InfoSecBulletin Cybersecurity for mankind
On September 1, 2025, Qrator Lab identified and managed a major attack from the largest L7 DDoS botnet seen so far, targeting a government organization. A total of 5.76 million IP addresses were blocked.
Qrator Labs has been tracking a botnet for months. The first attack occurred on March 26, targeting an online betting organization and involving approximately 1.33 million IP addresses, mainly from Brazil, Argentina, Russia, Iraq, and Mexico.
L7 DDoS Botnet Hijacked 5.76M Devices for Large Attacks
Palo Alto Networks User-ID Credential Agent Vuln Exposes password In Cleartext
CyberVolk Ransomware Attacks CII In Japan, France, and UK
Microsoft warns of active directory and office vulnarability
(CVE-2025-10159)
Sophos Addressed Critical Auth Bypass flaw in Wireless Access Points
1.6M fitness phone call recordings exposed online
Microsoft September Patch Tuesday 2025 fixes 81 flaws, two zero-days
Elastic Security Incident : Hackers Accessed Email Account Contains Valid Credentials
Hacker Exploit Amazon SES to Send 50K Phishing Emails
SafePay Ransomware
SafePay Ransomware Attacks 73 Orgs in a Single Month
On May 16, a second incident affected a government organization, with the botnet growing to 4.6 million devices. Most traffic came from Brazil, the U.S., Vietnam, India, and Argentina.
By September, the botnet grew larger. The third attack targeted the government sector with 5.76 million IP addresses involved. It occurred in two phases: the first wave had about 2.8 million IP addresses, followed by an additional 3 million an hour later.
Most malicious traffic originated from Brazil (1.41M), Vietnam (661K), the U.S. (647K), India (408K), and Argentina (162K). Over three months, the biggest increases in botnet participation were seen in Vietnam (+83%) and India (+202%).
“When targeting unprotected or poorly protected resources, a DDoS botnet of this scale can generate tens of millions of requests per second, overwhelming servers within minutes. What’s more, not every DDoS protection provider is capable of withstanding such a massive attack, which means the availability of all their clients’ resources could be at risk simultaneously,” said Andrey Leskin, CTO at Qrator Labs.
CyberVolk Ransomware Attacks CII In Japan, France, and UK – InfoSecBulletin
