The Curious Engineer

All blogs / Security

360 Netlab Blog

blog.netlab.360.com

Network Security Research Lab at 360

SecurityNetworking

’16’17’18’19’20’21’22’23’24’25’26
Posts
278 from 2 Sep 2016 to 30 Oct 2026
Posting
weekly (25 in the last year)
Kind
company blog
Language
Chinese
Feed
https://blog.netlab.360.com/rss/

2026 25

  1. 金融行业网络安全监测月报(202610)
  2. AI安全专题周报（20261030）
  3. AI安全专题周报（20261023）
  4. AI安全专题周报（20261016）
  5. 银狐云端“生死簿”续篇：从持续生产到 Referer 时间窗变种
  6. AI安全专题周报（20260930）
  7. 金融行业网络安全监测月报(202609)
  8. AI安全专题周报（20260925）
  9. AI安全专题周报（20260918）
  10. 银狐云端“生死簿”：从“无条件返回”到“黑名单”机制
  11. AI安全专题周报（20260911）
  12. 金融行业网络安全监测月报(202608)
  13. AI安全专题周报(20260904)
  14. AI安全专题周报(20260828)
  15. AI安全专题周报(20260821)
  16. AI安全专题周报(20260814)
  17. 金融行业网络安全监测月报(202607)
  18. 金融行业网络安全监测月报(202606)
  19. 金融行业网络安全监测月报(202605)
  20. 金融行业网络安全监测月报(202604)
  21. 金融行业网络安全监测月报(202603)
  22. 金融行业网络安全监测月报(202602)
  23. 金融行业网络安全监测月报(202601)
  24. 金融行业网络安全监测月报(202512)
  25. 金融行业网络安全监测月报(202511)

2020 21

  1. 千面人:Bigviktor 分析报告
  2. An Update for a Very Active DDos Botnet: Moobot
  3. 那些年我们一起追过的僵尸网络之Moobot
  4. The Gafgyt variant vbot seen in its 31 campaigns
  5. Look at NTP pool using DNS data
  6. 从DNS角度看NTP pool服务器的使用
  7. New activity of DoubleGuns Group, control hundreds of thousands of bots via public cloud service
  8. 双枪团伙新动向，借云服务管理数十万僵尸网络
  9. DDG的新征程——自研P2P协议构建混合P2P网络
  10. The LeetHozer botnet
  11. LeetHozer Botnet分析报告
  12. 多款光纤路由器设备在野0-day漏洞简报
  13. Multiple fiber routers are being compromised by botnets using 0-day
  14. DDG botnet, round X, is there an ending?
  15. Two zero days are Targeting DrayTek Broadband CPE Devices
  16. DrayTek Vigor企业级路由器和交换机设备在野0-day 漏洞分析报告
  17. 一些网站https证书出现问题的情况分析
  18. Icnanker, a Linux Trojan-Downloader Protected by SHC
  19. Icnanker, 一个使用了SHC技术的木马下载器
  20. LILIN DVR 在野0-day 漏洞分析报告
  21. Multiple botnets are spreading using LILIN DVR 0-day

2019 26

  1. Mozi, Another Botnet Using DHT
  2. P2P Botnet： Ｍozi分析报告
  3. Dacls, the Dual platform RAT
  4. Lazarus Group使用Dacls RAT攻击Linux平台
  5. The awaiting Roboto Botnet
  6. 潜伏者：Roboto Botnet 分析报告
  7. The Botnet Cluster on the 185.244.25.0/24
  8. 那些和185.244.25.0/24网段有关的Botnet
  9. Emptiness: A New Evolving Botnet
  10. 那些总是想要和别人强行发生关系的僵尸网络之Emptiness
  11. Some Fiberhome routers are being utilized as SSH tunneling proxy nodes
  12. 一些Fiberhome路由器正在被利用为SSH隧道代理节点
  13. Godlua Backdoor分析报告
  14. An Analysis of Godlua Backdoor
  15. Linux.Ngioweb分析报告
  16. An Analysis of Linux.Ngioweb Botnet
  17. Ongoing Credit Card Data Leak [Continues]
  18. 信用卡数据泄漏持续进行中 [快速更新]
  19. 信用卡数据泄漏持续进行中
  20. Ongoing Credit Card Data Leak
  21. SystemdMiner,when a botnet borrows another botnet’s infrastructure
  22. systemdMiner 借鸡下蛋，通过 DDG 传播自身
  23. The new developments Of the FBot
  24. FBot 新进展
  25. Smoke Loader: The Admin Panel, the 3rd Party Patch, and few other things
  26. Smoke Loader:主体、控制台、插件，以及盗版之殇

