{"id":30512,"date":"2024-09-29T06:05:49","date_gmt":"2024-09-29T06:05:49","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=30512"},"modified":"2026-04-17T18:07:37","modified_gmt":"2026-04-17T18:07:37","slug":"over-300000-gorillabot-the-new-king-of-ddos-attacks","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/","title":{"rendered":"Over 300,000! GorillaBot: The New King of DDoS Attacks"},"content":{"rendered":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<html><body><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>In September 2024, NSFOCUS Global Threat Hunting System monitored a new botnet family calling itself Gorilla Botnet entering an unusually active state. Between September 4 and September 27, it issued over 300,000 attack commands, with a shocking attack density.<\/p>\n\n\n\n<p>During this active period, Gorilla Botnet targeted over 100 countries, with China and the U.S. being the hardest hit. Targets included universities, government websites, telecoms, banks, gaming, and gambling sectors.<\/p>\n\n\n\n<p>Gorilla Botnet supports multiple CPU architectures such as ARM, MIPS, x86_64, and x86, and is a modified version of the Mirai source code. It introduced various DDoS attack methods and used encryption algorithms commonly employed by the <a href=\"https:\/\/nsfocusglobal.com\/pt-br\/freakout-analysis-report-1\/\" target=\"_blank\" rel=\"noreferrer noopener\">KekSec group<\/a> to hide key information, while employing multiple techniques to maintain long-term control over IoT devices and cloud hosts, demonstrating a high level of counter-detection awareness as an emerging botnet family.<\/p>\n\n\n\n<p>Be proactive in your cybersecurity strategy. <a href=\"https:\/\/nsfocusglobal.com\/pt-br\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener\">Contact us<\/a> to find out how <a href=\"https:\/\/nsfocusglobal.com\/pt-br\/products\/anti-ddos-system-ads\/\" target=\"_blank\" rel=\"noreferrer noopener\">NSFOCUS Anti-DDoS Solution<\/a> can help!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Impact Scope<\/h2>\n\n\n\n<p>NSFOCUS Global Threat Hunting System monitoring data shows that Gorilla Botnet issued over 300,000 DDoS attack commands in September 2024, with a daily peak of over 20,000 commands. From the timing of the attacks, Gorilla Botnet sent out commands continuously over 24 hours, with a relatively even distribution of commands.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-1-Attack-commands.png\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-1-Attack-commands.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30514\" width=\"597\" height=\"356\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-1-Attack-commands.png 506w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-1-Attack-commands-300x179.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-1-Attack-commands-200x119.png 200w\" sizes=\"(max-width: 597px) 100vw, 597px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 1 Attack commands<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Gorilla Botnet&#8217;s attack targets included 113 countries, involving over 20,000 targets. Geographically, China suffered the most severe attacks, accounting for 20% of the total, followed by the U.S. (19%), Canada (16%), and Germany (6%).<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-2-Victim-distribution.png\"><img decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-2-Victim-distribution.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30516\" width=\"573\" height=\"343\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-2-Victim-distribution.png 506w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-2-Victim-distribution-300x180.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-2-Victim-distribution-200x120.png 200w\" sizes=\"(max-width: 573px) 100vw, 573px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 2 Victim distribution<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Furthermore, monitoring data indicates that Gorilla Botnet initiated multiple attacks against critical infrastructure over the past month, involving over 40 organizations.<\/p>\n\n\n\n<p>In terms of attack methods, Gorilla Botnet tends to use UDP Flood (41%), followed by ACK BYPASS Flood (24%) and VSE Flood (12%).<\/p>\n\n\n\n<p>Due to the limited number of &#8220;bots,&#8221; using the connectionless UDP protocol allows for arbitrary source IP spoofing to generate relatively high traffic, making UDP flooding attacks particularly favored. In terms of attack implementation, attackers use a large number of self-named DDoS attacks, but still draw from existing attack code.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-3-Attack-vectors.png\"><img decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-3-Attack-vectors.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30518\" width=\"574\" height=\"343\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-3-Attack-vectors.png 507w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-3-Attack-vectors-300x179.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-3-Attack-vectors-200x120.png 200w\" sizes=\"(max-width: 574px) 100vw, 574px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 3 Attack vectors<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sample Analysis<\/h2>\n\n\n\n<p><br><strong>Core Functionality<\/strong><br>This trojan is modified from the Mirai family, supporting architectures like ARM, MIPS, x86_64, and x86. The online package and command parsing module reuse Mirai source code but leave a signature message stating &#8220;gorilla botnet is on the device ur not a cat go away,&#8221; hence we named this family GorillaBot.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot.png\"><img loading=\"lazy\" decoding=\"async\" width=\"630\" height=\"326\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30520\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot.png 630w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot-300x155.