigations, and identify emerging threats earlier. 

The post ANY.RUN Recognized for Innovations and Market Leadership at Global InfoSec Awards 2026   appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Millions of automated software development pipelines rely on security tools, such as Trivy and Checkmarx AST, integrated into the build process. It is precisely these trusted solutions recently became the entry point for one of the largest and most dangerous supply chain attacks in modern history. In this post we discuss how to audit automated workflows and secure corporate cloud infrastructure.

Timeline of the attack and known consequences

On March 19, a successful targeted supply chain attack was carried out via Trivy, an open-source vulnerability scanning tool widely used in CI/CD pipelines. The attackers, a group known as TeamPCP, managed to inject malware into official GitHub Actions workflows and Docker images associated with Trivy. As a result, every automated pipeline scan made triggered malware that stole SSH keys, cloud access tokens, cryptocurrency wallets, and other valuable data from compromised systems. Given the critical nature of the incident, it was assigned the identifier CVE-2026-33634 with a near-maximum CVSS4B score of 9.4.

Later that same day, the Trivy team detected the attack and removed malicious artifacts from the distribution channels, halting this phase of the attack. However, the attackers had already gained access to the environments of many Trivy users.

On March 23, a similar incident was discovered in another application security tool: a GitHub Action for Checkmarx KICS, as well as Checkmarx AST.  Three hours later, the malicious code was removed from there as well. TeamPCP also managed to compromise OpenVSX extensions supported by Checkmarx: cx-dev-assist 1.7.0 and ast-results. Reports on when this part of the incident was resolved vary.

On March 24, a popular project using Trivy’s code scanning — the LiteLLM AI gateway, a universal library for access to various LLM providers — was attacked. Versions 1.82.7 and 1.82.8, uploaded to PyPI repository, were compromised. These versions were publicly available for about 5 hours.

But the fact that the attack lasted only a few hours is no reason to dismiss it. Given the popularity of the affected projects, the malicious code could have been executed thousands of times, including within the infrastructures of very large companies.

This allowed attackers to deploy persistent backdoors in Kubernetes clusters, as well as launch the self-replicating CanisterWorm worm across the JavaScript npm ecosystem.

The attackers’ code has destructive capabilities that wipe out a Kubernetes cluster and all its nodes if it detects Farsi as the primary language or the Tehran time zone on the compromised system. In other regions, the malware simply steals data using CanisterWorm.

According to experts, more than 20,000 repositories are considered potentially vulnerable. The attackers claim to have stolen hundreds of gigabytes of data and more than 500,000 accounts.

How Trivy Was Attacked

To compromise Trivy, the attackers used credentials stolen in a previous incident. The previous Trivy compromise, which occurred in late February, was likely not fully contained, and the attackers — the TeamPCP group — returned with a new attack.  Trivy’s developers, Aqua Security, speculate that because credentials were being phased out gradually following the previous incident, the attackers were able to generate new access tokens for themselves before compromised old ones had been revoked.

As a result, TeamPCP was able to compromise GitHub Actions used in CI/CD pipelines. Using credentials with tag-writing privileges, the attackers forcibly overrode 76 out of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy, redirecting existing trusted versions to malicious commits. This resembles tactics observed in the Shai-Hulud 2.0 campaign.  As a result, workflows throughout the pipeline began executing the attackers’ code, while the release metadata showed no visible changes.

At the same time, the attackers published an infected Trivy binary (v0.69.4) to official distribution channels, including GitHub Releases and container registries.

LiteLLM Compromise

The compromise of the popular language model access tool LiteLLM could itself trigger a major wave of attacks across the chain of projects that use it. The attack took place on March 24, 2026, when TeamPCP directly published malicious versions of the library (1.82.7 and 1.82.8) on PyPI. Between 10:39 UTC and 16:00 UTC, these compromised packages contained a malware that stole credentials. It was embedded in the proxy_server.py file, and version 1.82.8 also contained a malicious litellm_init file. The stolen data was exfiltrated to the server models.litellm[.]cloud.

Customers using LiteLLM Cloud or the official LiteLLM Proxy Docker image were not affected due to strict version locking, whereas developers and downstream projects that installed unpinned versions via pip during the specified time window were compromised.

Within 3 hours, the malicious packages were removed from PyPI repository, and the LiteLLM team suspended new releases, rotated credentials, and engaged an external incident response process. Teams that use LiteLLM in their projects are advised to immediately check for the litellm_init.pth compromise indicator and routinely rotate all potentially compromised secrets.