2018 60

  1. “双枪”木马的基础设施更新及相应传播方式的分析
  2. BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers
  3. BCMUPnP_Hunter：疑似10万节点级别的僵尸网络正在滥用家用路由器发送垃圾邮件
  4. GhostDNS正在针对巴西地区70种、100,000+家用路由器做恶意DNS劫持
  5. 70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS
  6. Fbot, A Satori Related Botnet Using Block-chain DNS System
  7. Fbot，一个Satori相关的、基于区块链DNS的蠕虫
  8. A New Mining Botnet Blends Its C2s into ngrok Service
  9. 利用ngrok传播样本挖矿
  10. 窃听风云: 你的MikroTik路由器正在被监听
  11. 7,500+ MikroTik Routers Are Forwarding Owners’ Traffic to the Attackers, How is Yours?
  12. 威胁快讯：DDG 3013 版本
  13. Threat Alert: DDG 3013 is Out
  14. Malicious Campaign luoxk Is Actively Exploiting CVE-2018-2893
  15. 恶意代码团伙luoxk正在积极利用 CVE-2018-2893 传播
  16. 僵尸永远不死，DDG拒绝凋零
  17. Old Botnets never Die, and DDG REFUSE to Fade Away
  18. HNS Botnet Recent Activities
  19. HNS Botnet 最近活动更新
  20. 威胁快讯：一次僵尸挖矿威胁分析
  21. Botnets never Die, Satori REFUSES to Fade Away
  22. 僵尸永远不死，Satori也拒绝凋零
  23. DDG.Mining.Botnet 近期活动分析
  24. GPON Exploit in the Wild (IV) - TheMoon Botnet Join in with a 0day(?)
  25. GPON Exploit in the Wild (III) - Mettle, Hajime, Mirai, Omni, Imgay
  26. GPON 漏洞的在野利用（三）——Mettle、Hajime、Mirai、Omni、Imgay、TheMoon
  27. GPON Exploit in the Wild (II) - Satori Botnet
  28. GPON 漏洞的在野利用（二）——Satori 僵尸网络
  29. GPON 漏洞的在野利用（一）——muhstik 僵尸网络
  30. GPON Exploit in the Wild (I) - Muhstik Botnet Among Others
  31. Botnet Muhstik is Actively Exploiting Drupal CVE-2018-7600 in a Worm Style
  32. 僵尸网络 Muhstik 正在积极利用 Drupal 漏洞 CVE-2018-7600 蠕虫式传播
  33. RSA大会 '2018，360Netlab的威胁情报服务
  34. 8291端口告警事件简报
  35. Quick summary about the Port 8291 scan
  36. 威胁快讯：一个Redis.Miner
  37. MsraMiner 被曝光后72小时内的更新
  38. MsraMiner: 潜伏已久的挖矿僵尸网络
  39. A Case Study: How One Big Player Could Impact the Cohive Business in China
  40. 是谁悄悄偷走我的电（四）：国内大玩家对Coinhive影响的案例分析
  41. Memcache UDP Reflection Amplification Attack II: The Targets, the Sources and Breakdowns
  42. Memcache UDP 反射放大攻击 II: 最近的数据分析
  43. Memcache DDoS: A Little Bit More
  44. Memcache UDP反射放大攻击技术分析
  45. Who is Stealing My Power III: An Adnetwork Company Case Study
  46. 是谁悄悄偷走我的电（三）：某在线广告网络公司案例分析
  47. 是谁悄悄偷走我的电（二）：那些利用主页挖取比特币的网站
  48. The List of Top Alexa Websites With Web-Mining Code Embedded on Their Homepage
  49. Who is Stealing My Power: Web Mining Domains Measurement via DNSMon
  50. 是谁悄悄偷走我的电（一）：利用DNSMon批量发现被挂挖矿代码的域名
  51. ADB.Miner: More Information
  52. ADB.Miner 安卓蠕虫的更多信息
  53. ADB.Miner：恶意代码正在利用开放了ADB 接口的安卓设备挖矿
  54. Early Warning: ADB.Miner A Mining Botnet Utilizing Android ADB Is Now Rapidly Spreading
  55. DDG.Mining.Botnet：一个瞄准数据库服务器的挖矿僵尸网络
  56. DDG: A Mining Botnet Aiming at Database Servers
  57. TheMoon : 一个僵尸网络的老皇历和新变种
  58. MyKings: 一个大规模多重僵尸网络
  59. 偷盗的艺术: Satori 变种正在通过替换钱包地址盗取 ETH 数字代币
  60. Art of Steal: Satori Variant is Robbing ETH BitCoin by Replacing Wallet Address

