Botnets.fr - User contributions [en]

LockBit

2021-07-15T05:04:26Z

Eric.freyssinet:

{{Botnet
|Feature=AES encryption, Affiliation, ECC
|Programming language=C, ASM
|BeginYear=2019
|Group=Ransomware, Cryptolocker
}}

LockBit

2021-07-15T05:01:48Z

Eric.freyssinet:

LockBit

2021-07-15T05:01:25Z

Eric.freyssinet:

LockBit

2021-07-15T05:00:28Z

Eric.freyssinet: Created page with "{{Campaign}}"

Template:Editor

2021-07-14T20:55:27Z

Eric.freyssinet:

<noinclude>
This is the "Editor" template.
It should be called in the following format:
<pre>
{{Editor
|Introduction=
|Link=
}}
</pre>
Edit the page to see the template text.
</noinclude><includeonly>__NOTOC__
''(Editor) Link to the old Wiki page : [https://www.botnets.fr/wiki.old/index.php/{{BASEPAGENAMEE}}]''
{| style="width: 30em; font-size: 90%; border: 1px solid #aaaaaa; background-color: #f9f9f9; color: black; margin-bottom: 0.5em; margin-left: 1em; padding: 0.2em; float: right; clear: right; text-align:left;"
! style="text-align: center; background-color:#ccccff;" colspan="2" |<big>{{PAGENAME}}</big>
|-
! Link
| {{#if:{{{Link|}}}|[[link::{{{Link|}}}]] ({{Wayback |url={{{Link|}}}}})|}}
|}
==Introduction==
{{{Introduction|}}}
==Publications==
{{#ask:[[Category:Publications]] [[editor::{{PAGENAME}}]]
|?author
|?botnet
|?campaign
|?year}}
[[Category:Editors]]
</includeonly>

Template:Author

2021-07-14T20:54:49Z

Eric.freyssinet:

<noinclude>
This is the "Author" template.
It should be called in the following format:
<pre>
{{Author
|Blog=
|Twitter=
}}
</pre>
Edit the page to see the template text.
</noinclude><includeonly>
''(Botnet) Link to the old Wiki page : [https://www.botnets.fr/wiki.old/index.php/{{BASEPAGENAMEE}}] / Google search: [https://www.google.fr/search?q={{BASEPAGENAMEE}}+Botnet]''
==Blog==
[[blog::{{{Blog|}}}]]

{{#if:{{{Twitter|}}}|==Twitter==
[https://twitter.com/{{{Twitter|}}} @{{{Twitter|}}}] {{#set:twitter={{{Twitter|}}}}}|}}

==Publications==
{{#ask:[[Category:Publications]] [[author::{{PAGENAME}}]]
|?botnet
|?campaign
|?year}}

[[Category:Authors]]
</includeonly>

Template:Year

2021-07-14T20:54:07Z

Eric.freyssinet:

<noinclude>
This is the "Year/Month" template.
It should be called in the following format:
<pre>
{{Year (or Month)
|Description=
}}
</pre>
Edit the page to see the template text.
</noinclude><includeonly>__NOTOC__
''(Year/Month)''
==Description==
[[description::{{{Description|}}}]]
==Botnets==
* Starting in {{PAGENAME}}: {{#ask:[[Category:Botnets]] [[begin year::{{PAGENAME}}]]}}
* Ending in {{PAGENAME}}: {{#ask:[[Category:Botnets]] [[end year::{{PAGENAME}}]]}}
==Publications==
{{#ask:[[Category:Publications]] [[year::{{PAGENAME}}]]
|?author
|?editor
|?botnet
|?campaign}}

{{#ifeq:{{#len:{{BASEPAGENAME}}}}|4|[[Category:Years]]|[[Category:Months]]}}
</includeonly>

2021

2021-07-14T20:53:19Z

Eric.freyssinet: Created page with "{{Year}}"

REvil ransomware gang's web sites mysteriously shut down

2021-07-14T20:52:53Z

Eric.freyssinet:

{{Publication
|Campaign=REvil
|Group=Ransomware, Cryptolocker
|Year=2021
|Date=2021-07-13
|Editor=Bleeping Computer
|Link=https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/
|Author=Lawrence Abrams
|Type=Press article
|Abstract=The infrastructure and websites for the REvil ransomware operation have mysteriously gone offline as of last night.

The REvil ransomware operation, aka Sodinokibi, operates through numerous clear web and dark web sites used as ransom negotiation sites, ransomware data leak sites, and backend infrastructure.

Starting last night, the websites and infrastructure used by the REvil ransomware operation have mysteriously shut down.
}}

REvil ransomware gang's web sites mysteriously shut down

2021-07-14T20:52:09Z

Eric.freyssinet:

{{Publication
|Campaign=REvil
|Year=2021
|Date=2021-07-13
|Editor=Bleeping Computer
|Link=https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/
|Type=Press article
|Abstract=The infrastructure and websites for the REvil ransomware operation have mysteriously gone offline as of last night.

