Threat video1:00
VenomRAT, Latrodectus Botnet Takedowns: Detection & IOCs
Live botnet controllers fell 41-76% at major networks in H2 2025. Covers 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for VenomRAT, Latrodectus Botnet Takedowns: Detection & IOCs →
Chapters
- 0:00The hookBotnet controllers down 76 percent.
- 0:04The storyVenomRAT creator arrested in Athens.
- 0:11Attack pathPhishing delivers malware to victims.
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise17 indicators to hunt: 7 domains, 1 URL and 2 SHA-256 hashes, and more.
- 0:36MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation3 steps now: Block or alert on Spamhaus DROP/BCL-listed IPs and Spamhaus-listed botnet.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Botnet controllers down 76 percent.
0:05VenomRAT creator arrested in Athens.
0:08Police seized CrazyRDP servers.
0:11Phishing delivers malware to victims.
0:14Evades sandbox, establishes persistence.
0:17Beacons to command-and-control.
0:19Logs keystrokes, steals data.
0:23No threat actor is attributed. Confidence: low.
0:2817 indicators to hunt: 7 domains, 1 URL and 2 SHA-256 hashes, and more.
0:3716 ATT&CK techniques, from resource development to command and control.
0:423 steps now: Block or alert on Spamhaus DROP/BCL-listed IPs and Spamhaus-listed botnet.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.