Hackers Use Jenkins Access to Deploy DDoS Botnet Against Gaming Servers
Attackers abuse misconfigured Jenkins servers to deploy DDoS botnet targeting gaming infrastructure.
Security researchers at Darktrace detected a campaign on March 18, 2026 exploiting misconfigured Jenkins servers via the scriptText endpoint to deploy a DDoS botnet targeting gaming servers, particularly those running Valve's Source Engine. The attackers used Groovy scripts to achieve Remote Code Execution, dropping malware (w.exe on Windows, bot_x64 on Linux) that communicates via a single IP address (103.177.110.202) in Vietnam. The botnet employs evasion techniques and game-specific DoS attacks like attack_dayz to crash gaming infrastructure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Valve Corporation?
Get an email when a new story names Valve Corporation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 103.177.110.202
- malware — w.exe
- malware — bot_x64.exe
- malware — ksoftirqd/0
- malware — kworker