RapperBotMalware
A Mirai derivate bruteforcing SSH servers.From MISP Galaxy
Last reported 7 months ago, by JPCERT/CC Eyes1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1213.005Messaging Applications
“Primary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.”
- T1218.002Control Panel
“…itecture, C2 protocol specifications, server rotation practices, and operational aspects of the user interface suggested that the C2 control panel may have been operated through macro-based automation or via a console interface.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JSAC2026 -Day 2-“Hideyuki Furukawa provided an in-depth analysis of the IoT-focused DDoS botnet “RapperBot,” presenting findings on its C2 operations and DDoS attack activities, which had not previously been reported in detail.”
Thanks — we review every report.