Return-Path: Delivered-To: alvarochf@traceseis.com Received: from cs510.bluehost.com by cs510.bluehost.com with LMTP id eALAEPLZxGmoAAoAWiBQxw (envelope-from ) for ; Thu, 26 Mar 2026 01:02:10 -0600 Return-path: Envelope-to: alvarochf@traceseis.com Delivery-date: Thu, 26 Mar 2026 01:02:10 -0600 Received: from mail015.mlsend.com ([185.225.161.15]:53039) by cs510.bluehost.com with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1w5ejJ-00000002omb-3T5Z for alvarochf@traceseis.com; Thu, 26 Mar 2026 01:02:10 -0600 DKIM-Signature: a=rsa-sha256; bh=vHfi7rtwpbrpdSFuKf/2APchfCbpDXjIvlkcVTdXTpw=; c=relaxed/relaxed; d=mail.any.run; h=DKIM-Signature:X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1774508517; v=1; b=PkBTKLRYLCxX+iO+R79o4rLuUTId2h44FrCcEDdzrE/F3/ERuRR1CpntcrNLup0oS71avIZo dzdh6r4uL3byziaxwCSCIgIsaTyU+cmR3dA5WSKybhfv+h6YWf0dQo+aFmc+pcELP1L5DnVX0LX n5fJgpLFTtIxynXxO5WDLB3w= DKIM-Signature: a=rsa-sha256; bh=vHfi7rtwpbrpdSFuKf/2APchfCbpDXjIvlkcVTdXTpw=; c=relaxed/relaxed; d=mlsend.com; h=X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1774508517; v=1; b=jabP0Z7UN69mqqLFcmAiodUlEnxkn6GmRsIhlCQIEbKwd7coV5L9kpqHqhcYU9wb1y4Ob2Us WOyOPe7cjEwnEvFM65vUJkd+zplB9gJp5QSCMIW6BnpVCMZsbA741QOPIGDET+4YvpY3QouDEsN iAS94Tr+RWNMzVPom/PS3CMk= X-Mailer-Info: 10.MWYtBXYpdmb.MWYtBXYpdmbxgjM4kDN2EDOzYTMyAjMyITM.EGb2FmcvNGa mBEdyF2YlNXZpNnLj9Wb.QM4ITOxczN1kTNzkDM4cjMzITY0EzN3YDN.... Subject: Alvaro, New DDoS Botnet Targets Enterprise Networks From: "The ANY.RUN Analyst Team" To: Alvaro Date: 26 Mar 2026 07:01:57 -0000 Received: from 10.36.96.232 by 10.164.0.44 with http; 26 Mar 2026 07:01:57 +0000 Message-ID: <182917759539087232a417764@mlsend.com> x-mailer-recipientid: 182917759539087232a417764 Feedback-ID: campaign182894618348619307:417764:campaign:MailerLite List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Precedence: bulk X-Mailru-Msgtype: 182917759539087232 X-CampaignID: 182894618361202221 Reply-To: "The ANY.RUN Analyst Team" MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="==85cceea0f32c02a67a5a60deafdc836f" This is a multi-part message in MIME format. --==85cceea0f32c02a67a5a60deafdc836f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, You have received a newsletter from ANY. RUN. However, your email software can't display HTML emails. You can view the= newsletter by clicking here: https://letter.mail.any.run/emails/webview/417764/182917759539087232 You're receiving this newsletter because you have shown interest in ANY.= RUN. Not interested anymore? Click here to unsubscribe: https://letter.mail.any.run/unsubscribe/417764/182917759539087232?signat= ure=3Ded746d5942eb053f1323184c5872d2678a3b51d71ce41582a805bc75c06714c1 --==85cceea0f32c02a67a5a60deafdc836f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20 Alvaro, New DDoS Botnet Targets Enterprise Networks =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20 =20 =20
 See how to spot resilient C2 infra= stracture and prevent complex attacks
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20
=20 =20
3D"ANY.RUN"
=20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Ne= w DDoS botnet targeting organizations worldwide

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20
=20 =20
=20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Hi Alvaro!<= /h1>

A lot of DDo= S malware is noisy, blunt, and relatively self-contained. Kamase= rs is different. It is sophisticated and hits hard. But the par= t that may keep you up at night is what happens after the hit.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20

=20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20
=20 =20
=20 =20
=20 =20 =20 =20 =20
=20 =20 =20 =20
=20 =20 =20 =20 =20
=20
Read full analysis
=
=20

See analysis session= =E2=86=92

=20
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Here's a short revie= w

Kamasers is = a DDoS botnet that supports both application-layer and transport-layer a= ttacks and can also act as a loader. One infection can pull down additio= nal payloads between attack waves. That's where ransomware and data thef= t enter the picture.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Re= al business exposure

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Your infrastructure = becomes the attacker

Before you e= ven detect the incident, Kamasers will start launching attacks on third = parties.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Expanded radius

Because Kama= sers functions as a loader, what starts as a DDoS node can quickly escal= ate.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Recovery costs add u= p fast

Investigatio= n, external impact validation, potential IP blacklisting makes the opera= tional and financial risk real.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20

= Pro tip: Uncover Kamasers related infrastructure, = connected sessions, and recurring patterns in TI= Lookup =E2=86=92
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
<= /td>
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20

Try the advance= d sandbox

The behavior= al patterns, C2 discovery method, and loader activity became visibl= e thanks to ANY.RUN's advanced sandbox. For t= he next 14 days, the = same capability is yours.
=20 =20 =20 =20 =20
=20 =20 =20 =20
=20 =20 =20 =20 =20
=20 Get 14-day trial
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
<= /td>
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20
=20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20 =20
=20

Stay safe= and keep hunting,
The ANY.RUN team

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20
=20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20

ANY.R= UN

Dubai Silicon= Oasis, Techno Hub 1,
Unit 21, 60th Street, 342001, UAE

=
=20
3D"linkedin" 3D"x" 3D"youtube" 3D"reddit" 3D"discord"
=20

Privacy & Terms | Send Feedback
For any queries: support@an= y.run

You received this email because 
you signed up for = our newsletter

Unsubscribe =20 =20 =20

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
<= /td>
=20 =20 =20 =20 =20
=20 =20 =20
=20 =20 --==85cceea0f32c02a67a5a60deafdc836f--