BotNet Blog

DATE	NAME	Info	CATEG.	WEB
16.5.26	Kazuar: Anatomy of a nation-state botnet	Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations.	BotNet blog	Microsoft blog
18.4.26	PowMix botnet targets Czech workforce	Cisco Talos discovered an ongoing malicious campaign, operating since at least December 2025, affecting a broader workforce in the Czech Republic with a previously undocumented botnet we call “PowMix.”	BotNet blog	CISCO TALOS
11.4.26	Masjesu Rising: The Commercial IoT Botnet Built for Stealth, DDoS, and IoT Evasion	Masjesu Botnet: Deep dive into the commercially-run IoT threat, its stealth, multi-XOR evasion, and expanded architecture targets. Secure your network!	BotNet blog	Trelix
10.1.26	Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns	GoBruteforcer (also called GoBrut) is a modular botnet, written in Go, that brute-forces user passwords for services such as FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux servers. The botnet spreads through a chain of web shell, downloader, IRC bot, and bruteforcer modules.	BotNet blog	CHECKPOINT