Botnet Exposed: Hackers Leave Worker Access and Root Passwords Wide Open

Researchers discovered an unauthenticated Flask-based control panel and full command-and-control stack for a Twitter/X credential‑stuffing botnet, exposing worker IPs, root passwords, and REST endpoints that allow anyone to manage campaigns, upload lists, and exfiltrate results; telemetry showed millions of login attempts (≈4.86M total) with 138 confirmed account takeovers and ~85% of attempts blocked by 2FA. The workers reside in a Turkish-registered /24 block (Komuta Savunma), the UI is Turkish, and uniform root-password patterns indicate an automated provisioning pipeline; recommendations include enabling 2FA and enforcing rate limiting and anomaly detection on authentication endpoints.