DoJ Disrupts 3 Million-Device Botnets Behind Record DDoS [Prime Cyber Insights]

[00:00] Announcer: From Neural Newscast, this is Prime Cyber Insights, Intelligence for Defenders, Leaders, and Decision Makers. [00:09] Aaron Cole: Welcome to Prime Cyber Insights, from March 20th, 2026. I am Aaron. [00:17] Aaron Cole: And I'm Lauren. Today, we are analyzing a massive international law enforcement operation [00:24] Aaron Cole: targeting record-breaking IoT botnets. [00:27] Aaron Cole: The United States Department of Justice, in coordination with partners in Canada and Germany, [00:33] Aaron Cole: has disrupted the command-and-control infrastructure for four major botnets, [00:37] Aaron Cole: ISURU, Kim Wolf, Jack Skid, and Mossad. [00:42] Aaron Cole: This network comprised over 3 million devices worldwide, including routers and smart TVs, [00:47] Aaron Cole: capable of launching DDoS attacks peaking at 31.4 terabits per second. [00:52] Aaron Cole: Lauren, this represents a significant escalation beyond typical Mirai-style deployments. [00:58] Lauren Mitchell: It certainly does, Aaron. [01:00] Lauren Mitchell: The Kim Wolf operation is particularly notable for its use of residential proxy networks [01:06] Lauren Mitchell: to bypass standard home router firewalls. [01:09] Lauren Mitchell: By moving laterally through these local networks, the botnet achieved a level of volumetric capacity that Cloudflare compared to the entire populations of the United Kingdom, Germany, and Spain, making simultaneous web requests. [01:23] Lauren Mitchell: It is a major shift in how these networks scale. [01:26] Aaron Cole: While that infrastructure falls, Apple is issuing a rare public warning regarding the Karuna and Darksword exploit kits. [01:34] Aaron Cole: These tools are chaining multiple vulnerabilities to target older, unpatched iPhones, specifically those running versions earlier than iOS 15. [01:43] Aaron Cole: Research from Google and Iverify suggests that nation-state-level capabilities are now being automated for mass market data theft. [01:50] Lauren Mitchell: The commoditization of these exploits is the critical takeaway, Aaron. [01:55] Lauren Mitchell: Commercial spyware vendors and threat groups like UNC3653 are using these frameworks to automate the [02:02] Lauren Mitchell: exfiltration of messages, location data, and audio recordings. [02:06] Lauren Mitchell: While Apple suggests lockdown mode for high-risk users, the broader lesson for practitioners [02:11] Lauren Mitchell: is that the window between zero-day discovery and full automation has effectively collapsed. [02:18] Aaron Cole: On the Android side, Google is introducing a mandatory 24-hour waiting period for side-loading apps from unverified developers. [02:25] Aaron Cole: Beginning this August, users will be required to enable developer mode, restart their device, and wait a full day before an installation can be finalized. [02:34] Aaron Cole: It is a friction-heavy security control designed to break the rhythm of social engineering attacks. [02:40] Lauren Mitchell: It is a necessary friction, Aaron. [02:42] Lauren Mitchell: Given the rise of the Perseus Trojan targeting financial institutions and the pure HVNC-RAT distributed via Google Forms, [02:51] Lauren Mitchell: the speed of side loading had become a significant liability. [02:55] Lauren Mitchell: This cooling-off period gives users time to verify whether a request to bypass system security is actually legitimate. [03:03] Aaron Cole: Between botnet takedowns and mobile guardrails, we are seeing a clear shift toward architectural hardening. [03:11] Aaron Cole: The focus is moving from simple detection to making these volumetric and social engineering attacks structurally difficult to maintain. [03:19] Lauren Mitchell: Precisely. Removing 3 million nodes is a major win, but the resilience of Kim Walf shows that the defensive perimeter must now extend deep into the residential IoT layer. The priority remains auditing visibility and keeping mobile assets fully patched. [03:38] Aaron Cole: That concludes our briefing. [03:40] Aaron Cole: I am Aaron. [03:41] Lauren Mitchell: And I'm Lauren. [03:42] Lauren Mitchell: For more technical deep dives, visit pci.neuralnewscast.com [03:48] Lauren Mitchell: and subscribe to the Neural Newscast Network. [03:51] Lauren Mitchell: Neural Newscast is AI-assisted, human-reviewed. [03:54] Lauren Mitchell: View our AI transparency policy at neuralnewscast.com. [03:59] Announcer: This has been Prime Cyber Insights on Neural Newscast, [04:02] Announcer: Intelligence for Defenders, Leaders, and Decision Makers.