Tracking DDoS – Botnets

·

Tracking DDoS - Botnets

Meris // Mikrotik-based Botnets

  • size: 10.000 – 200.00

The Meris botnet first emerged in mid-2021 as a highly potent Distributed Denial of Service (DDoS) threat. It is considered a successor to the infamous Mirai botnet, which gained notoriety for hijacking Internet of Things (IoT) devices to launch large-scale DDoS attacks. Meris, however, is more sophisticated and capable of launching record-breaking attacks with extreme bandwidth by exploiting compromised devices, primarily MikroTik routers.

Meris can generate massive volumes of HTTP requests, overwhelming targets with floods of traffic. In contrast to Mirai, which mainly utilized IoT devices, Meris targets higher-powered network equipment, allowing it to unleash more devastating attacks. Over the last years, Meris was accounted for several record-breaking attacks against providers like cloudflare or OVH.

DDoSia by Noname57

  • size: 5000 – 9000

DDoSia is a malware toolkit developed by NoName, a pro-Russian hacking group.
The toolkit has gained notoriety for its involvement in hacktivist campaigns, particularly during the conflict between Russia and Ukraine, where it has been used to target websites and infrastructure in nations aligned with Ukraine or supporting sanctions against Russia.

DDoSia is capable of sophisticated Layer-7-Attacks (pseudo-browsers) and direct path tcp-floods, see also our article „Comparison of DDoS-Frameworks“.

Noname057/DDoSia are active since mid-2022 and had been analyzed a couple of times:

Gorilla Botnet

The Gorilla DDoS botnet is a relatively recent botnet that was observed engaging in distributed denial-of-service (DDoS) attacks from late 2023. It is a part of a growing trend of IoT-based botnets, similar in nature to botnets like Mirai, but with advanced capabilities to overwhelm targets through high-volume and multi-vector DDoS attacks.

It has been observed in campaigns by most likely russian hacktivists groups against government and finanzial services in US, IE, CH and FR.

Mirai

  • size: 20.000 – 200.000

The Mirai botnet is one of the most infamous botnets in the history of cybersecurity, known for its large-scale exploitation of Internet of Things (IoT) devices to launch Distributed Denial of Service (DDoS) attacks. First discovered in 2016, Mirai quickly became notorious for its ability to compromise poorly secured IoT devices—such as routers, cameras, and DVRs—by using a list of hard-coded default credentials. What makes Mirai unique is the release of the sourcecode in late 2016, which lead to a widespread adoption by various actors.

While its been around since 8 years, there is not „THE Mirai“ – botnet anymore, but many variants. All have in common the exploitation of IoT – devices.

Misc Reportings

previous art / 2014 – 2021

Since 2007, zeroBS employees have been involved in the investigation, analysis, and monitoring of server-based attacker botnets, specifically in the area of DDoS.

This page provides a list of our R&D activities, talks, and papers that have been published on this topic.

Latest posts
Avydos

Ensure the accessibility of your critical business resources and get in touch!

Linkedin Twitter
Adresse

Am Jägersberg 8 
24161 Altenholz – Germany

Avydos
Quick Links
Copyright © 2025 Avydos – All rights reserved.
en_GBEnglish
de_DEGerman en_GBEnglish