The August 31 operation cut the operator off from over 15,000 bots without cleaning a single disk. The Sality hosts on your network will stop calling home and keep infecting every executable they can write to.
Perspective Coverage
8 publishers
- Builder
- Builder 36%
- Operator
- Operator 42%
- Investor
- Investor 22%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+25
- Incentives68
- Confidence75
QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
US agencies assess Volt Typhoon's infrastructure access as pre-positioning for disruption
The advisory puts Volt Typhoon inside communications, energy, transport and water IT environments across the US and Guam, and says the behaviour does not look like espionage. The planning problem is outage, not data loss.
Reality
- Evidence70
- Adoption58
- Hype gap+12
- Incentives55
- Confidence62
Volt Typhoon-linked JDY botnet climbed back to 1,500 devices after the KV takedown
Black Lotus Labs counted about 650 JDY bots at the January 2024 low and more than 1,500 now, all of them fingerprinting exposed services soon after CVEs go public, with US military entities the most prominent target.
Publishers:lumen.com
Reality
- Evidence55
- Adoption50
- Hype gap+25
- Incentives70
- Confidence50
CrowdStrike talked a 23-year-old botnet into disconnecting itself
The company found weaknesses in Sality's peer-to-peer design and fed it false information until infected machines dropped their controller. The FBI and Justice Department handled the domain seizures.
Reality
- Evidence36
- Adoption30
- Hype gap+24
- Incentives74
- Confidence45