Loading threat actor…
RapperBot is an IoT-focused DDoS botnet and associated threat activity centered on the compromise of internet-exposed embedded devices, particularly DVRs and network cameras. It has been tracked since at least 2022 and has been associated with large-scale distributed denial-of-service operations affecting victims across more than 80 countries. Public reporting has linked the operation to hundreds of thousands of attacks and a botnet size ranging from tens of thousands of infected devices to substantially higher attack throughput at peak capacity. RapperBot propagates through scanning-driven compromise of vulnerable or weakly protected IoT devices and maintains command-and-control infrastructure to coordinate large-scale DDoS activity. Analysis of the botnet has highlighted multiple scanners, dedicated C2 operations, and stealth or countermeasure features intended to sustain the botnet and manage attack execution. Reported victimology includes broad international targeting, with specific concentration noted against online game-related servers in China. RapperBot activity has also been examined in connection with major service disruptions affecting prominent online platforms in 2025. The actor behind RapperBot is best characterized as a cybercriminal DDoS operator rather than a state-sponsored intrusion set. In August 2025, U.S. authorities charged an Oregon-based individual in connection with operating the botnet. The operation’s behavior and scale indicate a primary focus on disruptive-for-hire or otherwise criminal DDoS activity rather than espionage. Known aliases in reporting are limited and generally derivative of the botnet name itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
IoT DDoS botnet with active C2 infrastructure; propagates via multiple scanners; observed infections in multiple regions and linked (timing correlation) to service disruptions and attacks on online game-related servers; operator reportedly arrested after C2 communications ceased.
RapperBot is a botnet used to conduct large-scale DDoS attacks globally, leveraging tens of thousands of infected devices to overwhelm targets with high-volume traffic.
RapperBot is a botnet involved in large-scale DDoS attacks, particularly against AI infrastructure and social media platforms. It is notable for its stealth, command-and-control sophistication, and effectiveness in overwhelming targets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.