# Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day Exploits (CVE-2021-22205, CVE-2021-35394) and Telnet/SSH Brute-Force, Later Adding Ransom DDoS

> Fodcha is a rapidly spreading IoT/Linux DDoS botnet discovered by CNCERT and 360 Netlab in early 2022, named for its initial C2 domain (folded.in) and its use of the ChaCha algorithm to encrypt traffic. It propagates through N-day vulnerabilities and Crazyfia-driven Telnet/SSH brute-force, amassed 62,000+ unique bot IPs between March 29 and April 10, 2022, and later evolved into a 60K+ daily-bot, 1Tbps-capable botnet that embeds Monero ransom demands in DDoS packets.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0754
- **ID:** TL-2026-0754
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Fodcha operator
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-22205, CVE-2021-35394

## Description

Fodcha is a Mirai-derived, multi-architecture DDoS botnet first sampled on January 12, 2022 and publicly disclosed by 360 Netlab on April 13, 2022. CNCERT and 360 Netlab named it 'Fodcha' from its original command-and-control domain folded.in combined with its use of the ChaCha20 stream cipher to encrypt network traffic. The botnet ships discrete payloads for mips, mpsl (mipsel), arm, and x86 CPU architectures, allowing it to colonize a broad range of routers, DVRs, and Linux servers.

Propagation is two-pronged. First, Fodcha weaponizes a basket of N-day vulnerabilities, including CVE-2021-22205 (GitLab CE/EE unauthenticated RCE via a flawed ExifTool image parse), CVE-2021-35394 (Realtek Jungle SDK 'UDPServer' command-injection / buffer-overflow affecting dozens of OEM SoCs), an Android Debug Bridge (ADB) Debug Server RCE on exposed TCP/5555, and a series of device backdoors / command-injection flaws in MVPower DVR, LILIN DVR, TOTOLINK routers, and ZHONE routers. Second, a standalone brute-force cracking tool named Crazyfia — found co-located on the same downloader servers — scans for and cracks weak Telnet/SSH credentials; the Crazyfia scan results are consumed by the Fodcha operator to push samples onto vulnerable hosts. Successful exploitation pulls architecture-specific binaries from staging servers via wget/curl (ingress tool transfer).

The original (v1) build used folded.in for C2 until March 19, 2022, when the hosting/cloud vendor took down the domain; the operators migrated to fridgexperts.cc (v2), which resolved to more than a dozen IPs spread across the US, Korea, Japan, and India on Amazon, DediPath, DigitalOcean, and Linode infrastructure. Fodcha's C2 protocol uses a multi-step handshake; later builds redesigned communications to use xxtea (with hardcoded key 'PJbiNbbeasddDfsc') to encrypt sensitive configuration/resources and ChaCha20 (32-byte key + 12-byte nonce, single round) for the network channel, deliberately frustrating both file- and traffic-level detection. Bot commands include 0x69 (heartbeat), 0xEB (launch attack), and 0xFB (exit), with roughly 17 attack vectors largely reused from leaked Mirai source.

During March 29–April 10, 2022 Fodcha accumulated over 62,000 unique bot IPs with daily active counts around 10,000, overwhelmingly inside China (China Unicom ~59.9%, China Telecom ~39.4%, China Mobile ~0.5%; top provinces Shandong, Liaoning, Zhejiang) and hitting 100+ DDoS victims per day. Over subsequent releases (v2 OpenNIC TLDs on April 19; v3 xxtea on April 24; v4 structured config on June 5; v4.x dual-ICANN C2 on July 7) the botnet grew to 60,000+ daily bots and 40+ C2 IPs, peaking at over 1Tbps of attack traffic against a cloud provider on September 21, 2022 and 1,396 unique targets in a single day on October 11, 2022. The returning version added a ransom-DDoS (RDDoS) capability: extortion text demanding '10 xmr' to a Monero wallet is embedded directly in the Data portion of DDoS packets — turning a pure availability threat into a financially motivated extortion operation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1133 External Remote Services
- T1110 Brute Force
- T1046 Network Service Discovery
- T1027 Obfuscated Files or Information
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1498 Network Denial of Service
- T1657 Financial Theft

## Sources

- [Fodcha, a new DDoS botnet](https://blog.netlab.360.com/fodcha-a-new-ddos-botnet/)
- [Fodcha Is Coming Back, Raising A Wave of Ransom DDoS](https://blog.netlab.360.com/fodcha-is-coming-back-with-rddos/)
- [New Fodcha DDoS botnet targets over 100 victims every day](https://www.bleepingcomputer.com/news/security/new-fodcha-ddos-botnet-targets-over-100-victims-every-day/)
- [Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets](https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1tbps-in-power-injects-ransoms-in-packets/)
- [New Version of Fodcha DDoS Botnet Adds Extortion](https://www.esecurityplanet.com/threats/fodcha-ddos-botnet-extortion/)
- [New Fodcha DDoS Malware Targets More Than 100 Victims Daily](https://heimdalsecurity.com/blog/new-fodcha-ddos-malware-targets-more-than-100-victims-daily/)
- [CVE-2021-22205 — GitLab Unauthenticated RCE (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2021-22205)
- [CVE-2021-35394 — Realtek Jungle SDK RCE (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2021-35394)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0754