[{"data":1,"prerenderedAt":807},["ShallowReactive",2],{"blog-the-100tb-stealth-botnet-postmortem":3,"blog-others-the-100tb-stealth-botnet-postmortem":790},{"id":4,"title":5,"author":6,"body":7,"date":773,"description":774,"extension":775,"image":776,"meta":777,"navigation":778,"path":779,"seo":780,"source":781,"stem":782,"tags":783,"__hash__":789},"blog/blog/the-100tb-stealth-botnet-postmortem.md","The 100-Terabyte Ghost: Unmasking a Stealth Linux DDoS Botnet Using Kernel Bind Mounts","KloudBoy Security Team",{"type":8,"value":9,"toc":748},"minimark",[10,17,20,23,47,57,64,67,70,73,78,85,92,98,104,107,123,126,131,138,140,144,147,180,183,185,189,196,203,209,212,218,221,227,237,239,246,253,259,262,268,275,281,284,290,302,305,307,311,314,320,327,333,340,347,353,358,364,375,381,411,414,420,429,435,441,444,450,452,456,462,468,472,517,519,523,526,536,542,560,563,590,592,596,599,603,609,613,619,623,629,633,636,642,648,651,657,661,664,670,673,679,681,685,724,726,735,739,742],[11,12,13],"p",{},[14,15],"img",{"alt":5,"src":16},"/brand/og/og-security-services.png",[11,18,19],{},"Every DevOps engineer and systems administrator dreads the sudden, unexpected traffic spike notification from their cloud hosting provider.",[11,21,22],{},"In a recent emergency investigation handled by the KloudBoy security team, a client reached out with a shocking visual: their monthly bandwidth meters on their cloud hosting console were pinned at maximum capacity.",[24,25,26,39],"ul",{},[27,28,29,33,34,38],"li",{},[30,31,32],"strong",{},"Server Alpha:"," ",[35,36,37],"code",{},"58.662 TB / 20 TB"," (100% capacity exceeded)",[27,40,41,33,44,38],{},[30,42,43],{},"Server Beta:",[35,45,46],{},"48.766 TB / 20 TB",[48,49,54],"pre",{"className":50,"code":52,"language":53},[51],"language-text","[ OUTGOING TRAFFIC: 58.662 TB / 20 TB ]\n[████████████████████████████████████████] 100%\n\"If you exceed the included traffic, the cost for every commenced TB extra is €1.00.\"\n","text",[35,55,52],{"__ignoreMap":56},"",[11,58,59,60,63],{},"Combined, both servers had transmitted over ",[30,61,62],{},"107 Terabytes"," of unauthorized outbound bandwidth in less than two weeks. At standard cloud bandwidth overage rates, an unexpected bill was compounding by the hour.",[11,65,66],{},"What was happening? Was an internal mail service being abused as an open spam relay? Were media files being scraped or hotlinked? Or had the machines been hijacked into a cyberweapon?",[11,68,69],{},"Here is the step-by-step forensic deep-dive into how we investigated the breach, uncovered an ingenious kernel-level concealment technique, and eradicated the botnet.",[71,72],"hr",{},[74,75,77],"h2",{"id":76},"_1-initial-reconnaissance-listening-to-the-network-interface","1. Initial Reconnaissance: Listening to the Network Interface",[11,79,80,81,84],{},"When facing an unexplained bandwidth explosion, the first place to look is the raw Linux kernel interface counters in ",[35,82,83],{},"/proc/net/dev",".",[11,86,87,88,91],{},"Checking the primary network interface (",[35,89,90],{},"eth0",") on Server Alpha immediately revealed the astronomical scale:",[48,93,96],{"className":94,"code":95,"language":53},[51],"cat /proc/net/dev | grep eth0\n",[35,97,95],{"__ignoreMap":56},[48,99,102],{"className":100,"code":101,"language":53},[51],"Inter-| Receive | Transmit\n face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed\n eth0: 13289820216 101675297 0 0 0 0 0 0 66541661577599 46957176343 0 0 0 0 0 0\n",[35,103,101],{"__ignoreMap":56},[11,105,106],{},"Notice the numbers:",[24,108,109,115],{},[27,110,111,114],{},[30,112,113],{},"RX (Inbound):"," 13.2 GB across 101 Million packets",[27,116,117,33,120],{},[30,118,119],{},"TX (Outbound):",[30,121,122],{},"66.54 Terabytes across 46.95 Billion packets",[11,124,125],{},"Doing some basic math on the average outbound packet size:",[11,127,128],{},[35,129,130],{},"66,541,661,577,599 bytes / 46,957,176,343 packets ≈ 1,417 bytes/packet",[11,132,133,134,137],{},"A 1,417-byte average payload size matches the standard Ethernet ",[30,135,136],{},"Maximum Transmission Unit (MTU)"," of 1,500 bytes. This wasn’t standard web traffic, DNS queries, or outbound email—this was full-frame, line-rate packet streaming designed to completely saturate the server’s 1 Gbps uplink.",[71,139],{},[74,141,143],{"id":142},"_2-the-red-herrings","2. The Red Herrings",[11,145,146],{},"Our initial suspicions turned up empty:",[148,149,150,164,170],"ol",{},[27,151,152,155,156,159,160,163],{},[30,153,154],{},"Mail Queues:"," Checking Postfix and Sendmail queues (",[35,157,158],{},"mailq",", ",[35,161,162],{},"postqueue -p",") showed only standard internal system notifications. No mass-spam campaign.",[27,165,166,169],{},[30,167,168],{},"Web Server Logs:"," Examining Nginx access and error logs across all hosted virtual hosts revealed log files barely exceeding 10 MB in total. No massive file downloads, no open proxies.",[27,171,172,175,176,179],{},[30,173,174],{},"CPU Utilization:"," Running ",[35,177,178],{},"top"," showed modest CPU loads (average load under 0.6). The server appeared remarkably calm.",[11,181,182],{},"How could a server push 500 GB in a single hour without maxing out CPU or leaving trails in web server logs?",[71,184],{},[74,186,188],{"id":187},"_3-querying-the-metrics-database-isolating-the-attack-window","3. Querying the Metrics Database: Isolating the Attack Window",[11,190,191,192,195],{},"Fortunately, the server control panel on these machines records historical system metrics (CPU, disk I/O, network) into a local SQLite database (",[35,193,194],{},"system.db",").",[11,197,198,199,202],{},"We wrote a Python script to scan the differential in cumulative transmission (",[35,200,201],{},"total_up",") per day:",[48,204,207],{"className":205,"code":206,"language":53},[51],"import sqlite3, datetime\n\nconn = sqlite3.connect('system.db')\nc = conn.cursor\nq = \"\"\"\nSELECT date(addtime, 'unixepoch') as d, max(total_up) - min(total_up) as diff_bytes\nFROM network\nGROUP BY d\nHAVING diff_bytes > 107374182400\nORDER BY diff_bytes DESC\n\"\"\"\nc.execute(q)\nfor r in c.fetchall:\n print(f\"Date: {r[0]} -> {r[1]/(1024**4):.2f} TB\")\n",[35,208,206],{"__ignoreMap":56},[11,210,211],{},"The output was staggering:",[48,213,216],{"className":214,"code":215,"language":53},[51],"Date: Day 10 -> 3.86 TB\nDate: Day 4 -> 3.76 TB\nDate: Day 11 -> 3.54 TB\nDate: Day 8 -> 3.52 TB\nDate: Day 6 -> 3.35 TB\nDate: Day 3 -> 3.30 TB\nDate: Day 5 -> 2.97 TB\nDate: Day 9 -> 2.70 TB\nDate: Day 12 -> 2.68 TB\n",[35,217,215],{"__ignoreMap":56},[11,219,220],{},"Drilling down to hourly metrics during the peak surge:",[48,222,225],{"className":223,"code":224,"language":53},[51],"Hour 09:00 -> 105.95 GB\nHour 10:00 -> 500.69 GB \u003C-- Over 1.1 Gbps uplink saturation!\nHour 11:00 -> 281.96 GB\nHour 17:00 -> 213.04 GB\nHour 18:00 -> 230.90 GB\nHour 19:00 -> 280.29 GB\n",[35,226,224],{"__ignoreMap":56},[11,228,229,230,233,234,84],{},"For nearly two weeks straight, the servers were pushing between ",[30,231,232],{},"2.5 TB and 3.8 TB every single day",", hitting peak burst rates of ",[30,235,236],{},"500 GB in an hour",[71,238],{},[74,240,242,243],{"id":241},"_4-the-smoking-gun-m_bot_lock_instance","4. The Smoking Gun: ",[35,244,245],{},"@m_bot_lock_instance",[11,247,248,249,252],{},"To find the culprit process, we inspected active network sockets using socket statistics (",[35,250,251],{},"ss","):",[48,254,257],{"className":255,"code":256,"language":53},[51],"ss -t -u -a -n -p\n",[35,258,256],{"__ignoreMap":56},[11,260,261],{},"Two suspicious entries stood out among thousands of benign sockets on Server Alpha:",[48,263,266],{"className":264,"code":265,"language":53},[51],"tcp ESTAB 0 0 198.51.100.24:48278 168.220.248.xxx:24032 users:((\"python2.7\",pid=4758,fd=9))\ntcp ESTAB 0 0 198.51.100.24:48246 168.220.248.xxx:24032 users:((\"python2.7\",pid=4758,fd=10))\n",[35,267,265],{"__ignoreMap":56},[11,269,270,271,274],{},"And checking ",[35,272,273],{},"/proc/net/unix"," for abstract namespace UNIX domain sockets:",[48,276,279],{"className":277,"code":278,"language":53},[51],"00000000578cb20b: 00000002 00000000 00000000 0002 01 37177065 @m_bot_lock_instance\n",[35,280,278],{"__ignoreMap":56},[11,282,283],{},"On Server Beta, we ran the exact same audit:",[48,285,288],{"className":286,"code":287,"language":53},[51],"tcp ESTAB 0 0 198.51.100.88:52136 168.220.248.xxx:24032 users:((\"qemu-ga\",pid=2974251,fd=9))\n00000000578cb20b: 00000002 00000000 00000000 0002 01 552763552 @m_bot_lock_instance\n",[35,289,287],{"__ignoreMap":56},[11,291,292],{},[30,293,294,295,298,299,301],{},"Both servers were actively connected to the exact same external IP and port (",[35,296,297],{},"168.220.248.xxx:24032",") and sharing the exact same internal singleton lock socket: ",[35,300,245],{},"!",[11,303,304],{},"An IP lookup on the remote destination confirmed it was an external bulletproof Command & Control (C2) server.",[71,306],{},[74,308,310],{"id":309},"_5-the-master-of-disguise-linux-kernel-bind-mounts","5. The Master of Disguise: Linux Kernel Bind Mounts",[11,312,313],{},"We proceeded to inspect the binary behind the suspicious process PID on Server Alpha:",[48,315,318],{"className":316,"code":317,"language":53},[51],"ls -la /proc/4758/exe\n# lrwxrwxrwx. 1 root root 0 Sep 28 04:40 /proc/4758/exe -> /usr/sbin/python2.7\n\nls -la /usr/sbin/python2.7\n# -rwxr-xr-x. 1 root root 7144 Jun 28 2022 /usr/sbin/python2.7\n\nfile /usr/sbin/python2.7\n# /usr/sbin/python2.7: ELF 64-bit LSB executable, x86-64, version 1 (SYSV)\n",[35,319,317],{"__ignoreMap":56},[11,321,322,323,326],{},"At first glance, ",[35,324,325],{},"/usr/sbin/python2.7"," looked like a normal 7 KB system Python executable. But when we attempted to delete it:",[48,328,331],{"className":329,"code":330,"language":53},[51],"rm -f /usr/sbin/python2.7\n# rm: cannot remove ‘/usr/sbin/python2.7’: Device or resource busy\n",[35,332,330],{"__ignoreMap":56},[11,334,335,336,339],{},"Why would a regular file report ",[35,337,338],{},"Device or resource busy","?",[11,341,342,343,346],{},"We checked ",[35,344,345],{},"/proc/mounts",":",[48,348,351],{"className":349,"code":350,"language":53},[51],"cat /proc/mounts | grep python\n# /dev/sda1 /usr/sbin/python2.7 ext4 rw,seclabel,relatime,data=ordered 0 0\n",[35,352,350],{"__ignoreMap":56},[354,355,357],"h3",{"id":356},"the-trick-revealed","The Trick Revealed:",[11,359,360,361,346],{},"The attacker had leveraged a Linux ",[30,362,363],{},"bind mount",[148,365,366,372],{},[27,367,368,369,371],{},"They copied their 292 KB compiled malware to ",[35,370,325],{}," and launched it.",[27,373,374],{},"Once running in memory, they executed:",[48,376,379],{"className":377,"code":378,"language":53},[51],"mount --bind /usr/bin/python2.7 /usr/sbin/python2.7\n",[35,380,378],{"__ignoreMap":56},[148,382,384,408],{"start":383},3,[27,385,386,387,390,391,33,395,397,398,159,401,404,405,301],{},"Because ",[35,388,389],{},"/usr/bin/python2.7"," (the genuine vendor Python binary) was mounted ",[392,393,394],"em",{},"on top of",[35,396,325],{},", any sysadmin running ",[35,399,400],{},"ls -l",[35,402,403],{},"sha256sum",", or file integrity monitors (like AIDE or Tripwire) only saw the ",[30,406,407],{},"legitimate, vendor-signed Python binary",[27,409,410],{},"Meanwhile, the Linux kernel kept the original executable open in RAM under the running PID.",[11,412,413],{},"We immediately unmounted the disguise:",[48,415,418],{"className":416,"code":417,"language":53},[51],"umount -l /usr/sbin/python2.7\nls -la /usr/sbin/python2.7\n# -rwxr-xr-x. 1 root root 292472 Jul 4 20:58 /usr/sbin/python2.7\n",[35,419,417],{"__ignoreMap":56},[11,421,422,425,426,301],{},[30,423,424],{},"The mask came off."," The underlying file wasn’t a 7 KB Python binary at all—it was a ",[30,427,428],{},"292 KB compiled malicious ELF executable",[11,430,431,432,346],{},"We checked Server Beta and found the exact same technique, this time mounting over ",[35,433,434],{},"/usr/lib/qemu-ga",[48,436,439],{"className":437,"code":438,"language":53},[51],"umount -l /usr/lib/qemu-ga\nls -la /usr/lib/qemu-ga\n# -rwxr-xr-x 1 root root 292472 Jul 4 20:38 /usr/lib/qemu-ga\n",[35,440,438],{"__ignoreMap":56},[11,442,443],{},"Both files on both servers produced the exact same cryptographic fingerprint:",[48,445,448],{"className":446,"code":447,"language":53},[51],"SHA256: 120b3b7c013a5f859edbbd60957fa560eaab797a42884b20b2238c8a99458f01\n",[35,449,447],{"__ignoreMap":56},[71,451],{},[74,453,455],{"id":454},"_6-dissecting-the-malware-what-was-it-doing","6. Dissecting the Malware: What Was It Doing?",[11,457,458,459,346],{},"We dumped strings from the memory image ",[35,460,461],{},"/proc/\u003CPID>/exe",[48,463,466],{"className":464,"code":465,"language":53},[51],"CNC-BOT-RATCHET-INIT-V1\nCNC-BOT-SESSION-KEY-V2\nm_bot_lock_instance\nattack_rand_next\n_attack_rand_state\nhttp_get_random_user_agent\nHTTP_USER_AGENTS\nhttp_generate_random_string\nget_attack_mode\ntcp_udp_checksum\nhttp_set_nonblocking\n",[35,467,465],{"__ignoreMap":56},[354,469,471],{"id":470},"analysis-of-malware-capabilities","Analysis of Malware Capabilities:",[24,473,474,484,498,507],{},[27,475,476,479,480,483],{},[30,477,478],{},"Mirai / Mozi Variant:"," Uses ",[35,481,482],{},"CNC-BOT-RATCHET-INIT-V1"," session handshakes with encrypted C2 channels.",[27,485,486,489,490,493,494,497],{},[30,487,488],{},"Raw Socket Forgery:"," Contains ",[35,491,492],{},"tcp_udp_checksum"," and ",[35,495,496],{},"attack_rand_next"," for crafting high-velocity spoofed UDP floods, TCP SYN floods, and ACK floods.",[27,499,500,479,503,506],{},[30,501,502],{},"Layer-7 HTTP Flood Engine:",[35,504,505],{},"http_get_random_user_agent"," to launch application-layer denial-of-service floods against targeted web infrastructure.",[27,508,509,512,513,516],{},[30,510,511],{},"No Exfiltration or Ransomware:"," Crucially, the binary contained ",[30,514,515],{},"no database query routines, no ransomware encryption routines, and no document scrapers",". The attacker’s sole intent was to turn the servers into high-powered “zombies” for their DDoS-for-hire botnet.",[71,518],{},[74,520,522],{"id":521},"_7-the-backdoor-reconstructing-the-intrusion","7. The Backdoor: Reconstructing the Intrusion",[11,524,525],{},"How did the attackers get in?",[11,527,528,529,493,532,535],{},"Checking ",[35,530,531],{},"/etc/passwd",[35,533,534],{},"/etc/sudoers.d/"," revealed an account created during the initial breach:",[48,537,540],{"className":538,"code":539,"language":53},[51],"# /etc/passwd:\nsystemctl:x:1005:1006::/home/systemctl:/bin/bash\n\n# /etc/sudoers.d/systemctl:\nsystemctl ALL=(ALL) NOPASSWD:ALL\n",[35,541,539],{"__ignoreMap":56},[11,543,544,545,548,549,552,553,555,556,559],{},"The attacker had chosen the name ",[35,546,547],{},"systemctl"," so that casual audits