aol.pm

Botnets and intelligence disclosures

18 source-attributed historical records, 43 typed relationships and six conceptual architecture explanations. Historical findings, leak reporting and official declassification remain distinct; no raw leaks or operational toolkits hosted.

Published 16 October 2026 · JSON · TXT

The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets

Early IRC-centered botnet research argues for correlating host and network evidence. Centralized coordination, transport and malicious purpose are separate properties.

Metadata, sources and evidence limits
id
botnets-zombie-roundup-2005
type
research_paper
dates
publication month
2005-07
publisher
USENIX, SRUTI 05
people
  • Evan Cooke
  • Farnam Jahanian
  • Danny McPherson
sources
caveat
The landing page omits Danny McPherson; the hosted paper names him. Observations describe the study period, not current prevalence.
relations
    • documents_architecture
    • centralized IRC C2
    • documents_defense
    • multi-source behavioral correlation
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Peer-to-Peer Botnets: Overview and Case Study

The Trojan.Peacomm case study examines peer-to-peer coordination. P2P describes a topology; it does not establish an operator identity or the absence of every central dependency.

Metadata, sources and evidence limits
id
botnets-p2p-peacomm-2007
type
research_paper
dates
publication month
2007-04
publisher
USENIX, HotBots 07
people
  • Julian B. Grizzard
  • Vikram Sharma
  • Chris Nunnery
  • Brent ByungHoon Kang
  • David Dagon
sources
relations
    • analyzes
    • Trojan.Peacomm
    • documents_architecture
    • peer-to-peer C2
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection

BotMiner correlated similar communications with malicious activity in IRC, HTTP and P2P traces, including Nugache and Storm. Its measured results are historical research findings, not a guarantee of universal detection.

Metadata, sources and evidence limits
id
botnets-botminer-2008
type
research_paper
dates
landing page date
2008-07-31
publication year
2008
publisher
USENIX Security
people
  • Guofei Gu
  • Roberto Perdisci
  • Junjie Zhang
  • Wenke Lee
sources
relations
    • evaluated_against
    • Nugache
    • evaluated_against
    • Storm
    • documents_defense
    • cross-cluster traffic correlation
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Conficker: logic and rendezvous points

Early SRI analysis describes a self-updating worm and rendezvous mechanisms. Variant dates matter: later capabilities should not be assigned to the original worm by assumption.

Metadata, sources and evidence limits
id
botnets-conficker-2009
type
research_report
dates
observations
2008-11/2008-12
report release
2009-02-04
report updated
2009-03-19
publisher
SRI International
people
  • Phillip Porras
  • Hassen Saidi
  • Vinod Yegneswaran
sources
caveat
Descriptive history only; no reconstructed malware code or protocol implementation is imported.
relations
    • analyzes
    • Conficker
    • source_documents_technique
    • T1568.002
    • MITRE ATT&CK Conficker procedure example; variant scope retained
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

GameOver Zeus disruption

International court-authorized measures disrupted GameOver Zeus and associated Cryptolocker activity. DOJ’s July update reported all or nearly all active infected computers communicating with a substitute server.

Metadata, sources and evidence limits
id
botnets-gameover-zeus-2014
type
disruption_event
dates
operation began
2014-05
announcement
2014-06-02
court status update
2014-07-11
publisher
FBI; U.S. Department of Justice
sources
caveat
A dated institutional assessment of disruption is not permanent eradication.
relations
    • disrupted
    • GameOver Zeus
    • involved_agency
    • FBI
    • associated_with
    • Cryptolocker
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Understanding the Mirai Botnet

A seven-month retrospective examines Mirai’s growth, IoT device ecosystem, DDoS victims and competing variants. The researchers estimated a peak of 600,000 infections within their measurement scope.

Metadata, sources and evidence limits
id
botnets-mirai-2016-2017
type
research_paper
dates
major activity
2016
publication month
2017-08
publisher
USENIX Security 17
people
  • Manos Antonakakis
  • Tim April
  • Michael Bailey
  • Matt Bernhard
  • Elie Bursztein
  • Jaime Cochran
  • Zakir Durumeric
  • J. Alex Halderman
  • Luca Invernizzi
  • Michalis Kallitsis
  • Deepak Kumar
  • Chaz Lever
  • Zane Ma
  • Joshua Mason
  • Damian Menscher
  • Chad Seaman
  • Nick Sullivan
  • Kurt Thomas
  • Yi Zhou
sources
caveat
Research landing page only; no malware source mirrors.
relations
    • analyzes
    • Mirai
    • documents_impact
    • DDoS
    • documents_target_class
    • embedded and IoT devices
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Qakbot multinational disruption

DOJ announced an infrastructure disruption and removal of Qakbot code from infected devices. It reported more than 700,000 victim computers and about $8.6 million in seized cryptocurrency.

