Botnet & DDoS

Cybernews found an exposed server revealing a two-year operation that brute-forced weak credentials on end-of-life PPTP/L2TP VPN devices to build an 87,000-IP residential proxy network, resold to platforms including VPN Pure, using a jailbroken Claude Code to automate the hunt.

The FBI and RCMP seized NightmareStresser's domains this week, ending a booter service that claimed "8 years, never went down." A DOJ record from December 2022 says otherwise — a domain under the same name was seized once already.

On 31 August 2026 investigators cut a 23-year-old peer-to-peer botnet off from its operator by poisoning the peer lists of its own bots. The protocol they exploited had been documented publicly since 2011 and could never be patched.

LockBit, BlackSuit and Play didn't run their own servers. They rented them from a company in St Petersburg that answered no abuse reports and no takedown requests, and billed like any other host.