The Gorilla Botnet, utilizing Mirai botnet source code and advanced techniques, has emerged as a significant global threat, according to cybersecurity firm NSFOCUS.

Since its detection in September 2024, the Gorilla Botnet has launched extensive DDoS attacks targeting over 300,000 systems across more than 100 countries.

On average, the botnet executes around 20,000 attack commands daily, impacting critical infrastructures such as universities, government websites, telecoms, banks, and gaming platforms.

This botnet employs a network of compromised IoT devices to carry out large-scale DDoS attacks, overwhelming targeted systems with traffic and disrupting user access.

It operates through a distributed command-and-control network and offers various DDoS attack methods, including UDP Flood and ACK Bypass Flood.

The Gorilla Botnet's use of encryption allows it to obscure important data, ensuring long-term control over compromised devices and compatibility with various CPU architectures.

The attacks have notably targeted critical infrastructures, highlighting the urgent need for improved security protocols across various sectors.

The malware's sophistication includes encryption algorithms similar to those used by the hacking group Keksec, complicating detection efforts for cybersecurity professionals.

Additionally, the botnet focuses on persistence by exploiting vulnerabilities, ensuring that malicious services run upon system startup.

In light of these threats, organizations are urged to enhance their cybersecurity measures, including deploying firewalls, intrusion detection systems, and cloud-based DDoS protection to mitigate risks.