InfoSecBulletin Cybersecurity for mankind
On September 1, 2025, Qrator Lab identified and managed a major attack from the largest L7 DDoS botnet seen so far, targeting a government organization. A total of 5.76 million IP addresses were blocked.
Qrator Labs has been tracking a botnet for months. The first attack occurred on March 26, targeting an online betting organization and involving approximately 1.33 million IP addresses, mainly from Brazil, Argentina, Russia, Iraq, and Mexico.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
On May 16, a second incident affected a government organization, with the botnet growing to 4.6 million devices. Most traffic came from Brazil, the U.S., Vietnam, India, and Argentina.
By September, the botnet grew larger. The third attack targeted the government sector with 5.76 million IP addresses involved. It occurred in two phases: the first wave had about 2.8 million IP addresses, followed by an additional 3 million an hour later.
Most malicious traffic originated from Brazil (1.41M), Vietnam (661K), the U.S. (647K), India (408K), and Argentina (162K). Over three months, the biggest increases in botnet participation were seen in Vietnam (+83%) and India (+202%).
“When targeting unprotected or poorly protected resources, a DDoS botnet of this scale can generate tens of millions of requests per second, overwhelming servers within minutes. What’s more, not every DDoS protection provider is capable of withstanding such a massive attack, which means the availability of all their clients’ resources could be at risk simultaneously,” said Andrey Leskin, CTO at Qrator Labs.
CyberVolk Ransomware Attacks CII In Japan, France, and UK – InfoSecBulletin
