New Telegram-Based DDoS Framework NULLZEREPTOOL Uncovered Researchers at Flare have identified NULLZEREPTOOL, a sophisticated attack framework that repurposes a Telegram bot as a remote control panel for distributed denial-of-service (DDoS) campaigns, leveraging rotating proxy infrastructure to evade detection. The framework was first discovered after a Pastebin post was flagged during routine monitoring, exposing the full Python source code of a Telegram-managed DDoS bot. While initially appearing as a basic script, further analysis revealed a multi-layered design combining a proven DDoS engine with experimental modules for WiFi disruption, Bluetooth jamming, and credential theft. ### Key Features & Capabilities - Telegram-Controlled DDoS Panel: Unlike traditional self-spreading botnets, NULLZEREPTOOL operates as a command-and-control (C2) hub via Telegram, allowing attackers to launch floods, adjust worker threads, and monitor attack statistics in real time. - 20+ Attack Methods: The framework supports HTTP GET floods, UDP packets, TCP handshakes, and a "combo" attack bundling multiple request types to maximize impact. - Proxy Rotation: To sustain attacks, NULLZEREPTOOL harvests free HTTP proxies from seven sources (e.g., api.proxyscrape.com, proxylist.geonode.com), validating and rotating them to bypass IP-based rate limits. - Experimental Modules: Later variants include WiFi deauthentication, Bluetooth jamming, and hierarchical botnet tasking, though these features remain unproven in real-world attacks due to missing client components. - Credential & Data Handling: The framework includes CVV logging, password extraction, and a "BOTNET_HIERARCHY" structure for potential future botnet expansion, though current implementations are server-side only. ### Attack Workflow & Testing - Test Targets: Operators conducted live tests against sites like shopmuabancf[.]com, Bloomberg[.]com/quote/FRGH:SW, and daula[.]shop, tracking worker counts and request volumes. - Proxy & Amplification Tactics: The framework abuses public DNS resolvers (8.8.8.8, 1.1.1.1) and NTP servers (time.google.com, pool.ntp.org) for amplification attacks. - "Quantum" Branding Misleading: Despite claims of "advanced" WiFi/Bluetooth exploits, the code relies on standard cryptographic functions (e.g., hashlib.sha3_512), suggesting marketing hype rather than genuine innovation. ### Defensive Insights Flare’s analysis highlights how lightweight, chat-driven orchestration (e.g., Telegram bots) can be weaponized for agile DDoS attacks. Organizations should monitor for: - Mixed HTTP methods with random headers - High-volume UDP/TCP bursts on ports 80/443 - DNS/NTP amplification traffic targeting public resolvers The discovery underscores the need for continuous monitoring of paste sites, dark web forums, and Telegram channels to detect emerging threats before they mature into full-fledged attack platforms. Hardcoded bot tokens, admin IDs, and C2 endpoints have been identified and can be used for detection and blocking. ### Indicators of Compromise (IoCs) - Target Domains: shopmuabancf[.]com, shopbloxfruits[.]com, Bloomberg[.]com/quote/FRGH:SW - Proxy Sources: api.proxyscrape[.]com, proxylist.geonode[.]com, free-proxy-list[.]net - Amplification Targets: 8.8.8.8, 1.1.1.1, time.google.com, pool.ntp.org - Telegram Credentials: Hardcoded BOT_TOKEN, ADMIN_ID (7593738229), ADMIN_PASSWORD ("7788") - Source Code Links: Pastebin.com/ryxQ077S (later variant), Pastebin.com/Rxk4VgnX (earlier variant)