Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day Exploits (CVE-2021-22205, CVE-2021-35394) and Telnet/SSH Brute-Force, Later Adding Ransom DDoS
Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day (TL-2026-0754), also tracked as Fodcha, is a high-severity malware campaign, first published 2026-06-10. It is attributed to Fodcha operator with low confidence, affects GitLab GitLab CE/EE, references 2 CVEs (CVE-2021-22205, CVE-2021-35394), maps to 17 MITRE ATT&CK techniques (T1027, T1046, T1059), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0754
- Threat ID
- TL-2026-0754
- Also known as
- Fodcha, Folded DDoS botnet
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- Fodcha operator
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- healthcare, telecommunications, cloud, technology, gaming, government
- Target regions
- China, North America, Europe, Japan, Australia, Russia, Brazil
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
Malware and tooling: Fodcha, Crazyfia
Fodcha is a rapidly spreading IoT/Linux DDoS botnet discovered by CNCERT and 360 Netlab in early 2022, named for its initial C2 domain (folded.in) and its use of the ChaCha algorithm to encrypt traffic. It propagates through N-day vulnerabilities and Crazyfia-driven Telnet/SSH brute-force, amassed 62,000+ unique bot IPs between March 29 and April 10, 2022, and later evolved into a 60K+ daily-bot, 1Tbps-capable botnet that embeds Monero ransom demands in DDoS packets.
How Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day works
Fodcha is a Mirai-derived, multi-architecture DDoS botnet first sampled on January 12, 2022 and publicly disclosed by 360 Netlab on April 13, 2022. CNCERT and 360 Netlab named it 'Fodcha' from its original command-and-control domain folded.in combined with its use of the ChaCha20 stream cipher to encrypt network traffic. The botnet ships discrete payloads for mips, mpsl (mipsel), arm, and x86 CPU architectures, allowing it to colonize a broad range of routers, DVRs, and Linux servers.
Propagation is two-pronged. First, Fodcha weaponizes a basket of N-day vulnerabilities, including CVE-2021-22205 (GitLab CE/EE unauthenticated RCE via a flawed ExifTool image parse), CVE-2021-35394 (Realtek Jungle SDK 'UDPServer' command-injection / buffer-overflow affecting dozens of OEM SoCs), an Android Debug Bridge (ADB) Debug Server RCE on exposed TCP/5555, and a series of device backdoors / command-injection flaws in MVPower DVR, LILIN DVR, TOTOLINK routers, and ZHONE routers. Second, a standalone brute-force cracking tool named Crazyfia — found co-located on the same downloader servers — scans for and cracks weak Telnet/SSH credentials; the Crazyfia scan results are consumed by the Fodcha operator to push samples onto vulnerable hosts. Successful exploitation pulls architecture-specific binaries from staging servers via wget/curl (ingress tool transfer).
The original (v1) build used folded.in for C2 until March 19, 2022, when the hosting/cloud vendor took down the domain; the operators migrated to fridgexperts.cc (v2), which resolved to more than a dozen IPs spread across the US, Korea, Japan, and India on Amazon, DediPath, DigitalOcean, and Linode infrastructure. Fodcha's C2 protocol uses a multi-step handshake; later builds redesigned communications to use xxtea (with hardcoded key 'PJbiNbbeasddDfsc') to encrypt sensitive configuration/resources and ChaCha20 (32-byte key + 12-byte nonce, single round) for the network channel, deliberately frustrating both file- and traffic-level detection. Bot commands include 0x69 (heartbeat), 0xEB (launch attack), and 0xFB (exit), with roughly 17 attack vectors largely reused from leaked Mirai source.
During March 29–April 10, 2022 Fodcha accumulated over 62,000 unique bot IPs with daily active counts around 10,000, overwhelmingly inside China (China Unicom ~59.9%, China Telecom ~39.4%, China Mobile ~0.5%; top provinces Shandong, Liaoning, Zhejiang) and hitting 100+ DDoS victims per day. Over subsequent releases (v2 OpenNIC TLDs on April 19; v3 xxtea on April 24; v4 structured config on June 5; v4.x dual-ICANN C2 on July 7) the botnet grew to 60,000+ daily bots and 40+ C2 IPs, peaking at over 1Tbps of attack traffic against a cloud provider on September 21, 2022 and 1,396 unique targets in a single day on October 11, 2022. The returning version added a ransom-DDoS (RDDoS) capability: extortion text demanding '10 xmr' to a Monero wallet is embedded directly in the Data portion of DDoS packets — turning a pure availability threat into a financially motivated extortion operation.