The REvil ransomware operation, aka Sodinokibi, operates through numerous clear web and dark web sites used as ransom negotiation sites, ransomware data leak sites, and backend infrastructure.

Starting last night, the websites and infrastructure used by the REvil ransomware operation have mysteriously shut down.
}}

Form:Publication

2021-07-14T20:51:28Z

Eric.freyssinet:

<noinclude>
This is the "Publication" form.
To create a page with this form, enter the page name below;
if a page with that name already exists, you will be sent to a form to edit that page.

{{#forminput:form=Publication}}

</noinclude><includeonly>
<div id="wikiPreview" style="display: none; padding-bottom: 25px; margin-bottom: 25px; border-bottom: 1px solid #AAAAAA;"></div>
{{{for template|Publication}}}
{| class="formtable"
! Image:
| {{{field|Image}}}
|-
! Legend:
| {{{field|Legend}}}
|-
! Botnet:
| {{{field|Botnet|values from category=Botnets}}}
|-
! Malware:
| {{{field|Malware|values from category=Malware}}}
|-
! Exploit kit:
| {{{field|ExploitKit|values from category=Exploit kits|input type=tokens}}}
|-
! Services:
| {{{field|Service|values from category=Services|input type=tokens}}}
|-
! Target:
| {{{field|Target|input type=tokens}}}
|-
! Origin:
| {{{field|Origin}}}
|-
! Campaign:
| {{{field|Campaign|values from category=Campaigns|input type=tokens}}}
|-
! Feature:
| {{{field|Feature|values from category=Features}}}
|-
! Strings:
| {{{field|String|input type=tokens}}}
|-
! Distribution vector:
| {{{field|Vector|input type=tokens}}}
|-
! Vulnerability:
| {{{field|Vulnerability|values from category=Vulnerabilities}}}
|-
! CCProtocol:
| {{{field|CCProtocol}}}
|-
! Programming language:
| {{{field|Programming language|input type=tokens}}}
|-
! Botnet/malware group:
| {{{field|Group|input type=tokens|value from category=Groups}}}
|-
! Operation/working group:
| {{{field|Operation|input type=tokens|value from category=Operations}}}
|-
! Year:
| {{{field|Year}}}
|-
! Date:
| {{{field|Date|input type=datepicker}}}
|-
! Editor/Conference:
| {{{field|Editor}}}
|-
! Link:
| {{{field|Link}}}
|-
! DOI:
| {{{field|DOI}}}
|-
! Author:
| {{{field|Author}}}
|-
! Type:
| {{{field|Type}}}
|-
! Abstract:
| {{{field|Abstract|input type=textarea|editor=wikieditor}}}
|}
{{{end template}}}

'''Free text:'''

{{{standard input|free text|rows=10}}}

{{{standard input|summary}}}

{{{standard input|minor edit}}} {{{standard input|watch}}}

{{{standard input|save}}} {{{standard input|preview}}} {{{standard input|changes}}} {{{standard input|cancel}}}
</includeonly>

REvil ransomware gang's web sites mysteriously shut down

2021-07-14T20:50:45Z

Eric.freyssinet:

{{Publication
|Campaign=REvil
|Year=2021
|Date=2021/07/13
|Link=https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/
|Type=Press article
|Abstract=The infrastructure and websites for the REvil ransomware operation have mysteriously gone offline as of last night.

The REvil ransomware operation, aka Sodinokibi, operates through numerous clear web and dark web sites used as ransom negotiation sites, ransomware data leak sites, and backend infrastructure.

Starting last night, the websites and infrastructure used by the REvil ransomware operation have mysteriously shut down.
}}

Bac à sable

2021-07-14T20:40:01Z

Eric.freyssinet:

|{{Flagicon|France|size=50px|altlink=Landings_FR}}|

<imagemap>
</imagemap>

Bac à sable

2021-07-14T20:38:55Z

Eric.freyssinet:

|{{Flagicon|France|size=50px|altlink=Landings_FR}}|

<imagemap>

Template:Publication

2021-07-14T12:01:45Z

Eric.freyssinet:

<noinclude>
This is the "Publication" template.
It should be called in the following format:
<pre>
{{Publication
|Image=
|Legend=
|Botnet=
|Malware=
|Group=
|Target=
|ExploitKit=
|Feature=
|String=,
|Vector=
|Campaign=
|Service=
|Vulnerability=
|CCProtocol=
|Operation=
|Year=
|Date=
|Editor=
|Link=
|Author=
|Type=
|Abstract=
}}
</pre>
Edit the page to see the template text.
</noinclude><includeonly>__NOTOC__
''(Publication) Google search: [https://www.google.fr/search?q={{BASEPAGENAMEE}}+Botnet]''
{| style="width: 30em; font-size: 90%; border: 1px solid #aaaaaa; background-color: #f9f9f9; color: black; margin-bottom: 0.5em; margin-left: 1em; padding: 0.2em; float: right; clear: right; text-align:left;"
! style="text-align: center; background-color:#ccccff;" colspan="2" |<big>{{PAGENAME}}</big>
{{#if:{{{Image|}}}|
{{!}}-
! colspan=2 align="center" {{!}} [[Image:{{{Image|}}}|120px]]
|}}
|-
! Botnet
| {{#arraymap:{{{Botnet|}}}|,|x|[[botnet::x]]}}
|-
! Malware
| {{#arraymap:{{{Malware|}}}|,|x|[[malware::x]]}}
|-
! Botnet/malware group
| {{#arraymap:{{{Group|}}}|,|x|[[group::x]]}}
|-
! Exploit kits
| {{#arraymap:{{{ExploitKit|}}}|,|y|[[exploit_kit::y]]}}
|-
! Services
| {{#arraymap:{{{Service|}}}|,|y|[[service::y]]}}
|-
! Feature
| {{#arraymap:{{{Feature|}}}|,|x|[[feature::x]]}}{{#if:{{{String|}}}| String(s): {{#arraymap:{{{String|}}}|,|w|[[botnetstring::w]]}}|}}
|-
! Distribution vector
| {{#arraymap:{{{Vector|}}}|,|x|[[vector::x]]}}
|-
! Target
| {{#arraymap:{{{Target|}}}|,|x|[[target::x]]}}
|-
! Origin
| {{#arraymap:{{{Origin|}}}|,|x|[[origin::x]]}}
|-
! Campaign
| {{#arraymap:{{{Campaign|}}}|,|x|[[campaign::x]]}}
|-
! Operation/Working group
| {{#arraymap:{{{Operation|}}}|,|x|[[operation::x]]}}
|-
! Vulnerability
| {{#arraymap:{{{Vulnerability|}}}|,|x|[[vuln::x]]}}
|-
! CCProtocol
| {{#arraymap:{{{CCProtocol|}}}|,|x|[[cc_protocol::x]]}}
|-
! Date
| [[year::{{{Year|}}}]] / [[date::{{{Date|}}}]]
|-
! Editor/Conference
| [[editor::{{{Editor|}}}]]
|-
! Link
| {{#if:{{{Link|}}}|[[link::{{{Link|}}}]] ({{Wayback |url={{{Link|}}}}})}}{{#if:{{{DOI|}}}| DOI: [http://doi.org/{{{DOI|}}} {{{DOI|}}}]}}
|-
! Author
| {{#arraymap:{{{Author|}}}|,|x|[[author::x]]}}
|-
! Type
| [[type::{{{Type|}}}]]
|}

== Abstract ==
{{quotation|{{{Abstract|}}}}}
== Bibtex ==
<tt>
@{{#ifeq:{{{Type|}}}|Scientific paper|article|misc}}{{{Last word|{{First word|{{{Author|}}}|sep=,}}}}{{{Year|}}}BFR{{PAGEID}},
editor = {{{{Editor|}}}},
author = {{{#arraymap:{{{Author|}}}|,|x}}},
title = {{{PAGENAME}}},
date = {{{#time:d|{{{Date|}}}}}},
month = {{#time:M|{{{Date|}}}}},
year = {{{{Year|}}}},{{#if:{{{DOI|}}}| doi = {{{{DOI|}}}},}}
howpublished = {\url{{{{Link|}}}}},
}
</tt>
[[Category:Publications]]
</includeonly>

REvil ransomware gang's web sites mysteriously shut down

2021-07-14T11:56:26Z

Eric.freyssinet: Created page with "{{Publication| Link=https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/}}"

{{Publication| Link=https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/}}

Qlocker

2021-07-11T11:33:27Z

Eric.freyssinet: Created page with "{{Campaign |Group=Cryptolocker, Ransomware }}"

WannaCry

2021-07-11T11:33:11Z

Eric.freyssinet:

WannaCry

2021-07-11T11:32:47Z

Eric.freyssinet: Eric.freyssinet moved page Wannacry to WannaCry without leaving a redirect

WannaCry

2021-07-11T11:32:12Z

Eric.freyssinet:

WannaCry

2021-07-11T11:31:54Z

Eric.freyssinet:

DarkSide

2021-07-11T11:31:26Z

Eric.freyssinet: Created page with "{{Campaign |Group=Cryptolocker, Ransomware }}"

Bitpaymer

2021-07-11T11:30:45Z

Eric.freyssinet: Created page with "{{Campaign |Alias=DoppelPaymer |Group=Cryptolocker, Ransomware }}"

{{Campaign
|Alias=DoppelPaymer
|Group=Cryptolocker, Ransomware
}}

Egregor

2021-07-11T11:30:20Z

Eric.freyssinet: Created page with "{{Campaign |Group=Cryptolocker, Ransomware }}"