Metadata, sources and evidence limits
id
botnets-qakbot-2023
type
disruption_event
dates
announcement
2023-08-29
publisher
U.S. Department of Justice
sources
caveat
These are the announcement’s dated figures; disruption does not prove the family cannot reappear.
relations
    • disrupted
    • Qakbot
    • facilitated
    • ransomware deployment
    • DOJ describes Qakbot malware capability, not the disruption event
    • Qakbot
    • involved_agency
    • FBI
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Domain generation algorithms

A DGA derives candidate rendezvous names. It is a discovery mechanism, not a network topology. Defensive interpretation combines DNS and endpoint evidence; unusual names alone are insufficient.

Metadata, sources and evidence limits
id
c2-dga
type
technique_reference
dates
catalog created
2020-03-10
publisher
MITRE ATT&CK
sources
relations
    • maps_to_attack
    • T1568.002
    • contrasts_with
    • T1568.001
    • documented_example
    • Conficker
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Fast flux and defensive DNS analysis

Fast flux changes address mappings behind names; a DGA changes candidate names. They can coexist. Legitimate distributed services also change infrastructure, so DNS observations require context.

Metadata, sources and evidence limits
id
c2-fast-flux
type
technique_reference
dates
advisory month
2025-04
publisher
NSA and partner agencies; MITRE ATT&CK
sources
relations
    • maps_to_attack
    • T1568.001
    • contrasts_with
    • T1568.002
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Dead-drop resolvers

Content on an external service can point a compromised host toward other C2 infrastructure. Resolving an address is distinct from carrying commands through that service. ATT&CK supplies BLACKCOFFEE and APT41 examples.

Metadata, sources and evidence limits
id
c2-dead-drop-resolver
type
technique_reference
dates
catalog created
2020-03-14
publisher
MITRE ATT&CK
sources
relations
    • maps_to_attack
    • T1102.001
    • documented_example
    • BLACKCOFFEE
    • MITRE ATT&CK source example, not a new actor attribution
    • documented_example
    • APT41
    • MITRE ATT&CK source example, not a personal identity claim
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Web C2 transport and encrypted channels

HTTP/S describes transport; centralized and P2P describe coordination topology. ATT&CK T1573 concerns encryption beyond inherent protocol protection: HTTPS alone should not automatically receive that mapping.

Metadata, sources and evidence limits
id
c2-web-encryption
type
technique_reference
dates
web catalog created
2020-03-15
encryption catalog created
2020-03-16
publisher
MITRE ATT&CK
sources
relations
    • maps_to_attack
    • T1071.001
    • distinguishes_from
    • T1573
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Snowden-era Verizon order reporting

Reporting on a Verizon court order, with initial and displayed publication dates retained separately.

Metadata, sources and evidence limits
id
intel-snowden-verizon-2013
type
disclosure_reporting
dates
initial reporting date
2013-06-05
current article display date
2013-06-06
publisher
The Guardian
people
  • Glenn Greenwald
provenance class
leak-based reporting; not official declassification
sources
caveat
The Pulitzer-submitted original supports the initial date; the current page displays the following date. No blanket authentication of other reported documents.
relations
    • reported_by
    • Glenn Greenwald
    • contextualized_by
    • intel-pclob-2014
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

PCLOB Section 215 telephone-records report

Official oversight analysis of bulk telephone records and the Foreign Intelligence Surveillance Court, with twelve recommendations. Board findings, dissenting views and court rulings remain distinct.

Metadata, sources and evidence limits
id
intel-pclob-2014
type
official_oversight_report
dates
report filed
2014-01-23
publisher
Privacy and Civil Liberties Oversight Board
provenance class
official public oversight report
sources
relations
    • reviews_program
    • Section 215 bulk telephone records
    • contextualizes
    • intel-snowden-verizon-2013
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Vault 7 and the Schulte proceedings

The prosecution establishes a CIA theft and transmission-to-WikiLeaks context. The 2024 sentence followed several trials and covered multiple categories of crimes; it was not solely punishment for disclosure.

Metadata, sources and evidence limits
id
intel-vault7-court-context
type
disclosure_legal_context
dates
theft date
2016-04-20
first public disclosure
2017-03-07
espionage trial verdict
2022-07-13
sentencing
2024-02-01
publisher
U.S. Attorney’s Office SDNY; U.S. District Court SDNY
people
  • Joshua Adam Schulte
provenance class
court-established disclosure context, as documented by DOJ and court records
sources
caveat
The 2024 order noted an appeal. Current appellate disposition was not checked. This does not authenticate every mirrored file or operational claim; no toolkit archive is included.
relations
    • disclosure_publisher
    • WikiLeaks
    • Vault 7 disclosure publisher, not publisher of court proceedings
    • origin_institution
    • CIA
    • DOJ account of proved trial facts
    • legal_case_subject
    • Joshua Adam Schulte
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Shadow Brokers: provenance claims and defensive aftermath

Kaspersky reported high-confidence code relationships with previously studied Equation Group malware, without identifying the leaker or acquisition route. Microsoft later identified patches, including MS17-010, for listed affected vulnerabilities.

