While monitoring Dark Web forums, SEKOIA.IO analysts discovered a new Golang botnet, advertised since April 2022 by its alleged developer as Aurora Botnet. Sold as a Malware-as-a-Service (MaaS), this multi-purpose botnet enables an attacker to steal sensitive data (passwords, cryptocurrency wallets, files), send commands to bots, download and execute additional payloads,and open HTTP proxies.
We published a FLINT (Flash Intelligence Report) in which you can find exclusive details of the threat actor advertising Aurora, on our malware analysis and the botnet's involvement in ongoing dispute between illicit marketplaces struggling for the leadership. We also share some artefacts about the detection of Aurora within SEKOIA.IO XDR.
Detection of Aurora malware on SEKOIA.IO XDR:
Related Resources:
