Inside the Botnet Arsenal: What 3,300 DDoS Malware Samples Reveal About Today’s Attacks

Each sample is compiled for many chips, so the botnet can recruit almost any device with a weak password or an unpatched flaw. Millions of these devices sit on home and business networks with no one watching them. Together they make up the botnets’ firepower.

The DDoS arsenal, function by function 

We grouped every attack function we found into categories. The percentages below are the share of the 1,577 samples whose attack code we could fully map. 

1. TCP floods: in 75% of samples

The workhorse of the arsenal. These attacks use up connection tables, firewall state and server resources. 

• SYN floods (17%): thousands of half-open connections that tie up servers and stateful firewalls. 

• ACK, PSH, “STOMP”, XMAS and other flag floods (16%): packets with unusual flag combinations, built to slip past simple filters and exhaust stateful devices. “STOMP” attacks first complete a real handshake and then flood the open connection, so the traffic looks legitimate. 

• Raw TCP and connection floods: high-rate packet streams with header fields (sequence numbers, window sizes, IP IDs, ports) that change in every packet, so they never form a simple, repeating fingerprint. More than 700 samples vary these header fields. 

2. UDP floods: in 67% of samples

The classic volumetric attack, with modern variations: 

• Plain UDP floods that fill links with as much bandwidth as possible. 

• “Hex”, “Junk” and “STD” floods that send random or patterned payloads to beat payload-matching rules. 

• PPS (packets-per-second) floods that send tiny packets at enormous rates. They target router and firewall CPU resources rather than bandwidth. 

3. HTTP/HTTPS and application-layer (Layer 7) floods: in 58% of samples

This is where attacks get clever. Layer-7 floods imitate real users, so they are much harder to tell apart from real customers: 

• Rotating browser identities: more than 800 samples carry browser User-Agent strings, cycling between Chrome, Firefox, Safari and mobile browsers. 

• Cache-busting: random query strings that force every request past the CDN to your origin server. 

• Modern browser imitation: some strains copy HTTP/2 handshakes and Chromium “client hint” headers to look like up-to-date browsers. 

• HTTPS/TLS floods: encrypted request floods that cost the defender far more CPU resources than they cost the attacker. 

• CDN-targeted modes: functions named after specific CDN and cloud protection providers, built to wear down those defenses. 

4. Game-server floods: in 31% of samples

Online gaming is one of the most heavily targeted industries, and the malware shows it. We found dedicated functions for: 

• Valve Source Engine query floods – the “VSE” attack is one of the most common functions in the whole dataset 

• Fortnite, Minecraft, Rainbow Six, SA-MP (GTA multiplayer) and RakNet-based games 

• Discord voice and chat infrastructure 

These attacks send traffic that looks like real game protocol messages, so blocking it in a crude way also cuts off real players. 

5. “Bypass” floods aimed at mitigation services: in 20% of samples

Some functions are named directly after the hosting providers and protection services they are meant to beat (“OVH”, “NFO”, “home bypass”, “TCP bypass”, “UDP bypass”). Attackers write malware to defeat specific defenses. Protection that never adapts will sooner or later be targeted by name. 

6. DNS floods: in 16% of samples

DNS query floods hit authoritative and recursive resolvers with large numbers of lookups, each with a new transaction ID. If DNS goes down, everything behind it goes down too, even when the web servers themselves are fine. 

7. ICMP floods: in 10% of samples

The ping flood still exists. It is simple and noisy, and it works well as a distraction while a quieter attack runs alongside it. 

8. GRE and tunnelling floods: in 7% of samples

GRE floods wrap attack traffic inside tunnelling protocols, sometimes with whole fake Ethernet frames inside. They are aimed at infrastructure and can get past filters that only look at the outer packet. 

9. Reflection and amplification: in 7% of samples

Some strains abuse third-party services such as SSDP (UPnP) and DNS to bounce and amplify traffic toward a victim. The attacker sends a small request and the victim receives a much larger reply.

Hiding in plain sight 

The attack modes are only part of the story. The malware also works hard to avoid detection: 

• Spoofed and changing source IP addresses: more than 500 samples create fake source addresses, so blocking by IP address does little. 

• Constantly changing packet fingerprints: ports, header values, payload lengths and contents change from packet to packet, which defeats static signatures. 

• Disguised processes: more than 100 samples rename themselves to look like normal Linux system processes such as [kworker/0:0], so a quick look at an infected device shows nothing unusual. 

What this means for your business 

1. Multi-vector is the norm. Four out of five botnet samples can launch more than one type of attack. A defense that only handles volumetric floods, or only handles web attacks, leaves gaps an attacker can find in minutes.
2. Layer-7 attacks are a mainstream threat. More than half of the mapped samples include application-layer floods that imitate real browsers. Telling a bot from a customer needs real-time, behaviour-based analysis, not static rules.
3. Speed matters more than ever. Botnets switch attack modes on command. Mitigation that waits for a person to look at the traffic, or that takes minutes to reroute it, will always be a step behind.
4. Attackers target your defenses by name. “Bypass” modes show that adversaries study common protection setups. Defenses need to adapt automatically and look at traffic behaviour, not just simple thresholds.
5. Gaming, hosting and ISPs are in the crosshairs. Dedicated game-protocol floods and provider-specific bypasses show exactly who the botnet operators are aiming at.
6. The botnet is built from your neighbours’ devices. Unsecured routers, cameras and DVRs across 17 chip architectures provide the firepower. As long as those devices stay online and unpatched, the supply of attack capacity will not run out.

How to stay ahead 

• Use always-on, automatic DDoS protection that detects and blocks attacks within seconds, without waiting for a person to act. 

• Cover every layer: volumetric, protocol (TCP state, SYN, ACK, GRE) and application (HTTP/HTTPS) attacks. 

• Use behaviour-based detection that looks at how traffic acts rather than relying on IP blocklists or fixed signatures. 

• Protect DNS and other shared infrastructure as carefully as your web front end. 

• Harden your own devices: change default passwords, patch firmware and segment IoT devices so your network doesn’t become someone else’s weapon. 

Behind the research: our DDoS Threat Research team 

The analysis in this article isn’t a one-off project. It is what our DDoS Threat Research team does every day. 

Botnets change every week. New variants appear, old attack methods get renamed and reworked, and new ways to get past defenses turn up in the wild. Good protection keeps up with those changes. Our team makes sure it does. 

Proactive: finding attacks before they find you 

We don’t wait for an attack to reach a customer before we study it. Our team: 

• Takes apart new malware as soon as it appears, pulling out every attack function, as we did for the 3,322 samples in this report. 

• Tracks botnet families and their offshoots, so we spot a new variant the day it starts spreading, not after it has been used against a customer. 

• Studies how each attack method works: which protocols it abuses, what its packets look like, and which defenses it was written to get around. 

• Builds and tests defenses early, so protection is often ready before an attack method is widely used. 

Reactive: fast response when something new appears 

When a new attack vector does appear in the wild, speed is what counts. Our researchers: 

• Analyze new attack traffic as it happens and pull out the patterns that set it apart from real users. 

• Turn those findings into new detection rules and mitigation methods, then test them against real attack data, so legitimate traffic keeps flowing. 

• Feed every lesson back into our research, so each attack we see makes the next defense stronger. 

Delivered automatically through our DDoS Intelligence service 

Research only helps if it reaches the network that needs it. Our DDoS Intelligence Service sends the team’s latest rules and mitigation methods straight to customer deployments: 

• No waiting for a software upgrade. New protection arrives as soon as it is ready. 

• No manual work for your team. Updates are applied automatically, so your engineers can stay focused on running the network. 

• Protection that grows with the threat. Every new botnet variant, game-server flood, bypass method and DDoS trick we find becomes part of your defense. 

• Shared knowledge. An attack spotted anywhere helps protect everyone using the service. 

In short, you don’t just get a DDoS protection product. You get a dedicated team of DDoS specialists working in the background, studying the attackers and keeping your defenses up to date around the clock.

The bottom line 

Modern DDoS malware is a well-stocked, constantly updated arsenal. It is cheap to deploy, easy to change, and built to get around the defenses most organizations rely on. Our analysis of more than 3,300 samples shows attackers with a wide menu of options, and they only need one of them to get through. 

The good news is that this arsenal is now well understood, because we make it our job to understand it. Our Threat Research team studies every new variant, builds the countermeasures, and sends them to you through our DDoS Intelligence Service. Every attack method in this report can be detected and stopped before your customers notice anything. 

Want to see how our DDoS Intelligence Service can protect your network against these attack types?