SecurityScorecard Discovers new botnet, ‘Zhadnost,’ responsible for Ukraine DDoS attacks

SecurityScorecard analyzed three DDoS incidents against Ukrainian government and banking websites in February 2022, identified a 3,000+ IP botnet dubbed “Zhadnost” composed mainly of MikroTik routers with DNS recursion enabled (used for DNS amplification) and some HTTP flooding, assessed limited operational impact but moderate-confidence attribution to Russia or Russian-aligned actors, and provided mitigation guidance and IoC contact information.