Pulse Detail — Threat Intelligence

● 0 online

ANALYZING THREAT INTELLIGENCE

PULSE NAME

xlabs_v1 DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

WHITE CyberHunter_NL 2026-05-05 Modified: 2026-05-05

20

IOCs

MEDIUM VOLUME

↓ CSV ↓ JSON

figure tcp80 c2 domain offshore lc tadashi defense evasion tcp5555 chacha20 as214472 netherlands april exploit mirai android persistence demo botnet bridge accept phishing telegram beyond close stop

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1008 T1027 T1036 T1057 T1059 T1070 T1071 T1082 T1090 T1105 T1106 T1119 T1190 T1205 T1210 T1222 T1489 T1498 T1499 T1562 T1564 T1568 T1571 T1595

Indicators of Compromise (5 / 20 total)

All IPv4 CIDR FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain

TYPE	INDICATOR	DESCRIPTION	CREATED
IPv4	176.65.139.44	CC=DE ASN=ASNone	2026-05-05
IPv4	176.65.139.42	CC=DE ASN=ASNone	2026-05-05
IPv4	176.65.139.9	CC=DE ASN=ASNone	2026-05-05
IPv4	172.94.96.75	CC=US ASN=ASNone	2026-05-05
IPv4	176.65.139.134	CC=DE ASN=ASNone	2026-05-05

References (1)

↗ https://hunt.io/blog/xlabs-v1-ddos-for-hire-operation-exposed