Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale

Cybersecurity researchers identified a China-linked actor called SecShow conducting large-scale DNS probing via CERNET nameservers since mid-2023—using randomized DNS responses and measurement techniques that can be abused for amplification and triggered amplification loops with security products—and reported a separate financially motivated Mirai-based DDoS-for-hire botnet named Rebirth targeting game servers and advertised via Telegram/online storefronts.