Features of the TeamPCP Cloud Stealer malware

Attackers added new logic to GitHub Actions and the Trivy executable while preserving the original functionality. Vulnerability scan results via Trivy appeared normal, but at the same time, valuable data was being searched for and extracted. Malicious code was:

• performing reconnaissance (collected network data and environment variables);
• searching for tokens and credentials to access AWS and GCP cloud environments;
• scanning memory (/proc/*/mem) to extract secrets stored in the memory of Runner.Worker and Runner.Listener processes;
• extracting Kubernetes secrets (/run/secrets/kubernetes.io/serviceaccount);
• collecting data for connecting to database servers (MySQL, PostgreSQL, MongoDB, Redis, Vault);
• collecting any other API keys and secrets from environment files and CI/CD configuration files (.env, .json, .yml);
• searching for webhooks for Slack and Discord channels;
• searching for data related to crypto wallets (variables related to the Solana blockchain, as well as rpcuser and rpcpassword data).

The collected data was encrypted and uploaded to a server with a name similar to the name of the Trivy’s developers (scan.aquasecurtiy[.]org). As a backup mechanism, the attackers provided a way for uploading data to a repository named docs-tpcp.

The attack on CheckMarx and LiteLLM used a similar tactic with other typosquatting domains: models.litellm[.]cloud and checkmarx[.]zone.

Response and Defense Strategies for CVE-2026-33634

Existing signature-based checks and dependency scanning in public registries are no longer sufficient, as the malicious code was injected directly into trusted, signed actions and evaded detection until behavioral monitoring was applied. CI/CD pipelines have become the “new perimeter” of security.

Immediate Actions.  Ensure that all workflows use secure versions (Trivy binary 0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6).

CI/CD pipeline administrators and security teams should immediately review their dependances to Checkmarx (kics-github-action, ast-github-action) and Trivy (setup-trivy and trivy-action) solutions. If workflows referenced a version tag rather than a specific SHA hash, carefully review your workflow execution logs for the duration of the active supply chain attack.

You should also check your network logs for traffic to the domains scan.aquasecurtiy[.]org, checkmarx[.]zone, and models.litellm[.]cloud. The presence of such traffic indicates that sensitive data has been successfully exfiltrated.

If a repository named docs-tpcp has appeared on organization’s GitHub, this may also indicate a successful data breach.

In any case, a proactive threat hunting should be conducted, assuming that the systems have been successfully compromised and that the attackers have rapidly advanced within the affected systems.

It is recommended to restore the affected environments from verified backups.

Dependency pinning and secret management. Ensure that exact dependency versions are pinned using cryptographic hashes in all pipelines and Dockerfiles. We advise transition from long-lived tokens to short-lived credentials by using a secrets manager tool and implementing OIDC integrations where they are supported. Minimize the injection of secrets into the runtime environment — do so only when it is absolutely necessary. Ensure that secrets are not stored on disk or in temporary files, and are not reused across different processes.

Other security measures. Allow only GitHub Actions from a list approved by the organization; block new and unverified processes. Configure GITHUB_TOKEN and other access keys in accordance with the principle of least privilege. Do not grant write permissions unless absolutely necessary.

To enhance the security of GitHub Actions, there are several open-source tools available:

• zizmor — a tool for static analysis and detection of configuration errors in GitHub Actions;
• gato and Gato-X — two versions of a tool that helps identify structurally vulnerable pipelines;
• allstar — a GitHub application developed by OpenSSF to configure and enforce security policies in GitHub organizations and repositories.

 

If you want to learn more about supply chain attacks, we invite you to look at our analytical report Supply chain reaction: securing the global digital ecosystem in an age of interdependence. It’s based on insights from technical experts and reveals how often organizations face supply chain and trusted relationship risks, where protection gaps remain, and what strategies to employ to improve resilience against this kind of threats.

Kaspersky official blog – ​Read More

DDoS attacks are no longer only an infrastructure problem. They can quickly turn into a business issue, affecting uptime, customer experience, and operational stability. Kamasers is a strong example of this new reality, with broad attack capabilities and resilient command-and-control mechanisms that allow it to remain active under pressure.

Let’s explore the Kamasers botnet through both technical and behavioral analysis, looking at the commands it receives, the geographic distribution of its attacks, and the functions implemented in the malware sample. Together, these elements help reveal how Kamasers operates and why it poses a serious threat to organizations worldwide

Key Takeaways 

• Kamasers is a sophisticated DDoS botnet that supports both application-layer and transport-layer attacks, including HTTP, TLS, UDP, TCP, and GraphQL-based flooding. 