Sodinokibi

2021-07-11T11:29:37Z

Eric.freyssinet: Redirected page to REvil

#REDIRECT[[REvil]]

Sodinokibi

2021-07-11T11:29:26Z

Eric.freyssinet: Created page with "#REDIRECT||REvil]]"

#REDIRECT||REvil]]

REvil

2021-07-11T11:29:07Z

Eric.freyssinet: Created page with "{{Campaign |Alias=Sodinokibi |Group=Cryptolocker, Ransomware }}"

Ragnar Locker

2021-07-11T11:28:25Z

Eric.freyssinet: Created page with "{{Campaign |BeginYear=2019 |Group=Cryptolocker, Ransomware }}"

Ryuk

2021-07-11T11:27:13Z

Eric.freyssinet: Created page with "{{Campaign |Group=Cryptolocker, Ransomware }}"

Mailto

2021-07-11T11:26:17Z

Eric.freyssinet: Redirected page to Netwalker

#REDIRECT[[Netwalker]]

Netwalker

2021-07-11T10:45:36Z

Eric.freyssinet:

Netwalker

2021-07-11T10:44:22Z

Eric.freyssinet: Created page with "{{Campaign}}"

Live Coronavirus Map Used to Spread Malware

2020-03-14T10:54:24Z

Eric.freyssinet:

{{Publication
|Link=https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/
|Abstract=Cybercriminals constantly latch on to news items that captivate the public’s attention, but usually they do so by sensationalizing the topic or spreading misinformation about it. Recently, however, cybercrooks have started disseminating real-time, accurate information about global infection rates tied to the Coronavirus/COVID-19 pandemic in a bid to infect computers with malicious software.
|Target=COVID-19 pandemic
}}

Live Coronavirus Map Used to Spread Malware

2020-03-14T10:54:00Z

Eric.freyssinet:

Live Coronavirus Map Used to Spread Malware

2020-03-14T10:53:28Z

Eric.freyssinet:

{{Publication
|Link=https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/
|Extract=Cybercriminals constantly latch on to news items that captivate the public’s attention, but usually they do so by sensationalizing the topic or spreading misinformation about it. Recently, however, cybercrooks have started disseminating real-time, accurate information about global infection rates tied to the Coronavirus/COVID-19 pandemic in a bid to infect computers with malicious software.
}}

Live Coronavirus Map Used to Spread Malware

2020-03-14T10:52:23Z

Eric.freyssinet: Created page with "{{Publication| Link=https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/}}"

{{Publication| Link=https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/}}

COVID-19 pandemic

2020-03-14T10:35:35Z

Eric.freyssinet:

{{Asset
|Description=The 2019/2020 COVID-19 coronavirus pandemic resulted in a number of related or co-occurring attacks and malware operations
|TypeOfAsset=News event
}}

Property:Type of asset

2020-03-14T10:30:04Z

Eric.freyssinet:

This is a property of type [[Has type::Text]].

The allowed values for this property are:
* [[Allows value::Operating system]]
* [[Allows value::Runtime engine]]
* [[Allows value::Software]]
* [[Allows value::Country]]
* [[Allows value::Sector]]
* [[Allows value::Company]]
* [[Allows value::Type of platform]]
* [[Allows value::Law enforcement]]
* [[Allows value::People group]]
* [[Allows value::Person]]
* [[Allows value::CPU]]
* [[Allows value::News event]]

COVID-19 Pandemic

2020-03-14T10:21:00Z

Eric.freyssinet: Eric.freyssinet moved page COVID-19 Pandemic to COVID-19 pandemic

#REDIRECT [[COVID-19 pandemic]]

COVID-19 pandemic

2020-03-14T10:20:59Z

Eric.freyssinet: Eric.freyssinet moved page COVID-19 Pandemic to COVID-19 pandemic

COVID-19 pandemic

2020-03-14T10:20:33Z

Eric.freyssinet: Created page with "{{Asset}}"

Main Page

2020-03-14T10:17:33Z

Eric.freyssinet:

__NOTOC__

== Introduction ==
This semantic Wiki is developed since November 2011 in the context of a PhD work on the fight against botnets conducted at the LIP 6 laboratory in Paris (Complex networks team). The PhD was successfully [http://blog.crimenumerique.fr/2015/11/21/lutte-contre-les-botnets/ defended in November 2015 in Paris], France. But work continues...

