Keksec

Keksec, also known as Kek Security and #keksec, is a financially motivated cybercrime group formed in 2016 by experienced botnet operators. It develops, operates, and distributes malware for distributed denial-of-service (DDoS) attacks, DDoS-based extortion, cryptocurrency mining, information theft, and underground malware sales. Its operations compromise Linux and Windows systems, including internet-facing servers, routers, cameras, and other IoT devices. Gaming services are among its DDoS targets, while its propagation campaigns broadly seek vulnerable systems rather than a consistently defined geographic victim population. Keksec's malware portfolio includes Necro, Gafgyt and Gafgyt_tor variants, Tsunami, EnemyBot, Cloud9, DarkIRC, and DarkHTTP. The group extensively modifies leaked and open-source malware and rapidly incorporates publicly disclosed vulnerabilities into self-propagating botnets. Initial access commonly combines internet-wide scanning, exploitation of exposed applications and network devices, and brute-force attacks against weak or default Telnet and SSH credentials. EnemyBot supports multiple processor architectures and extends targeting to web servers, content management systems, and exposed Android Debug Bridge services. The group's tooling supports remote command execution, additional payload delivery, network sniffing, credential theft, keylogging, browser-cookie theft, clipboard interception, and data exfiltration. Necro can inject Cloud9 browser malware into compromised websites, enabling browser-based mining, information theft, and DDoS activity. Persistence mechanisms include scheduled jobs and Windows autorun entries. Defense evasion includes process-name disguise, string encryption and obfuscation, code morphing, and injection of the r77 rootkit into Windows processes. Tor-based command-and-control and domain-generation algorithms provide infrastructure concealment and resilience. Keksec maintains multiple botnet families in parallel and frequently updates their propagation and attack capabilities.