HoneyLabs maps 1,001‑IP botnet spanning 64 countries via shared backend servers
HoneyLabs tracked a botnet by correlating the backend servers used to deliver payloads, revealing a single operation of 1,001 IPs across 306 networks in 64 countries linked to eight staging servers sharing TLS/HTTP fingerprints. The campaign exploits an Apache path‑traversal bug (CVE‑2021‑41773) and uses a self‑replicating shell stage, maintaining a steady flow of ~70‑125 active IPs weekly.