== Botnets ==
{{Div col|3}}
=== A ===
* [[AbaddonPOS]]
* [[Accdfisa]]
* [[Acebot]]
* [[Ackposts]]
* [[Admin.HLP]]
* [[Adneukine]]
* [[Adrenalin]]
* [[Agobot]] / [[Gaobot]] Related families: [[Phatbot]], [[Forbot]], [[Polybot]], [[XtremBot]]
* [[Ainslot]]
* [[Akbot]] / [[Qakbot]], [[Pinkslipbot]], [[Qbot]]
* [[Aldi]]
* [[Alebrije]]
* [[AlertLock]]
* [[Alina]]
* [[Alphacrypt]]
* [[Alureon]] / [[Olmarik]], [[TDSS]], [[TDL]], [[Popureb]]
* [[Americana Dreams]]
* [[Andromeda]] / [[Gamarue]]
* [[AnnLoader]]
* [[Apbot]]
* [[Arcom]]
* [[Asprox]] / [[Badsrc]], [[Aseljo]]
* [[Athena]]
* [[Atrax]]
* [[Avalanche]]
* [[Avatar]]
* [[Avzahn]]

=== B ===
* [[Backscript]]
* [[Backoff]]
* [[Bagle]] / [[Beagle]], [[Mitglieder]], [[Lodeight]]
* [[Bahama]]
* [[Bamital]]
* [[Barracuda]]
* [[Bashlight]]
* [[Bedep]]
* [[Beebone]] / [[Symmi]], [[Changeup]], [[Vobfus]]
* [[Bereb]] / Related to [[Kiribot]]
* [[BernhardPOS]]
* [[BlackEnergy]]
* [[BlackPOS]] / [[Dump Memory Grabber]]
* [[BlackShades]]
* [[Bmaster]]
* [[Bobax]] / [[Bobic]], [[Oderoor]], [[Cotmonger]], [[Hacktool.Spammer]], [[Kraken]]
* [[Bomba Locker]]
* [[Boxer]]
* [[Bozok]]
* [[Bredolab]]
* [[BrutPOS]]

=== C ===
* [[Carbanak]]
* [[Carberp]] / [[Caberp]], [[Syscron]]
* [[Carna]]
* [[Casier]]
* [[Cbeplay.P]]
* [[Cerber]]
* [[Cerberus]]
* [[Chameleon]]
* [[ChewBacca]]
* [[Chidol]]
* [[Chthonic]]
* [[Cimbot]]
* [[Citadel]]
* [[Clampi]] / [[Ligats]], [[Ilomo]] or [[Rscan]]
* [[Coinbitclip]]
* [[CoinVault]]
* [[Comfoo]]
* [[Conficker]] / [[Downup]], [[Downadup]], [[Kido]]
* [[CoreBot]]
* [[Coreflood]]
* [[Coverton]]
* [[Cridex]] / [[Bugat]], [[Feodo]]
* [[Critroni]] / [[CTB-Locker]]
* [[Cryakl]] / [[Fantomas]]
* [[CryptoDefense]]
* [[CryptoLocker]]
* [[Cryptoblocker]]
* [[CryptXXX]]
* [[Cutwail]] / [[Pandex]], [[Mutant]]
* [[Cythosia]]

=== D ===
* [[Daredevil]]
* [[DaRK DDoSseR]]
* [[Dark-Mailer]]
* [[DarkComet]]
* [[DarkMegi]]
* [[Darkness]] / [[Optima]], [[Votwup]]
* [[Decebal]]
* [[Destory]]
* [[Devdar]]
* [[Dexter]]
* [[Dharma]]
* [[Dirt Jumper]]
* [[Disker]]
* [[DistTrack]]
* [[Dldr.Agent.JKH]]
* [[Dlena]]
* [[Donbot]] / [[Bachsoy]], [[Buzus]]
* [[Dorifel]] / [[Quervar]], [[XDocCrypt]]
* [[Dorkbot]] / [[Nrgbot]], [[Ngrbot]]
* [[Duqu]]
* [[Dyre]] / [[Dyreza]], [[Dyzap]], [[Dyranges]]

=== E ===
* [[Eagle]]
* [[Eggdrop]]
* [[Encriyoko]]
* [[Epubb]]
* [[Ertfor]]
* [[Esthost]]
* [[Etumbot]]
* [[Expiro]] / [[Xpiro]]

=== F ===
* [[Fakavalert]]
* [[FakeM]]
* [[Feederbot]]
* [[Festi]]
* [[Fivetoone]] / [[DMSpammer]]
* [[Flagui]]
* [[Flame]] / [[Flamer]], [[sKyWIper]]
* [[Flashback]] / [[Flashfake]]
* [[Flimrans]]
* [[Foag]]
* [[Forbot]]
* [[FrameworkPOS]]
* [[Frutas]]
* [[Fuflo]]

=== G ===
* [[Galock]]
* [[GamaPoS]]
* [[Gameover]] / [[P2P ZeuS]]
* [[Gammima]]
* [[Gapz]]
* [[Gauss]]
* [[Gbot]]
* [[Gema]]
* [[Gendarmerie]]
* [[Generetic]]
* [[Getmypass]]
* [[Gheg]] / [[Tofsee]], [[Mondera]]
* [[Gimemo]]
* [[Gh0st RAT]]
* [[GlassRAT]]
* [[Goldenbaks]]
* [[GootKit]]
* [[Goscri]]
* [[Gozi]] / [[Ursnif]], [[Prinimalka]], [[Vawtrak]]
* [[Gpcode]]
* [[GranCrab]] / [[GandCrab]]
* [[Grum]] / [[Tedroo]]
* [[Gumblar]]