MITRE ATT&CK techniques used in TL-2026-0754
Defense Evasion
T1027 Obfuscated Files or Information
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
Persistence
T1133 External Remote Services
Impact
T1498 Network Denial of Service; T1657 Financial Theft
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
Affected products and versions in Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
- GitLab — GitLab CE/EE
Vulnerable versions: <13.8.8; 13.9.x <13.9.6; 13.10.x <13.10.3
Fixed in: 13.8.8; 13.9.6; 13.10.3 - Realtek — Jungle SDK (UDPServer / eCos rtl819x)
Vulnerable versions: 2.x; 3.2; 3.4; 3.4T; 3.4T-CT; 4.x
Fixed in: vendor-patched firmware - Google/Android — Android Debug Bridge (ADB) Debug Server
Vulnerable versions: devices exposing TCP/5555
Fixed in: disable ADB over network - MVPower — DVR (TV-7104HE / shell command execution)
Vulnerable versions: affected firmware - LILIN — DVR / NVR
Vulnerable versions: affected firmware - TOTOLINK — Routers
Vulnerable versions: affected firmware - ZHONE — Routers
Vulnerable versions: affected firmware
Remediation for Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
Patches
- GitLab CE/EE upgrade fixing CVE-2021-22205 (ExifTool 12.24+)
- Realtek Jungle SDK vendor firmware fixing CVE-2021-35394
Immediate actions
- Block the documented Fodcha C2 IPs and domains (folded.in, fridgexperts.cc, and the v3/v4 ICANN/OpenNIC C2 domains) at the perimeter and DNS layer
- Patch GitLab to a fixed release for CVE-2021-22205 and apply Realtek Jungle SDK fixes (CVE-2021-35394) on affected OEM firmware
- Disable or firewall internet-exposed Android ADB (TCP/5555), Telnet (TCP/23), and SSH (TCP/22) on IoT/edge devices
- Rotate all default and weak Telnet/SSH credentials on routers, DVRs, and cameras (MVPower, LILIN, TOTOLINK, ZHONE)
Workarounds
- Block TCP/5555 (ADB), TCP/9034 (Realtek UDPServer), and unauthenticated DVR HTTP endpoints at the network edge
- Enforce account lockout / fail2ban on Telnet and SSH to defeat Crazyfia brute-force
Longer-term hardening
- Deploy upstream/ISP DDoS scrubbing and anycast absorption to survive 1Tbps-class floods
- Segment and inventory IoT/edge devices; restrict management planes to internal networks only
- Deploy EDR/NDR with behavioral detection for wget/curl payload staging and encrypted beaconing on non-standard ports
CVEs associated with Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
Weaknesses (CWE) in Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
CWE-94, CWE-78, CWE-120, CWE-521, CWE-798
Timeline of Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
- First Fodcha sample captured; botnet begins operation using the folded.in C2 domain.
- Peak observed of 130,000+ daily attack commands issued from Fodcha C2 infrastructure.
- Cloud vendor takes down folded.in; operators migrate C2 to fridgexperts.cc (v2).
- Start of measurement window in which Fodcha accumulates 62,000+ unique bot IPs through April 10, with ~10,000 daily active bots.
- End of window: 62,000+ cumulative unique bots observed, 100+ DDoS victims per day, overwhelmingly in China.
- CNCERT and 360 Netlab publicly disclose Fodcha; BleepingComputer reports 100+ daily victims.
- Version 2.x introduces OpenNIC alternative-TLD C2 domains to resist takedown.
- Version 3 adds xxtea encryption (key PJbiNbbeasddDfsc) for configuration/resources alongside ChaCha20 network encryption.
- Version 4 introduces a structured configuration format.
- Confirmed Fodcha DDoS attack against a healthcare organization (June 7-8, 2022).
- Version 4.x adopts dual ICANN C2 domains for redundancy.
- Fodcha launches a 1+ Tbps DDoS attack against a cloud service provider.
- Single-day peak of 1,396 unique targets attacked; botnet at 60,000+ daily bots and 40+ C2 IPs with ransom demands embedded in DDoS packets.
Sources cited for Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
- Fodcha, a new DDoS botnet
- Fodcha Is Coming Back, Raising A Wave of Ransom DDoS
- New Fodcha DDoS botnet targets over 100 victims every day
- Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets
- New Version of Fodcha DDoS Botnet Adds Extortion
- New Fodcha DDoS Malware Targets More Than 100 Victims Daily
- CVE-2021-22205 — GitLab Unauthenticated RCE (NVD)
- CVE-2021-35394 — Realtek Jungle SDK RCE (NVD)
Threats related to Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day
- P2P Botnets in the Wild: Pink, Hajime, Mozi, FritzFrog, and Panchan — Decentralized C2 Landscape (360 Netlab Continuous Monitoring)
- RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation
- Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
- TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain
- Self-Propagating SSH Worm with Cryptographically Signed C2
- APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting
Detection coverage for TL-2026-0754
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0754 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.