Unmasking the new XorDDoS controller and infrastructure

Cisco Talos details active XorDDoS Linux DDoS malware activity (Nov 2023–Feb 2025), describing a new “VIP” trojan builder, a central controller and controller binder that enable large-scale coordinated attacks; it documents SSH brute-force infection, persistence mechanisms, phone-home/C2 protocols, wide victimology (notably heavy targeting of the United States), and provides IOCs and mitigation recommendations.