=== H ===
* [[Hamweq]]
* [[HangOver]]
* [[Harasom]]
* [[Harnig]] / [[Piptea]]
* [[HelloGirl]]
* [[Heloag]]
* [[Hermes]]
* [[HerpesNet]]
* [[Hesperbot]]
* [[Hikit]]
* [[Hiloti]]
* [[Hodprot]]
* [[H-Worm]]

=== I ===
* [[IceIX]]
* [[iKee.B (botnet)]]
* [[Illusion]]
* [[IMDDOS]]
* [[Infinity]]
* [[Ipeur]]
* [[ISR Stealer]]

=== J ===
* [[JackPOS]]
* [[Jagfu]]
* [[Jenxcus]]
* [[Jigsaw]]

=== K ===
* [[Khan]]
* [[Kaiten]]
* [[Karn!v0r3x]]
* [[Kelihos]]
* [[KINS]]
* [[Kjw0rm]]
* [[Kneber]]
* [[Koler]]
* [[Kovter]]
* [[Koobface]]
* [[Kraken]]

=== L ===
* [[Leave]]
* [[Leouncia]]
* [[Lethic]]
* [[LockerGoga]]
* [[LockScreen.CI]]
* [[Locky]]
* [[LogPOS]]
* [[Lukitus]]
* [[LusyPOS]]
* [[Lyposit]]

=== M ===
* [[Maazben]]
* [[Madi]]
* [[Makadocs]]
* [[Malex]]
* [[MalumPoS]]
* [[Mariachi]]
* [[Mariposa]]
* [[MDK]]
* [[Mebromi]]
* [[Medfos]] / [[Midhos]]
* [[Mega-D]] / [[Ozdok]]
* [[Mehika]] / [[TwitterBot]], [[Hittler]]
* [[Metulji]] / [[EvilFistSquad]]
* [[MiniDuke]]
* [[Mirage]]
* [[Mirai]]
* [[Mlano]]
* [[Mocbot]] / [[Wargbot]], [[Graweg]]
* [[ModPOS]]
* [[Monkif]] / [[ExeDot]], [[DIKhora]]
* [[MP-DDoser]]
* [[Multi-Locker]]
* [[Murofet]] / [[Licat]]
* [[Mytob]]

=== N ===
* [[NanoCore]]
* [[Nemucod]]
* [[Netsky]]
* [[Nertra]]
* [[NetTraveler]]
* [[NewPOSThings]]
* [[Ngrbot]]
* [[NitlovePOS]]
* [[Nitol]]
* [[Nitro]]
* [[NjRAT]] / Variant: [[H-Worm]]
* [[Njw0rm]]
* [[Nucrypt]] / [[Loosky]], [[Locksky]]
* [[Nugache]]
* [[Nymaim]]

=== O ===
* [[Obad]]
* [[OneWordSub]]
* [[OphionLocker]]

=== P ===
* [[Pandora]]
* [[Patcher]] / [[Multibanker]], [[Bankpatcher]]
* [[Petya]]
* [[Pexby]]
* [[Phatbot]]
* [[PiceBOT]]
* [[PickPocket]]
* [[Pinkslipbot]]
* [[Pirpi]]
* [[Pitou]]
* [[PlugX]] / [[Korplug]], [[Gulpix]]
* [[Pobelka]]
* [[Poebot]] / [[W32/Linkbot]]
* [[Poison Ivy]]
* [[PokerAgent]]
* [[Polybot]]
* [[Ponmocup]] / [[Pirminay]], [[Swisyn]], [[Vundo]]
* [[Pony]] / [[Fareit]]
* [[Poof]]
* [[Poseidon]]
* [[Power Bot]]
* [[Pramro]]
* [[PrettyPark]]
* [[Prinimalka]]
* [[Psybot]]
* [[PTA]]
* [[Punkey]]
* [[Pushdo]]

=== Q ===
* [[Qadars]]

=== R ===
* [[Ramnit]]
* [[Ranbyus]]
* [[Ranky]]
* [[Rannoh]] / [[Matsnu]]
* [[Ransom.EY]]
* [[Ransom.HY]]
* [[Ransom.IF]]
* [[Ransom.II]]
* [[Ransom.JU]]
* [[Raxm]]
* [[Rdasrv]]
* [[Regin]]
* [[Reposin]]
* [[Revenge RAT]]
* [[Reveton]]
* [[Revoyem]]
* [[Rocra]]
* [[Rustock]] / [[RKRustok]], [[Costrat]], [[Meredrop]]

