Revealing the Zergeca Botnet: A New Era in DDoS Attacks

Zergeca is a sophisticated Golang-based botnet detected in May 2024 that conducts DDoS (ackFlood, synFlood) and provides secondary capabilities such as proxying, scanning, self-updating, file transfer, reverse shell, and device information theft; its C2 uses domains (ootheca.pw, ootheca.top), shares IPs linked to Mirai, employs evasion techniques including DNS-over-HTTPS and Smux encryption, and has been observed across multiple countries.