Home / Blog / #ddos

#ddos

DDoS attacks and services explained: L4 volumetric floods, L7 HTTP attacks, protection claims vs reality, and how to order a real attack from the Mēris team — free test included.

What is Mēris Botnet? The story of the record-breaking DDoS botnet

How a botnet named after the Latvian word for “plague” set world records with 21.8 million requests per second and became the most feared DDoS-for-Hire service on the market.

Barracuda ESG Vulnerability Chain Gives Root — and Botnets Nodes

Barracuda patched two ESG flaws that chain into root. We break down why compromised mail gateways make ideal botnet nodes for udp and http flood attacks.

SonicWall GMS: Two 9.1-Grade Holes, Zero Patches Coming

SonicWall won't patch two GMS flaws, including a 9.1 unauthenticated file read. Why EoL management boxes are a gift to every botnet and DDoS-for-hire fleet.

DNS Hijacking via Sogou IME: DarkVigil Backdoor Served Over HTTP

SlippyNunchucks hijacked Sogou Input Method DNS requests over plaintext HTTP to drop the DarkVigil backdoor. Our botnet team's take on this classic MITM vector.

How to bypass Qrator DDoS protection — Mēris Blog

Passive filtering, JS Challenge and the feared WASM Challenge — how Qrator defends the RU segment, and how we took 21.8M RPS through it anyway.

XCPE Botnet Takedown: 1.3M TV Boxes Still Infected

Google sinkholed the XCPE botnet's C2, but 1.3 million backdoored TV boxes remain infected, and their proxy revenue model makes them ideal DDoS assets.