=== S ===
* [[Sage]]
* [[Sality]]
* [[SamSam]]
* [[Sasser]]
* [[ScarePakage]]
* [[Sdbot]]
* [[Shifu]]
* [[Shylock]] / [[Caphaw]]
* [[Silence Locker]]
* [[Silent Winlocker]]
* [[Silon]]
* [[Simda]]
* [[Simplocker]]
* [[Sinit]]
* [[Sinowal]] / [[Mebroot]], [[Rootkit MBR]], [[Bootkit (botnet)]]
* [[Sir DoOom]]
* [[Skunkx]]
* [[Slapper]]
* [[Smoke Bot]]
* [[SMSZombie]]
* [[Snap]]
* [[Sobig]] / [[Palyh]]
* [[Solar]] / [[Napolar]]
* [[Sopelka]]
* [[Soraya]]
* [[Spachanel]]
* [[SpamSoldier]]
* [[SpamThru]] / [[Spam-DComServ]], [[Covesmer]], [[Xmiler]]
* [[Spark]]
* [[SpyEye]]
* [[SpyBot]] / [[SDBot]], [[Rbot]], [[UrBot]], [[UrXBot]]
* [[Srizbi]] / [[Cbeplay]], [[Exchanger]]
* [[Storm]] / [[Nuwar]], [[Peacomm]], [[Zhelatin]], [[Tibs]]
* [[Stration]] / [[Warezov]], [[Opnis]]
* [[Studma]]
* [[Supern0va]]
* [[Swizzor]]
* [[Sykipot]]
* [[SynoLocker]]

=== T ===
* [[TDL-4]] / [[TDL-3]], [[TDSS]], [[DGAv14]]
* [[Taidoor]]
* [[Tatanarg]]
* [[Tatanga]]
* [[Tequila]]
* [[TeslaCrypt]]
* [[The Mask]]
* [[Thor]]
* [[TidServ]]
* [[Tigger]] / [[Syzor]]
* [[Tilon]]
* [[Tinba]] / [[Gataka]]
* [[TinyNuke]]
* [[Tobfy]]
* [[Tobfy.N]]
* [[Torpig]]
* [[TorrentLocker]]
* [[Travnet]]
* [[TreasureHunt]]
* [[Turla]] / [[Uroburos]], [[Snake]]
* [[Twitter based botnet]]

=== U ===
* [[UBot]]
* [[ULocker]]
* [[Umbra]]
* [[Undefined-04]]
* [[Undefined-10]]
* [[Upas]]
* [[Urausy]]
* [[Uremtoo]]
* [[URLZone]] / [[Downloader-BQZ.a]]

=== V ===
* [[VertexNet]]
* [[Vicas]]
* [[VinSelf]]
* [[ViperRAT]]
* [[VirLock]]
* [[Virut]]
* [[VOlk]]

=== W ===
* [[Waledac]] / [[Waled]], [[SLM]], [[Kelihos]], [[Hilux]], [[Hlux]], [[Nap]]
* [[Wannacry]]
* [[Warezov]]
* [[Warbot]]
* [[Weelsof]]
* [[Wigon]]
* [[Wiper]]
* [[Wirenet]]
* [[Wopla]] / [[Pokier]], Slogger

=== X ===
* [[Xarvester]] / [[Rlsloup]], [[Rucrzy]]
* [[Xpaj]]
* [[Xtreme RAT]]

=== Y ===
* [[YoYo]]
* [[Ysreef]]

=== Z ===
* [[Zapchast]]
* [[Zegost]]
* [[Zemra]]
* [[ZeroAccess]]
* [[ZeroLocker]]
* [[ZeuS]] / [[Zunker]]
* [[ZeuS - P2P+DGA]]
{{Div col end}}

==Campaigns==
{{Div col|3}}
=== D ===
* [[Dragonfly]] / [[Energetic Bear]]
{{Div col end}}

==Groups==
* [[Banking]]
** [[Point-of-sale]]
* [[Click frauding]]
* [[DDoSing]]
* [[Ransomware]]
** [[Cryptolocker]]
** [[Fake antivirus]]
** [[Police lock]]
** [[Ransomware (other)]]
* [[RAT]] / [[Remote administration trojan]]
* [[Spying]]
** [[Destructive]]
* [[Spamming]]
* [[Stealing]]

==Criminal services==
* Bulletproof hosting
* DDoSing / Stress test
* Encryption
* Exchange
* Mules
* Pay-per-install
* Security software check
* Traffic
* VPN

== Panels ==
=== Z ===
* [[Zemra (panel)]]
== Exploit kits/packs ==
{{Div col|3}}
=== A ===
* [[Alpha Pack]]
* [[Angler]]
* [[Archie]]
* [[Assoc AID]]
* [[Astrum]]

=== B ===
* [[Best]]
* [[Black Dragon]]
* [[Blackhole]]
* [[Bleeding Life]]