• The malware can also act as a loader, downloading and executing additional payloads, which raises the risk of further compromise, data theft, and ransomware deployment.

• Its C2 infrastructure is resilient, using a Dead Drop Resolver (DDR) through legitimate public services such as GitHub Gist, Telegram, Dropbox, Bitbucket, and even Etherscan to retrieve active C2 addresses. 

• Analysis showed that Railnet ASN repeatedly appeared in malicious activity tied to multiple malware families, making it a notable infrastructure element in the broader threat landscape. 

• Kamasers was observed being distributed through GCleaner and Amadey, showing that it fits into established malware delivery chains. 

• The botnet’s activity is international, with strong submission visibility in Germany and the United States, while targeting extends across sectors including education, telecom, and technology.

The Business Risk Behind Kamasers 

Kamasers is a flexible attack platform that can turn compromised enterprise systems into operational liabilities, external attack infrastructure, and potential entry points for deeper compromise: 

• Corporate infrastructure can be turned against others: Infected enterprise systems may be used to launch DDoS attacks on third parties, creating reputational, contractual, and even legal risk for the organization. 

• A broader incident can follow quickly: Because Kamasers can function as a loader, a single infection may lead to additional payload delivery, raising the risk of data theft, ransomware, and deeper intrusion. 

• Visibility gaps become harder to defend: The malware uses legitimate public services to retrieve C2 information, making malicious communication more difficult to detect and increasing the chance of delayed response. 

• Response costs rise fast: Investigating infected hosts, validating external impact, restoring systems, and handling possible IP blacklisting can create significant operational and financial strain. 

• Business trust can be affected early: If company infrastructure is linked to malicious traffic, customers, partners, and providers may react before the full incident is even understood. 

Kamasers highlights a serious enterprise risk: attackers can use resilient C2 discovery, flexible attack methods, and follow-on payload delivery to turn a single compromise into an incident with operational, financial, compliance, and reputational consequences. 

Kamasers Threat Overview 

Kamasers is a malware botnet family designed to carry out DDoS attacks using both application-layer and transport-layer vectors. It supports HTTP GET/POST floods, API-targeted attacks, defense evasion techniques, TLS handshake exhaustion, connection-holding methods, as well as UDP and TCP floods. Infected nodes receive commands from the command-and-control infrastructure and generate the corresponding traffic. In addition, Kamasers can also function as a loader, downloading and executing files from the network. 

ANY.RUN previously observed activity associated with Udados, which is most likely an evolution or updated version of Kamasers. As such, Udados can be considered part of the Kamasers family. 

You can find public sandbox analysis sessions related to the Kamasers family with the following Threat Intelligence Lookup query: 

threatName:”kamasers” 

If a corporate host becomes part of a botnet and is used to carry out DDoS attacks, the organization may face financial risks related to incident response, system recovery, network costs, and potential contractual penalties, as well as regulatory scrutiny if inadequate security measures are identified, especially in cases involving data compromise. 

An additional risk stems from the malware’s ability to act as a loader, downloading and executing third-party payloads. This increases the likelihood of further intrusion, data exfiltration, ransomware deployment, and the resulting operational and reputational damage. 

C2 and Infrastructure  

As part of the analysis, it was observed that the bot received the !httpbypass control command, which initiates an HTTP flood attack against a specified URL with defined intensity and duration parameters. After completing the attack, the bot reported its status and returned to standby mode. 

View analysis session 

 In the sandbox analysis session, we can see how a DDoS attack targets a domain: 

In a number of analysis sessions, the command-and-control server was used not only to coordinate DDoS activity, but also to deliver additional payloads. Specifically, the bot received the !downloadcommand, after which it downloaded and executed a file from an external domain, then confirmed successful session completion to the C2 server: 

View analysis session 

In one observed case, the bot received the !descargar command, the Spanish-language equivalent of !download, to retrieve an executable file from an external domain. 

View analysis session with C2 command in Spanish 

In some cases, the Kamasers botnet was observed using public blockchain infrastructure as an auxiliary mechanism for obtaining the C2 address. Specifically, infected hosts queried the Etherscan API(api.etherscan.io) to retrieve data containing the URL of the command-and-control server: 

View session querying the Etherscan API 

After obtaining the URL, the bot connects to the C2 server and sends information about its ID, command execution status, bot version, privileges on the infected host, C2 discovery source, and system information: 

In a number of cases, Kamasers uses public services, including GitHub, as an auxiliary source of configuration: 

Check how Kamasers uses public services  

Behavioral analysis of Kamasers showed that the botnet frequently establishes connections to IP addresses associated with Railnet LLC’s ASN.