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot-600x310.png 600w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-4-GorrilaBot-200x103.png 200w\" sizes=\"(max-width: 630px) 100vw, 630px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 4 GorrilaBot<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>GorillaBot has five built-in command and control (C&amp;C) servers; upon running, it randomly selects one to connect to, establishing a connection with the server using the same online process as Mirai, then waits to receive commands.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30522\" width=\"661\" height=\"160\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC.png 574w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC-300x73.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC-570x139.png 570w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-5-CC-200x48.png 200w\" sizes=\"(max-width: 661px) 100vw, 661px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 5 C&amp;C<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Compared to the original Mirai, it has significantly more DDoS attack methods, with a maximum of 19 attack vectors detailed in the table below.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Vector<\/td><td>Method<\/td><\/tr><tr><td>0<\/td><td>attack_udp_generic<\/td><\/tr><tr><td>1<\/td><td>attack_udp_vse<\/td><\/tr><tr><td>3<\/td><td>attack_tcp_syn<\/td><\/tr><tr><td>4<\/td><td>attack_tcp_ack<\/td><\/tr><tr><td>5<\/td><td>attack_tcp_stomp<\/td><\/tr><tr><td>6<\/td><td>attack_gre_ip<\/td><\/tr><tr><td>7<\/td><td>attack_gre_eth<\/td><\/tr><tr><td>9<\/td><td>attack_udp_plain<\/td><\/tr><tr><td>10<\/td><td>attack_tcp_bypass<\/td><\/tr><tr><td>11<\/td><td>attack_udp_bypass<\/td><\/tr><tr><td>12<\/td><td>attack_std<\/td><\/tr><tr><td>13<\/td><td>attack_udp_openvpn<\/td><\/tr><tr><td>14<\/td><td>attack_udp_rape<\/td><\/tr><tr><td>15<\/td><td>attack_wra<\/td><\/tr><tr><td>16<\/td><td>attack_tcp_ovh<\/td><\/tr><tr><td>17<\/td><td>attack_tcp_socket<\/td><\/tr><tr><td>18<\/td><td>attack_udp_discord<\/td><\/tr><tr><td>19<\/td><td>attack_udp_fivem<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>Encryption and Decryption Algorithms<\/strong><br>GorillaBot also uses the encryption algorithms favored by the KekSec group to encrypt key strings. Coupled with the signatures left in the malicious samples and the habit of using &#8220;lol.sh&#8221; as the propagation script name, it is speculated that this group may be related to KekSec or is using KekSec to conceal its true identity.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-6-Encryption-and-decryption-algorithms.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-6-Encryption-and-decryption-algorithms.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30524\" width=\"645\" height=\"237\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-6-Encryption-and-decryption-algorithms.png 569w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-6-Encryption-and-decryption-algorithms-300x110.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-6-Encryption-and-decryption-algorithms-200x73.png 200w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 6 Encryption and decryption algorithms<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p><strong>Persistence and Counter-Honeypot<\/strong><br>Additionally, unlike conventional Mirai families, GorillaBot has a function specifically written as &#8220;yarn_init,&#8221; which integrates code to exploit the Hadoop Yarn RPC unauthorized access vulnerability.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-7-Vulnerability-exploitation.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-7-Vulnerability-exploitation.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30526\" width=\"591\" height=\"429\"><\/a><figcaption class=\"wp-element-caption\">Figure 7 Vulnerability exploitation<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Installing Hadoop YARN typically requires administrator privileges, giving attackers high permissions after exploiting the related vulnerabilities.<\/p>\n\n\n\n<p>For persistence, the GorillaBot trojan creates a service file named custom.service in the \/etc\/systemd\/system\/ directory, configured to run automatically at system startup. The primary purpose of the service is to download a script named lol.sh from the remote address http:\/\/pen.gorillafirewall.su\/ to the \/tmp\/ directory, set execution permissions, and execute the script.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence.png\"><img loading=\"lazy\" decoding=\"async\" width=\"753\" height=\"498\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30528\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence.png 753w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence-300x198.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence-600x397.png 600w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-8-Persistence-200x132.png 200w\" sizes=\"(max-width: 753px) 100vw, 753px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 8 Persistence<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>GorillaBot also adds commands to \/etc\/inittab, \/etc\/profile, and \/boot\/bootcmd to automatically download and execute the lol.sh script upon system startup, user login, or system startup. It creates a script named mybinary in the \/etc\/init.d\/ directory, set to execute at system startup, including actions to download and execute the lol.sh script. It also attempts to add a soft link to mybinary in \/etc\/rc.d\/rc.local or \/etc\/rc.conf (if not present) for execution at system startup.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30530\" width=\"787\" height=\"104\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence.png 787w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence-300x40.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence-768x101.png 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence-600x79.png 600w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/Figure-9-Persistence-200x26.png 200w\" sizes=\"(max-width: 787px) 100vw, 787px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 9 Persistence<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Through the attacker&#8217;s description &#8220;\/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot&#8230;&#8221; it is inferred that the trojan is also attempting to counter honeypots, such as checking whether the \/proc filesystem exists on the controlled device to determine if it is a honeypot.