Metadata, sources and evidence limits
id
intel-shadow-brokers-2016-2017
type
disclosure_research_context
dates
initial disclosure
2016-08-13
kaspersky analysis
2016-08-16
ms17 010 release
2017-03-14
microsoft triage publication
2017-04-15
publisher
Kaspersky GReAT; Microsoft Security Response Center
provenance class
researcher-assessed leak relationship
sources
caveat
Code relationship, alleged agency attribution, leaker identity and document authenticity are different questions. Use April 2017 for the later release until April 14/15 timestamp conventions are reconciled.
relations
    • assessed_related_to
    • Equation Group
    • Assessor: Kaspersky GReAT; high confidence applies to analyzed code relationship only
    • mitigated_by
    • MS17-010
    • Assessor: Microsoft; scope: listed SMB vulnerabilities, not the leak or event
    • listed SMB vulnerabilities
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

VENONA translated-message releases

The first of six public releases contained 49 translations about Soviet efforts to obtain U.S. atomic-research information. Historical message, translation, revision and public-release dates are separate fields.

Metadata, sources and evidence limits
id
intel-venona-release
type
declassified_collection
dates
first public release month
1995-07
publisher
National Security Agency
provenance class
official declassification
sources
caveat
Declassified translations are not contemporary plaintext originals; uncertainty and later corrections remain relevant.
relations
    • released_by
    • NSA
    • documents_subject
    • Soviet intelligence and U.S. atomic research
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

William F. Friedman Collection of Official Papers

NSA describes more than 52,000 pages, primarily from 1930–1955. National Archives records an April 20 public release, preceding the April 24 announcement.

Metadata, sources and evidence limits
id
intel-friedman-papers
type
declassified_collection
dates
bulk document dates
1930/1955
public release
2015-04-20
nsa announcement
2015-04-24
publisher
NSA; National Archives; George C. Marshall Foundation
people
  • William F. Friedman
provenance class
official declassification
sources
relations
    • documents_career
    • William F. Friedman
    • released_by
    • NSA
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16

Gulf of Tonkin SIGINT historical releases

The collection contains historical articles, chronologies, oral histories, SIGINT reports, translations and memoranda. Intelligence evidence, later historical interpretation and institutional endorsement remain distinct.

Metadata, sources and evidence limits
id
intel-tonkin-release
type
declassified_collection
dates
events
1964-08
first release
2005-11-30
final release
2006-05-30
publisher
National Security Agency
provenance class
official declassification
sources
caveat
NSA says authors’ opinions need not represent its official views. The collection is not a single categorical claim.
relations
    • documents_event
    • Gulf of Tonkin incidents
    • released_by
    • NSA
checked
2026-10-16
rights
Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.
verification
Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.
source packet
Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16
Collection coverage, provenance and relationships
assertions
architecture cards
    • Coordination topology
    • Centralized systems have a logical coordination point; peer-to-peer systems coordinate through peers. Hybrid systems can combine dependencies. Topology alone does not identify an operator.
      • botnets-zombie-roundup-2005
      • botnets-p2p-peacomm-2007
    • Transport
    • IRC and HTTP/S are application transports. Either label answers a different question from centralized or peer-to-peer coordination.
      • botnets-zombie-roundup-2005
      • botnets-botminer-2008
      • c2-web-encryption
    • Rendezvous
    • A fixed address, generated candidate name or external resolver describes how infrastructure is found. Finding an address is distinct from carrying commands.
      • c2-dga
      • c2-dead-drop-resolver
    • Infrastructure churn
    • Fast flux changes address mappings; DGA changes candidate names. These mechanisms can coexist, and legitimate distributed services also require context.
      • c2-fast-flux
      • c2-dga
    • Encryption
    • Protocol-provided TLS and additional encryption are distinct properties. Do not automatically map every HTTPS connection to ATT&CK T1573.
      • c2-web-encryption
    • Detection and response
    • Correlate endpoint and network observations, interpret DNS changes in context and retain the study’s measurement scope. A single indicator or a successful disruption is not a permanent verdict.
      • botnets-botminer-2008
      • botnets-gameover-zeus-2014
      • botnets-qakbot-2023
coverage
records
18
botnet and architecture records
11
intelligence records
7
fulltexts
0
raw leaks
0
complete denominator
Unknown / not established
rights
Metadata and original summaries only. No full source-text reuse claimed.

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.