2017 24

  1. Openload.co and Other Popular Alex Sites Are Abusing Client Browsers to Mining Cryptocurrency
  2. openload.co 等网站绕过 CoinHive 使用客户端浏览器算力挖取门罗币
  3. 安全威胁预警：Mirai变种Satori正在端口 37215 和 52869 上类似蠕虫式传播
  4. Warning: Satori, a Mirai Branch Is Spreading in Worm Style on Port 37215 and 52869
  5. 安全威胁早期预警：新的mirai僵尸网络变种正在端口23和2323上积极传播
  6. Early Warning: A New Mirai Variant is Spreading Quickly on Port 23 and 2323
  7. CLDAP反射放大攻击超过SSDP和CharGen成为第三大反射型DDoS攻击
  8. CLDAP is Now the No.3 Reflection Amplified DDoS Attack Vector, Surpassing SSDP and CharGen
  9. IoT_reaper: A Few Updates
  10. IoT_reaper 情况更新
  11. IoT_reaper: A Rappid Spreading New IoT Botnet
  12. IoT_reaper : 一个正在快速扩张的新 IoT 僵尸网络
  13. Is Hajime botnet dead?
  14. Is Hajime botnet dead?
  15. 从DNS和sinkhole视角看WannaCry蠕虫
  16. Http 81 Botnet: the Comparison against MIRAI and New Findings
  17. 比较“81端口的botnet”和 MIRAI 之间的联系
  18. New Threat Report: A new IoT Botnet is Spreading over HTTP 81 on a Large Scale
  19. 新威胁报告：一个新IoT僵尸网络正在 HTTP 81上大范围传播
  20. 我们也来聊聊IDN
  21. Netlab‘s ScanMon at RSA Conference 2017
  22. RSA大会 '2017上的ScanMon
  23. Fraudulent Top Sites, an Underground Market Infrastructure
  24. 以大站的名义：专注地下产业的网络基础设施

2016 11

  1. New Mirai DGA Seed 0x91 Brute Forced
  2. Mirai 变种中的DGA
  3. Now Mirai Has DGA Feature Built in
  4. A Few Observations of The New Mirai Variant on Port 7547
  5. 德国电信断网：mirai僵尸网络的新变种和旧主控
  6. 关于 mirai 僵尸网络控制主机的数据分析
  7. 关于 dyn / twitter 受攻击情况的说明和 mirai 僵尸网络的回顾
  8. A quick stats on the 608,083 Mirai IPs that hit our honeypots in the past 2.5 months
  9. DNS中的“无效Rdata”
  10. Conficker域名被滥用情况分析
  11. New Elknot/Billgates Variant with XOR like C2 Configuration Encryption Scheme