Railnet is regularly mentioned in public reporting as a legitimate front for the hosting provider Virtualine. This provider is known for the absence of KYC procedures, and some research has noted that the associated infrastructure is used to host malicious services and facilitate attacks. 

Railnet infrastructure has previously been observed in campaigns targeting both government and private-sector organizations across several European countries, including Switzerland, Germany, Ukraine, Poland, and France. 

There are also documented cases of Railnet infrastructure being used to distribute other malware families, including Latrodectus, which a number of reports link to activity associated with groups such as TA577. 

At the time of analysis, ANY.RUN data showed that Railnet’s ASN consistently appeared in reports tied to a wide range of malicious activity and was being used by multiple malware families. These were not isolated incidents, but a recurring pattern: the same ASN was repeatedly involved across different campaigns, making it a convenient infrastructure hub for threat actors. 

The current picture of Railnet activity can be quickly verified using ANY.RUN’s Threat Intelligence Lookup. Searching by ASN makes it possible to assess how extensively it is involved in malicious chains, which malware families interact with it, and how the nature of that activity changes over time: 

destinationIpAsn:”railnet” 

In the analyzed sandbox sessions, Kamasers was distributed via GCleaner and Amadey, a delivery pattern that has also been observed in other DDoS campaigns.

Attack Geography and Targeting 

Among the observed DDoS targets were companies in the LATAM region. However, according to ANY.RUN’s threat intelligence data, the targeting profile is broader: the education sector is affected most often, along with telecommunications and technology organizations. 

By geographic distribution of observed submissions, the largest share comes from Germany and the United States, with separate cases also recorded in Poland and other countries. During the analysis, control commands in Spanish were also observed. This may indirectly suggest that the botnet may have originated from, or evolved within, a Spanish-speaking operator environment, although its actual activity is clearly international in scope. 

It is also important to consider that the botnet uses the infrastructure of infected hosts to carry out attacks. If corporate systems are compromised, the organization may not only become a potential target itself, but also inadvertently serve as a source of attacks against third parties. This creates reputational risks, the possibility of IP address blacklisting, and additional financial costs related to investigation and infrastructure recovery. 

Technical Breakdown of Kamasers  

To better understand the Kamasers botnet architecture, a detailed sample analysis was conducted. The starting point was the sample from this ANY.RUN sandbox session:

Check analysis session 

This was followed by reverse engineering of the binary. The analysis focused primarily on how the malware receives and processes commands from the C2 server, as well as the attack capabilities implemented in the sample. 

After launch, the malware begins retrieving commands through a Dead Drop Resolver mechanism. It uses public services such as GitHub Gist, Telegram, Dropbox, and Bitbucket as intermediary sources. From these sources, the bot extracts the address of the real C2 server and then establishes a connection to it. 

Command processing takes place in several stages. First, the bot verifies that the command format is valid. All valid commands must begin with the “!” character. If this prefix is missing, the command is rejected and not executed. 

After validating the prefix, the bot matches the command against an internal handler table. The analysis showed that Kamasers uses a handler caching mechanism. If the previously used handler matches the current command index, the bot takes a fast path without performing another lookup. Otherwise, it triggers the dynamic resolution routine. 

This mechanism can be briefly described as shown in the pseudocode above. 

One of the most illustrative commands is !udppro. It implements a high-speed UDP flood with support for source IP spoofing. Code analysis shows the standard sequence for creating a UDP socket via the WinSock API using the AF_INET, SOCK_DGRAM, and IPPROTO_UDP parameters. 

After initializing the socket, the malware configures the packet transmission parameters. Support for IP spoofing enables reflection and amplification attacks through public NTP and DNS servers. In such scenarios, the victim receives responses that are significantly larger than the original requests, leading to a sharp increase in load.  

The !download command is also present, implementing a Download & Execute mechanism. The bot retrieves an executable file from the specified URL, checks for the MZ signature, allocates memory, maps the sections, and transfers execution to the entry point. If successful, it sends a task completion message; if an error occurs, it generates a failure notification. 

Implementation of Dead Drop Resolver Channels

Kamasers uses four Dead Drop Resolver channels: GitHub Gist, a Telegram bot, a file hosted on Dropbox, and a Bitbucket repository. Importantly, links to these services are not stored in the sample in plain form. Instead, they are constructed and unpacked dynamically at runtime, which is why such strings do not appear during static analysis of the binary. 

