[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg14eN99N0Ux9yDnNY2l0ErFzY9QXA2v6lQ6fcZGcgkw":3},{"article":4,"iocs":50,"watch_terms":66,"solutions":67,"lesson":34},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4496bc96-a2a5-413f-9fdc-6232ee4eeafa","Hackers Use Jenkins Access to Deploy DDoS Botnet Against Gaming Servers","hackers-use-jenkins-access-to-deploy-ddos-botnet-against-gaming-servers-02b5da","A new campaign shows misconfigured Jenkins servers abused to deploy a DDoS botnet targeting gaming systems, with Valve Corporation infrastructure in focus.","Security researchers at Darktrace detected a campaign on March 18, 2026 exploiting misconfigured Jenkins servers via the scriptText endpoint to deploy a DDoS botnet targeting gaming servers, particularly those running Valve's Source Engine. The attackers used Groovy scripts to achieve Remote Code Execution, dropping malware (w.exe on Windows, bot_x64 on Linux) that communicates via a single IP address (103.177.110.202) in Vietnam. The botnet employs evasion techniques and game-specific DoS attacks like attack_dayz to crash gaming infrastructure.","Attackers abuse misconfigured Jenkins servers to deploy DDoS botnet targeting gaming infrastructure.","https:\u002F\u002Fhackread.com\u002Fhackers-jenkins-ddos-botnet-gaming-servers\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002Fhackers-jenkins-ddos-botnet-gaming-servers.jpg","2026-05-01T17:21:29+00:00","2026-05-01T18:00:13.521733+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Valve Corporation","vendor",{"name":21,"type":19},"Darktrace",{"name":23,"type":24},"Jenkins","product",{"name":26,"type":24},"Valve Source Engine",{"name":28,"type":24},"CyberChef",{"name":30,"type":31},"Groovy scripting","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,61,64],{"type":52,"value":53,"context":54},"ip","103.177.110.202","Command and control server; malware delivery; located in Vietnam (Webico\u002FTino provider)",{"type":36,"value":56,"context":57},"w.exe","Windows payload dropped from 103.177.110.202; renamed to win_sys.exe and hidden as update.dat in Temp folder",{"type":36,"value":59,"context":60},"bot_x64.exe","Linux payload binary dropped to \u002Ftmp directory for DDoS botnet",{"type":36,"value":62,"context":63},"ksoftirqd\u002F0","Process name masquerade used by botnet to evade detection on Linux systems",{"type":36,"value":65,"context":63},"kworker",[18,21,23],{"controls":68,"vendors":155},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":128,"name":129,"problem":130,"products":131},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[132,140,147],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":141,"vendor_name":21,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[156],{"slug":141,"name":21,"logo_path":142,"roles":157},[158],"reported_by"]