New MDBotnet Unleashes DDoS Attacks – Cyble

MDBotnet is a .NET-based DDoS bot (sample SlavaRussia.exe) sold on a Russian cybercrime forum as DDoS-as-a-service; analysis shows it connects to C2 at 212.109.199.128:4202, persists via a registry Run key, auto-updates through Updater.exe/svhost.exe, and implements HTTP GET flooding (SYN flood code exists but appears disabled). The report includes multiple file hashes and the C2 IP:Port as IOCs and recommends standard mitigation and monitoring controls.