The Dead Drop Resolver (DDR) mechanism serves as an intermediary layer between the bot and the primary C2 server. After launch, the malware sequentially sends HTTP GET requests to each of the public resources. The content hosted there contains the current address of the command-and-control server. Once a response is received, the bot extracts the C2 address and establishes a direct connection to continue receiving commands. 

If the first source returns a valid address, no further requests are made. If the connection fails or the response is invalid, the bot automatically falls back to the next channel: Telegram, then Dropbox, and finally Bitbucket. 

All of these resources ultimately point to the same C2 infrastructure: 

If none of the DDR channels responds, the malware falls back to a built-in list of backup domains. 

Catching Kamasers Early: A Practical Detection Approach 

Kamasers shows how a single malware infection can quickly turn into a broader business problem. Beyond DDoS activity, the botnet can also download and execute additional payloads, increasing the risk of deeper compromise. 

For security teams, the challenge is not only spotting the malware itself but also understanding whether an infected host is being used for external attacks, communicating with resilient C2 infrastructure, or pulling in follow-on payloads. 

Early detection depends on moving quickly from suspicious network activity to confirmed malicious behavior. 

1. Monitoring: Spot Malicious Infrastructure and Unusual Network Behavior Early 

Kamasers relies on external infrastructure to receive commands, retrieve C2 addresses, and in some cases download additional payloads. It also uses public services such as GitHub Gist, Telegram, Dropbox, Bitbucket, and even Etherscan as part of its Dead Drop Resolver logic. 

Monitoring for suspicious outbound connections, newly observed infrastructure, and repeated communication with known malicious hosting can help teams detect activity before the infection leads to larger operational impact. 

ANY.RUN’s Threat Intelligence Feeds help surface suspicious indicators early, giving SOC teams faster visibility into malicious domains, IPs, and infrastructure patterns linked to emerging threats. 

2. Triage: Confirm Botnet Activity with Behavior-Based Analysis 

With threats like Kamasers, static detection alone may not show the full risk. A suspicious file may appear inconclusive until its real behavior is observed during execution. 

Running the sample inside the ANY.RUN interactive sandbox makes it possible to confirm the full execution flow, including: 

• retrieval of C2 data through Dead Drop Resolver channels 
• connection to the active command-and-control server 
• receipt and execution of DDoS commands 
• download-and-execute behavior through commands like !download or !descargar 
• status reporting back to the C2 infrastructure 

This helps teams quickly determine whether the malware is only participating in DDoS activity or whether it also creates risk of further payload delivery and deeper compromise. 

3. Threat Hunting: Pivot from One Sample to Related Infrastructure 

Once Kamasers is confirmed, the next step is understanding how far the activity may extend. 

Using ANY.RUN’s Threat Intelligence Lookup, teams can pivot from the initial sample to uncover related infrastructure, connected sessions, and recurring patterns across the broader campaign. 

This makes it possible to: 

• identify other samples tied to the Kamasers family 
• trace infrastructure linked to the botnet’s C2 activity 
• investigate repeated use of ASN-linked hosting such as Railnet
• expand detection based on shared behavior and network indicators 

threatName:”kamasers” 

By pivoting from one confirmed sample, security teams can turn a single investigation into broader visibility across related botnet activity. 

Conclusion 

Kamasers is a sophisticated DDoS botnet with a well-designed architecture. Its use of a Dead Drop Resolver through legitimate services makes its C2 infrastructure highly resilient to takedown efforts. The presence of 16 different attack methods, including modern vectors such as GraphQL and HTTP bypass, along with advanced implementations of classic techniques, makes Kamasers a highly versatile tool for carrying out DDoS attacks. 

For business leaders, Kamasers shows that resilient, multi-vector botnets can threaten not only infrastructure, but also uptime, customer experience, and revenue-critical operations. 

Power faster, clearer investigations with ANY.RUN ➜ 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, fits naturally into modern SOC workflows and supports investigations from initial alert to final containment.  

It allows teams to safely execute suspicious files and URLs, observe real behavior in an interactive environment, enrich indicators with immediate context through TI Lookup, and continuously monitor emerging infrastructure using Threat Intelligence Feeds. Together, these capabilities help reduce uncertainty, accelerate triage, and limit unnecessary escalations across the SOC.  