of ",[35,550,551],{},"ps"," or ",[35,554,531],{}," would assume it was a standard Linux systemd daemon account. In reality, it was a rogue shell account with full passwordless ",[35,557,558],{},"sudo"," rights.",[11,561,562],{},"Checking the authentication logs revealed the attack vector:",[24,564,565,572,578,584],{},[27,566,567,568,571],{},"Both servers had ",[35,569,570],{},"PasswordAuthentication yes"," enabled on port 22.",[27,573,574,575,84],{},"Authentication logs recorded over ",[30,576,577],{},"76,000 automated password brute-force attempts per week",[27,579,580,581,583],{},"Attackers successfully guessed a password via brute-force, created the ",[35,582,547],{}," user, and planted the bot.",[27,585,586,587,589],{},"Later, the operators logged into the ",[35,588,547],{}," account over SSH, activated the flood engines, and blasted over 107 TB of traffic.",[71,591],{},[74,593,595],{"id":594},"_8-incident-response-hardening-playbook","8. Incident Response & Hardening Playbook",[11,597,598],{},"Here are the concrete steps we took to completely eradicate the threat and secure both servers:",[354,600,602],{"id":601},"step-1-sever-c2-connections-and-terminate-processes","Step 1: Sever C2 Connections and Terminate Processes",[48,604,607],{"className":605,"code":606,"language":53},[51],"# Terminate the malware PID\nkill -9 \u003CPID>\n\n# Block the C2 IP and bot port at the firewall immediately\niptables -I OUTPUT -d 168.220.248.xxx -j DROP\niptables -I INPUT -s 168.220.248.xxx -j DROP\niptables -I OUTPUT -p tcp --dport 24032 -j DROP\n",[35,608,606],{"__ignoreMap":56},[354,610,612],{"id":611},"step-2-unmask-and-delete-the-hidden-binaries","Step 2: Unmask and Delete the Hidden Binaries",[48,614,617],{"className":615,"code":616,"language":53},[51],"# Unmount the stealth bind mounts\numount -l /usr/sbin/python2.7\numount -l /usr/lib/qemu-ga\n\n# Permanently delete the malware files\nrm -f /usr/sbin/python2.7 /usr/lib/qemu-ga /usr/sbin/qemu-g\n",[35,618,616],{"__ignoreMap":56},[354,620,622],{"id":621},"step-3-purge-the-rogue-backdoor-user","Step 3: Purge the Rogue Backdoor User",[48,624,627],{"className":625,"code":626,"language":53},[51],"userdel -r -f systemctl\nrm -f /etc/sudoers.d/systemctl\nsed -i '/systemctl/d' /etc/sudoers.d/* /etc/sudoers\n",[35,628,626],{"__ignoreMap":56},[354,630,632],{"id":631},"step-4-lock-down-ssh-key-only-authentication","Step 4: Lock Down SSH (Key-Only Authentication)",[11,634,635],{},"Password authentication should never be enabled on public-facing production servers.",[11,637,638,639,346],{},"Edit ",[35,640,641],{},"/etc/ssh/sshd_config",[48,643,646],{"className":644,"code":645,"language":53},[51],"PasswordAuthentication no\nChallengeResponseAuthentication no\nPermitRootLogin prohibit-password\nPubkeyAuthentication yes\n",[35,647,645],{"__ignoreMap":56},[11,649,650],{},"Reload the SSH daemon:",[48,652,655],{"className":653,"code":654,"language":53},[51],"systemctl reload sshd || systemctl reload ssh\n",[35,656,654],{"__ignoreMap":56},[354,658,660],{"id":659},"step-5-make-firewall-rules-permanent","Step 5: Make Firewall Rules Permanent",[11,662,663],{},"On CentOS/RHEL (firewalld):",[48,665,668],{"className":666,"code":667,"language":53},[51],"firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" destination address=\"168.220.248.xxx\" drop'\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"168.220.248.xxx\" drop'\nfirewall-cmd --reload\n",[35,669,667],{"__ignoreMap":56},[11,671,672],{},"On Debian/Ubuntu (UFW):",[48,674,677],{"className":675,"code":676,"language":53},[51],"ufw deny out to 168.220.248.xxx\nufw deny from 168.220.248.xxx\nufw reload\n",[35,678,676],{"__ignoreMap":56},[71,680],{},[74,682,684],{"id":683},"_9-key-lessons-for-sysadmins","9. Key