NULLZEREPTOOL: Telegram-Controlled Python DDoS and Multi-Function Attack Framework — Threadlinqs Intelligence
As of 2026-07-21, NULLZEREPTOOL: Telegram-Controlled Python DDoS and Multi-Function Attack Framework is a medium-severity malware threat attributed to Unknown (Vietnamese-speaking DDoSaaS operator, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1592 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Attribution: Unknown (Vietnamese-speaking DDoSaaS operator · FINANCIAL
NULLZEREPTOOL is a Python-based, Telegram-controlled DDoS-as-a-Service framework surfaced through two Pastebin source-code leaks (April 27 and April 29, 2026). It ships a 20-method Layer 3/4/7 DDoS
NULLZEREPTOOL is a commodity DDoS-as-a-Service (DDoSaaS) tool written in Python and controlled entirely through a Telegram bot (via the `telebot` library), discovered by Flare's dark-web/paste-site monitoring across two separate Pastebin uploads two days apart (Rxk4VgnX on 2026-04-27, ryxQ077S on 2026-04-29). The core is a 20-method attack engine dispatched from a METHODS dictionary, including combo_worker (interleaved HTTP/UDP/TCP), http_worker, udp_worker, tcp_worker, slowloris_worker, dns_amplification_worker (50x repeated queries reflected off 8.8.8.8 and 1.1.1.1), and ntp_amplification_worker (monlist requests reflected off time.google.com and pool.ntp.org). An auto-scaling controller checks observed RPS every 15 seconds and grows the worker pool (current x 1.2 + 10, capped at 2,000 threads, up to 1,000 initial threads with 1ms minimum per-worker delay) whenever throughput falls below 70% of the operator-set target. A seven-source proxy harvesting/validation pipeline (api.proxyscrape.com, proxylist.geonode.com, free-proxy-list.net, and four unnamed GitHub raw-file sources) validates candidates against httpbin.org/ip with a 5-second timeout, retaining only sub-2-second responders, and supports live rotation via the /proxy Telegram command.
Operator access is gated by a SQLite-backed (c2.db) single-use license-key system: keys are generated with secrets.token_hex(10) into 20-character hex strings, default max-uses of 1, with admin commands /key [days], /keys, and /delkey — consistent with a tiered-access or resale/reseller distribution model typical of low-tier booter/stresser markets. The Telegram bot itself is gated by a hardcoded operator Telegram ID (7593738229) and a fixed plaintext password ("7788") accepted by the /login command, tracked in a logged_in session dictionary; /attacks, /proxy, /key, /cvv, /stats round out the command surface, with periodic in-chat stats messages during active floods.
Observed live attack sessions recovered from the leaked artifacts show operational use against shopmuabancf[.]com (an e-commerce site, 20,000 RPS combo attack, 10,404 requests, successful), Bloomberg.com (200,000 RPS combo attack, watchdog declared the target dead with 0 completed requests logged), and Trangchubloxfruit[.]com (a Roblox/gaming-adjacent site, 50,000 RPS combo attack, only 132 requests — low throughput). Vietnamese-language comments and bot response strings throughout the source point to a Vietnamese-speaking developer/operator community; overall sophistication is assessed as low, consistent with widespread booter/stresser tooling rather than an advanced or state-linked capability.
The later (April 29) variant adds three server-side modules whose end-to-end functionality Flare could not confirm because the corresponding client binary (client.py) was absent from the leaked artifacts: (1) a wireless-attack module wrapping aireplay-ng and netsh wlan disconnect for WiFi deauthentication, l2ping -f / hcitool dc for Bluetooth disruption (Linux-only, requires root), netsh wlan show profiles key=clear / nmcli for saved WiFi credential extraction, and a three-stage hcxdumptool -> hcxpcapngtool -> hashcat WiFi-cracking workflow; (2) a credential/financial-data module exposing manual /cvv <cc> <cvv> <exp> entry into a cvv_logs table (cc, cvv, exp, time) retrievable via /getcvv, a /wifipass command for extracted WiFi profiles, and a referenced but unimplemented "browser_steal" task type with no corresponding parsing code; and (3) a Flask-based botnet-tasking layer exposing /slave_register, /slave_get_task, and /slave_report endpoints, a BOTNET_HIERARCHY structure tracking masters/slaves/task queues/completions, task types wifi_scan, browser_steal, and full_steal, and Telegram commands /botnet_task, /botnetdata, /botnetslaves, /botnetexport. Flare assessed this later feature set as still in a feature-testing phase given the missing client component.
No CVE or software vulnerability underlies this threat — it is a commod
Target sectors: ecommerce, news - media, gaming, finance
Target regions: Global, Southeast Asia, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1590, T1588, T1583, T1585, T1059, T1059, T1090, T1552, T1555, T1557