Undated 111

  1. Bigviktor dga botnet
  2. In the wild qnap nas attacks
  3. In the wild qnap nas attacks en
  4. Work in hangzhou
  5. Malware specter report
  6. Ghost in action the specter botnet
  7. Ttint an iot rat uses two 0 days to spread
  8. Ttint an iot remote control trojan spread through 2 0 day vulnerabilities
  9. 360netlab launch ioc assessmement service
  10. Heh botnet yi ge chu yu kai fa jie duan de iot p2p botnet
  11. Heh a new iot p2p botnet going after weak telnet services
  12. Linux ngioweb v2 going after iot devices
  13. Linux ngioweb v2 going after iot devices en
  14. Blackrota yi ge gokai fa de gao du hun yao de hou men
  15. Moobot 0day unixcctv dvr
  16. Moobot 0day unixcctv dvr en
  17. Use dns data produce threat intelligence
  18. Security with dns data en
  19. Blackrota a heavily obfuscated backdoor written in go
  20. Another lilin dvr 0 day being used to spread mirai
  21. Use dns data produce threat intelligence 2
  22. Another lilin dvr 0 day being used to spread mirai en
  23. Not really new pyhton ddos bot n3cr0m0rph necromorph
  24. Necro
  25. Matryosh botnet is spreading
  26. Matryosh botnet is spreading en
  27. Use dns data produce threat intelligence 3
  28. Use dns data produce threat intelligence 3 en
  29. Rinfojuan tu zhong lai zheng zai feng kuang sao miao he wa kuang
  30. Rinfo is making a comeback and is scanning and mining in full speed
  31. Fbot is now riding the traffic and transportation smart devices
  32. Fbot is now riding the traffic and transportation smart devices en
  33. Tor bld
  34. In the wild qnap nas attacks 2
  35. Gafgtyt tor and necro are on the move again
  36. Qnap nas users make sure you check your system
  37. New threat zhtrap botnet cn
  38. New threat zhtrap botnet en
  39. Necro shi yong tor dong tai yu ming dga shuang sha windows linux
  40. Threat alert z0miner is spreading quickly by exploiting elasticsearch and jenkins vulnerabilities
  41. Wei xie kuai xun z0miner zheng zai li yong elasticsearch he jenkins lou dong da si chuan bo 2
  42. Microsoft exchange vulnerability cve 2021 26855 scan analysis
  43. Necro upgrades again using tor dynamic domain dga and aiming at both windows linux
  44. Microsoft exchange vulnerability cve 2021 26855 scan analysis 3
  45. Stealth rotajakiro backdoor cn
  46. Wei xie kuai xun z0miner zheng zai li yong elasticsearch he jenkins lou dong da si chuan bo
  47. Stealth rotajakiro backdoor en
  48. Threat alert new update from sysrv hello now infecting victims webpages to push malicious exe to end users
  49. Rotajakiro vs oceanlotus cn
  50. Yi jing you xxxge jia zu de botnetli yong log4shelllou dong chuan bo wei da bu ding de gan jin liao
  51. Ssh stealer facefish cn
  52. Rotajakiro linux version of oceanlotus
  53. Ssh stealer facefish en
  54. Analysis of seized iran domains
  55. Mirai ptea botnet is exploiting undisclosed kguard dvr vulnerability
  56. Mirai ptea botnet is exploiting undisclosed kguard dvr vulnerability en
  57. Wei xie kuai xun teamtntxin huo dong tong guo gan ran wang ye wen jian ti gao chuan bo neng li
  58. The death of mozi cn
  59. The mostly dead mozi and its lingering bots
  60. Rimasuta spread with ruijie 0day
  61. Rimasuta spread with ruijie 0day en
  62. 360dta announced
  63. Pinkbot
  64. Pink en
  65. Abcbot an evolving botnet cn
  66. Abcbot an evolving botnet en
  67. Li yong namesilo parkinghe googlede zi ding yi ye mian lai chuan bo e yi ruan jian
  68. Zhatuniubility malware uses namesilo parking pages and googles custom pages to spread
  69. Specter domain whitelist abuse
  70. The pitfall of threat intelligence whitelisting specter botnet is taking over top legit dns domains by using cloudns service
  71. Public cloud threat intelligence 202110
  72. Warning ewdoor botnet is attacking att customers cn
  73. Warning ewdoor botnet is attacking att customers
  74. Analysis of popular domain names by non authorized resolvers
  75. Public cloud threat intelligence 202111
  76. An assessment of non authorized domain name resolution provided by dns resolution service provider
  77. Wei xie kuai xun log4jlou dong yi jing bei yong lai zu jian botnet zhen dui linuxshe bei
  78. Threat alert log4j vulnerability has been adopted by two linux botnets
  79. Ten families of malicious samples are spreading using the log4j2 vulnerability now
  80. Apache log4j2 vulnerability attack trend from the perspective of honeypot
  81. Use dta to illuminate the path of dns threat analysis 1
  82. Apache log4j2 vulnerability attack trend from the perspective of honeypot en
  83. Use dta to illuminate the path of dns threat analysis 2
  84. Public cloud threat intelligence 202112
  85. Use dta to illuminate the path of dns threat analysis 3
  86. Public cloud threat intelligence 202201
  87. Wo men kan dao de wu ke lan bei ddosgong ji xi jie
  88. Some details of the ddos attacks targeting ukraine and russia in recent days
  89. Public cloud threat intelligence 202202
  90. B1txor20 use of dns tunneling cn
  91. B1txor20 use of dns tunneling en
  92. Shu zi zheng shu zuo wei ji chu she shi de shi yong qing kuang fen xi
  93. What our honeypot sees just one day after the spring4shell advisory
  94. What our honeypot sees just one day after the spring4shell advisory en
  95. Review revoke russia ssl certificates
  96. Men sheng fa da cai fodchajiang shi wang luo
  97. Fodcha a new ddos botnet
  98. Orchard dga
  99. Public cloud threat intelligence 202203
  100. Public cloud threat intelligence 202204
  101. A new botnet orchard generates dga domains with bitcoin transaction information
  102. Purecrypter
  103. Purecrypter is busy pumping out various malicious malware families
  104. Ddosmonster the return of fodcha cn
  105. P2p botnet monitor
  106. Fodcha is coming back with rddos
  107. P2p botnets review status continuous monitoring
  108. Warning hive variant xdr33 is coming cn
  109. New ddos botnet wszeor
  110. Headsup xdr33 variant of ciahive emeerges
  111. 911s5