Lessons for Sysadmins",[148,686,687,697,712,718],{},[27,688,689,692,693,696],{},[30,690,691],{},"Beware the Bind Mount Evasion:"," If a process is running a binary that cannot be removed or seems to have anomalous memory footprints compared to its disk size, check ",[35,694,695],{},"cat /proc/mounts",". Modern rootkits and botnets increasingly use mount namespaces and bind mounts to mask malicious files under standard operating system paths.",[27,698,699,702,703,705,706,709,710,195],{},[30,700,701],{},"Abstract Sockets Don’t Lie:"," Regular file tools won’t show abstract UNIX sockets. Inspect ",[35,704,273],{}," for ",[35,707,708],{},"@","-prefixed sockets (like ",[35,711,245],{},[27,713,714,717],{},[30,715,716],{},"Never Allow SSH Passwords:"," Even strong passwords can fall to credential stuffing or brute force if exposed to 76,000 attempts weekly. Enforce SSH key authentication globally.",[27,719,720,723],{},[30,721,722],{},"Monitor Outbound Bandwidth Baseline:"," Alert on sustained outbound traffic anomalies before you hit monthly quota limits. A server suddenly pushing gigabit line rates is almost always participating in an active DDoS attack.",[71,725],{},[11,727,728],{},[392,729,730,731,84],{},"Need emergency assistance with a compromised server, malware removal, or infrastructure hardening? Reach out to the ",[732,733,6],"a",{"href":734},"/services/",[354,736,738],{"id":737},"website-hacked-or-dealing-with-malware","Website hacked or dealing with malware?",[11,740,741],{},"Our 24/7 security engineers clean malware, harden servers, and restore uptime in under 2 hours.",[11,743,744],{},[732,745,747],{"href":746},"/wordpress-malware-removal/","Get Emergency Security Help",{"title":56,"searchDepth":749,"depth":749,"links":750},2,[751,752,753,754,756,759,762,763,770],{"id":76,"depth":749,"text":77},{"id":142,"depth":749,"text":143},{"id":187,"depth":749,"text":188},{"id":241,"depth":749,"text":755},"4. The Smoking Gun: @m_bot_lock_instance",{"id":309,"depth":749,"text":310,"children":757},[758],{"id":356,"depth":383,"text":357},{"id":454,"depth":749,"text":455,"children":760},[761],{"id":470,"depth":383,"text":471},{"id":521,"depth":749,"text":522},{"id":594,"depth":749,"text":595,"children":764},[765,766,767,768,769],{"id":601,"depth":383,"text":602},{"id":611,"depth":383,"text":612},{"id":621,"depth":383,"text":622},{"id":631,"depth":383,"text":632},{"id":659,"depth":383,"text":660},{"id":683,"depth":749,"text":684,"children":771},[772],{"id":737,"depth":383,"text":738},"2026-09-28","A real-world incident response post-mortem on how two production cloud servers unknowingly transmitted over 100 Terabytes of DDoS attack traffic, and how a subtle Linux kernel trick kept the malware invisible.","md",null,{},true,"/blog/the-100tb-stealth-botnet-postmortem",{"title":5,"description":774},"https://kloudboy.com/blog/the-100tb-stealth-botnet-postmortem/","blog/the-100tb-stealth-botnet-postmortem",[784,785,786,787,788],"Security","Linux","DDoS","Incident Response","DevOps","d6g2Lgi3qGbZt7jzeHRfP8jBMn1RuTy5A4Cj6LeQCUQ",[791,795,799,803],{"path":792,"title":793,"date":794},"/blog/openlitespeed-vs-nginx-wordpress","OpenLiteSpeed vs Nginx vs Apache: The Ultimate WordPress Benchmark","2024-01-16",{"path":796,"title":797,"date":798},"/blog/wordpress-redirect-hack-fix","WordPress Redirecting to Spam Sites? Here Is the Fix","2024-01-15",{"path":800,"title":801,"date":802},"/blog/data-sovereignty-hosting","Data Sovereignty: Why Indian & GCC Startups Must Host Locally","2024-01-14",{"path":804,"title":805,"date":806},"/blog/remote-work-story","We Ditched the Office Completely — KloudBoy's Remote Work Story","2021-06-01",1792120524812]