Incident
incident:mariposa_botnet
Also: Mariposa
The takedown, investigation, arrests, retaliatory DDoS attack, and subsequent disruption involving the Mariposa botnet.
The takedown, investigation, arrests, retaliatory DDoS attack, and subsequent disruption involving the Mariposa botnet.
“the Mariposa botnet was back online and it was attacking them directly”
“the botnet was sinkholed once again”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Butterfly Bot | Explicit | 94 |
| outgoing | INVOLVES | Command and control | Explicit | 94 |
| outgoing | INVOLVES | sinkholing | Explicit | 94 |
| outgoing | INVOLVES | Mariposa Working Group | Explicit | 94 |
| outgoing | INVOLVES | Panda Security | Explicit | 94 |
| outgoing | INVOLVES | Georgia Tech | Explicit | 94 |
| outgoing | ATTRIBUTED_TO | DDT | Attributed | 94 |
Mariposa botnet INVOLVES Butterfly Bot
The Mariposa botnet incident involved systems infected with the Butterfly Bot malware.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“systems were being infected with something called the Butterfly Bot.”
Mariposa botnet INVOLVES Command and control
The Mariposa botnet relied on infected computers communicating with central command-and-control servers.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“Those servers they were reaching out to are known as command and control servers”
Mariposa botnet INVOLVES sinkholing
The Mariposa Working Group redirected the botnet's command-and-control domains to a sinkhole to observe infected systems and neutralize the botnet.
Explicit Confidence 99% · Chris Davis EP 94 Details
“We went ahead and did that; we pointed it all to our sinkhole”
Mariposa botnet INVOLVES Mariposa Working Group
The Mariposa incident involved a working group formed by Panda, Chris's organization, Georgia Tech, and others.
Explicit Confidence 99% · Chris Davis EP 94 Details
“we kinda put together this working group called the Mariposa Working Group”
Mariposa botnet INVOLVES Panda Security
Panda Security participated in analyzing the Butterfly Bot binaries and responding to the Mariposa botnet.
Explicit Confidence 98% · Chris Davis EP 94 Details
“We leaned on them to help with some language barrier stuff and to help us analyze the binaries.”
Mariposa botnet INVOLVES Georgia Tech
Georgia Tech participated in the Mariposa Working Group.
Explicit Confidence 99% · Chris Davis EP 94 Details
“the Mariposa Working Group which was Panda, ourselves, Georgia Tech, and a few other folks.”
Mariposa botnet ATTRIBUTED_TO DDT
The Spanish police reportedly determined that the Mariposa botnet was run by a cyber-gang called DDT.
Attributed Confidence 94% · Jack Rhysider EP 94 Details
“the Spanish police discovered this botnet was ran by a cyber-gang called the DDT.”