DDoS Malware Targets Jenkins to Hit Valve Game Servers

Darktrace observed a campaign leveraging misconfigured Jenkins scriptText RCE to deploy a cross-platform DDoS botnet (payload and C2 tied to 103.177.110.202) that performs volumetric UDP/TCP floods and application-layer attacks — including Valve Source Engine query amplification — against online game servers; the malware persists, daemonizes, reports system architecture to C2, and supports command-driven attacks and self-updates. Operators should lock down CI servers, remove weak credentials, and apply DDoS protections on game ports (e.g., 27015).