ANY.RUN also meets enterprise security and compliance expectations. The company is SOC 2 Type II certified, reinforcing its commitment to protecting customer data and maintaining strong security controls.  

Complete List of Kamasers Commands 

Indicators of Compromise (IOCs)   

• F6c6e16a392be4dbf9a3cf1085b4ffc005b0931fc8eeb5fedf1c7561b2e5ad6b
• Dd305f7f1131898c736c97f43c6729bf57d3980fc269400d23412a282ee71a9a
• hxxp://45[.]151[.]91[.]187/pa[.]php
• hxxp://91[.]92[.]240[.]50/pit/wp[.]php
• 071a1960fbd7114ca87d9da138908722d7f1c02af90ea2db1963915fbe234c52
• hxxp://178[.]16[.]54[.]87/uda/ph[.]php

C2 Infrastructure (DDR): 

• gist[.]github[.]com/pitybugak/5d16b75e8bd071e15b04cc9c06dcfafa[.]js
• api[.]telegram[.]org/bot8215158687:AAFgSmsaxfsJozcHIIYPv-HytZ3eCEaUrKg
• dl[.]dropboxusercontent[.]com/s/jqvpmc0kwg6ffi1mineh2/fj[.]txt
• Bitbucket[.]org/serky/repyx/raw/main/fq[.]txt

Fallback domains: 

• pitybux[.]com
• ryxuz[.]com
• toksm[.]com
• Boskuh[.]com

Yara rules: 

rule Kamasers { 

    meta: 

        description = “Detects Kamasers DDoS botnet” 

        author = “ANY.RUN” 

        date = “2026-02-11” 

        threat = “Kamasers” 

    strings: 

        $cmd1 = “!stop” ascii fullword 

        $cmd2 = “!download” ascii fullword 

        $cmd3 = “!visiturl” ascii fullword 

        $cmd4 = “!httpget” ascii fullword 

        $cmd5 = “!httpgetpro” ascii fullword 

        $cmd6 = “!httppost” ascii fullword 

        $cmd7 = “!tlsflood” ascii fullword 

        $cmd8 = “!httpbypass” ascii fullword 

        $cmd9 = “!graphql” ascii fullword 

        $cmd10 = “!httphulk” ascii fullword 

        $cmd11 = “!fastflood” ascii fullword 

        $cmd12 = “!proloris” ascii fullword 

        $cmd13 = “!slowread” ascii fullword 

        $cmd14 = “!udppro” ascii fullword 

        $cmd15 = “!tcppro” ascii fullword 

        $cmd16 = “!tcphold” ascii fullword 

        $msg1 = “Task completed:” ascii fullword 

        $msg2 = “Task completed: GraphQL Flood on” ascii fullword 

        $msg3 = “Task completed: HULK on” ascii fullword 

        $msg4 = “Task completed: UDPPRO Flood on” ascii fullword 

        $msg5 = “Task completed: TCPPRO Flood on” ascii fullword 

        $msg6 = “Task completed: TCP HOLD on” ascii fullword 

        $msg7 = “Task completed: Download & Execute from” ascii fullword 

        $msg8 = “Task completed: Visit URL” ascii fullword 

        $msg9 = “Starting GraphQL Flood on” ascii fullword 

        $msg10 = “Starting HULK on” ascii fullword 

        $msg11 = “Starting UDP PRO on” ascii fullword 

        $msg12 = “Starting TCP PRO on” ascii fullword 

        $msg13 = “Starting TCP HOLD on” ascii fullword 

        $msg14 = “Starting Visit URL task on” ascii fullword 

        $msg15 = “Runtime error in D&E task:” ascii fullword 

        $msg16 = “Unknown exception in DownloadAndExecuteTask” ascii fullword 

        $msg17 = “Awaiting task” ascii fullword 

        $msg18 = “Downloading file from:” ascii fullword 

        $msg19 = “Downloaded file disappeared (AV/EDR?)” ascii fullword 

        $msg20 = “Download failed with HRESULT:” ascii fullword 

        $msg21 = “HTTP GET Flood” ascii fullword 

        $msg22 = “HTTP GET PRO” ascii fullword 

        $msg23 = “HTTP POST Flood” ascii fullword 

        $msg24 = “HULK_POST” ascii fullword 

    condition: 

        uint16(0) == 0x5A4D and 

        (10 of ($cmd*)) and 

        (8 of ($msg*)) 

} 

The post Kamasers Analysis: A Multi-Vector DDoS Botnet Targeting Organizations Worldwide  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More