=== C ===
* [[ChePack]]
* [[CkVip]]
* [[Cool Exploit Kit]]
* [[Cool Pack]]
* [[CritXPack]] / [[Vintage Pack]]

=== D ===
* [[Dotkachef]]

=== E ===
* [[EgyPack]]
* [[Eleonore]]
=== F ===
* [[Fiesta]]
* [[Flash (Exploit kit)]]
* [[Flimkit]]
* [[Fragus]]

=== G ===
* [[Glazunov]]
* [[Gong Da]] / [[Gongdad]]
* [[GrandSoft]]

=== H ===
* [[Hanjuan]]
* [[Hierarchy]]

=== I ===
* [[Impact]]
* [[Incognito]]
* [[Infinity (Exploit kit)]]

=== K ===
* [[KaiXin]] / [[Gondad]]
* [[Kore]]

=== L ===
* [[LightsOut]]

=== M ===
* [[Magnitude]]
* [[MPack]]
* [[Mushroom]]

=== N ===
* [[NeoSploit]]
* [[Neutrino]]
* [[Nice]]
* [[Niteris]]
* [[Nuclear Pack]]
* [[Null Hole]]

=== P ===
* [[Phoenix]]
* [[Private EK]]
* [[ProPack]]

=== R ===
* [[Red Dot]]
* [[RedKit]] / [[Goon]], [[Puerto]]
* [[RIG]]

=== S ===
* [[Sakura]]
* [[Sava]]
* [[Serenity]] / [[Serenity Pack]]
* [[Siberia]] / [[Siberia Private]]
* [[Sibhost]] / [[Kore]], [[Urausy EK]], [[BestAV EK]]
* [[SofosFO]]
* [[Spartan]]
* [[SPL Pack]]
* [[Styx]] / [[Kein]]
* [[Sundown]]
* [[Sweet Orange]]

=== T ===
* [[T-Pack]]
* [[Techno XPack]]

=== V ===
* [[Vintage Pack]]
=== X ===
* [[x2o]] / [[Redkit light]]

=== Y ===
* [[Yang Pack]]
=== Z ===
* [[Zhi Zhu]]
{{Div col end}}

== Malware and botnet related Services ==
=== C ===
* [[Check4Me]]
=== I ===
* [[Iframeshop]]
=== P ===
* [[Prepaidex]]
=== S ===
* [[Scan4you]]
* [[SollHost]]

.enc

2020-03-03T20:36:48Z

Eric.freyssinet: Created page with "{{Feature}}"

.CryptoHasYou.

2020-03-03T20:36:25Z

Eric.freyssinet:

{{Botnet
|Feature=.enc,YOUR_FILES_ARE_LOCKED.txt,AES (256) encryption
|Group=Cryptolocker
}}

.CryptoHasYou.

2020-03-03T20:30:28Z

Eric.freyssinet: Created page with "{{Botnet| }}"

Dharma Ransomware Uses AV Tool to Distract from Malicious Activities

2019-05-12T14:13:51Z

Eric.freyssinet:

{{Publication
|Botnet=Dharma,
|Group=Ransomware,
|Year=2019
|Date=2019-05-08
|Editor=TrendLabs Security Intelligence Blog
|Link=https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/
|Author=Raphael Centeno,
|Type=Blogpost
|Abstract=The Dharma ransomware has been around since 2016, but it has continued to target and successfully victimize users and organizations around the world. One high profile attack happened in November 2018 when the ransomware infected a hospital in Texas, encrypting many of their stored records; luckily the hospital was able to recover from the attack without paying the ransom. Trend Micro recently found new samples of Dharma ransomware using a new technique: using software installation as a distraction to help hide malicious activities.
}}

Dharma Ransomware Uses AV Tool to Distract from Malicious Activities

2019-05-12T14:13:19Z

Eric.freyssinet:

{{Publication
|Botnet=Dharma,
|Group=Ransomware,
|Year=2019
|Date=2019-08-01
|Editor=TrendLabs Security Intelligence Blog
|Link=https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/
|Author=Raphael Centeno,
|Type=Blogpost
|Abstract=The Dharma ransomware has been around since 2016, but it has continued to target and successfully victimize users and organizations around the world. One high profile attack happened in November 2018 when the ransomware infected a hospital in Texas, encrypting many of their stored records; luckily the hospital was able to recover from the attack without paying the ransom. Trend Micro recently found new samples of Dharma ransomware using a new technique: using software installation as a distraction to help hide malicious activities.
}}

Dharma Ransomware Uses AV Tool to Distract from Malicious Activities

2019-05-12T14:11:37Z

Eric.freyssinet: Created page with "{{Publication| Link=https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/}}"

{{Publication| Link=https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/}}

Dharma

2019-05-12T14:10:44Z

Eric.freyssinet:

Dharma

2019-05-12T14:10:21Z

Eric.freyssinet: Created page with "{{Botnet| }}"