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16.png\"><img loading=\"lazy\" decoding=\"async\" width=\"776\" height=\"194\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-30532\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16.png 776w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16-300x75.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16-768x192.png 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16-600x150.png 600w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/image16-200x50.png 200w\" sizes=\"(max-width: 776px) 100vw, 776px\" \/><\/a><figcaption class=\"wp-element-caption\">Figure 10 Honeypot identification<\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">IOC<\/h2>\n\n\n\n<p>276adc6a55f13a229a5ff482e49f3a0b<\/p>\n\n\n\n<p>63cbfc2c626da269c67506636bb1ea30<\/p>\n\n\n\n<p>7f134c477f307652bb884cafe98b0bf2<\/p>\n\n\n\n<p>3a3be84df2435623132efd1cd9467b17<\/p>\n\n\n\n<p>03a59780b4c5a3c990d0031c959bf7cc<\/p>\n\n\n\n<p>5b37be51ee3d41c07d02795a853b8577<\/p>\n\n\n\n<p>15f6a606ab74b66e1f7e4a01b4a6b2d7<\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"<p>Overview In September 2024, NSFOCUS Global Threat Hunting System monitored a new botnet family calling itself Gorilla Botnet entering an unusually active state. Between September 4 and September 27, it issued over 300,000 attack commands, with a shocking attack density. During this active period, Gorilla Botnet targeted over 100 countries, with China and the U.S. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":30539,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3],"tags":[118,372],"class_list":["post-30512","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-botnet","tag-ddos-attack"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS<\/title>\n<meta name=\"description\" content=\"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2024-09-29T06:05:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg\" \/>\n<meta name=\"author\" content=\"NSFOCUS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"NSFOCUS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/\"},\"author\":{\"name\":\"NSFOCUS\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Over 300,000! GorillaBot: The New King of DDoS Attacks\",\"datePublished\":\"2024-09-29T06:05:49+00:00\",\"dateModified\":\"2026-04-17T18:07:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/\"},\"wordCount\":882,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/NSFOCUS-Featured-Image-2.jpg\",\"keywords\":[\"Botnet\",\"DDoS attack\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/\",\"name\":\"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/NSFOCUS-Featured-Image-2.jpg\",\"datePublished\":\"2024-09-29T06:05:49+00:00\",\"dateModified\":\"2026-04-17T18:07:37+00:00\",\"description\":\"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/NSFOCUS-Featured-Image-2.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/NSFOCUS-Featured-Image-2.jpg\",\"width\":900,\"height\":384,\"caption\":\"Digital network connections visualized over a glowing world map with matrix code.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/over-300000-gorillabot-the-new-king-of-ddos-attacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Over 300,000! GorillaBot: The New King of DDoS Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"NSFOCUS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"NSFOCUS\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS","description":"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/","og_locale":"pt_BR","og_type":"article","og_title":"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS","og_description":"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.","og_url":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/","og_site_name":"NSFOCUS","article_published_time":"2024-09-29T06:05:49+00:00","article_modified_time":"2026-04-17T18:07:37+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","type":"","width":"","height":""}],"author":"NSFOCUS","twitter_card":"summary_large_image","twitter_title":"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS","twitter_description":"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","twitter_misc":{"Escrito por":"NSFOCUS","Est. tempo de leitura":"6 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/"},"author":{"name":"NSFOCUS","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Over 300,000! GorillaBot: The New King of DDoS Attacks","datePublished":"2024-09-29T06:05:49+00:00","dateModified":"2026-04-17T18:07:37+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/"},"wordCount":882,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","keywords":["Botnet","DDoS attack"],"articleSection":["Blog"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/","url":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/","name":"Over 300,000! GorillaBot: The New King of DDoS Attacks - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","datePublished":"2024-09-29T06:05:49+00:00","dateModified":"2026-04-17T18:07:37+00:00","description":"Explore the emergence of Gorilla Botnet, its DDoS tactics, global impact, and sophisticated evasion techniques.","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/09\/NSFOCUS-Featured-Image-2.jpg","width":900,"height":384,"caption":"Digital network connections visualized over a glowing world map with matrix code."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/over-300000-gorillabot-the-new-king-of-ddos-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Over 300,000! GorillaBot: The New King of DDoS Attacks"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"NSFOCUS","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"NSFOCUS"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/30512","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=30512"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/30512\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/30539"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=30512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=30512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=30512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}