InfoSecBulletin Cybersecurity for mankind
On September 1, 2025, Qrator Lab identified and managed a major attack from the largest L7 DDoS botnet seen so far, targeting a government organization. A total of 5.76 million IP addresses were blocked.
Qrator Labs has been tracking a botnet for months. The first attack occurred on March 26, targeting an online betting organization and involving approximately 1.33 million IP addresses, mainly from Brazil, Argentina, Russia, Iraq, and Mexico.
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
On May 16, a second incident affected a government organization, with the botnet growing to 4.6 million devices. Most traffic came from Brazil, the U.S., Vietnam, India, and Argentina.
By September, the botnet grew larger. The third attack targeted the government sector with 5.76 million IP addresses involved. It occurred in two phases: the first wave had about 2.8 million IP addresses, followed by an additional 3 million an hour later.
Most malicious traffic originated from Brazil (1.41M), Vietnam (661K), the U.S. (647K), India (408K), and Argentina (162K). Over three months, the biggest increases in botnet participation were seen in Vietnam (+83%) and India (+202%).
“When targeting unprotected or poorly protected resources, a DDoS botnet of this scale can generate tens of millions of requests per second, overwhelming servers within minutes. What’s more, not every DDoS protection provider is capable of withstanding such a massive attack, which means the availability of all their clients’ resources could be at risk simultaneously,” said Andrey Leskin, CTO at Qrator Labs.
CyberVolk Ransomware Attacks CII In Japan, France, and UK – InfoSecBulletin
