Analysts observed attackers exploiting a Jenkins honeypot to deploy a new DDoS botnet targeting video game servers. Leveraging Jenkins scriptText abuse, the threat actors achieved remote code execution by sending malicious Groovy scripts to intentionally misconfigured instances with weak passwords. The multi-platform payload targets both Windows and Linux systems, deploying malware that evades detection through process renaming and daemonization. The botnet supports multiple attack vectors including UDP floods, TCP attacks, HTTP requests, and game-specific techniques targeting Valve Source Eng
This intelligence was reported by AlienVault OTX on 2026-05-11. The activity is associated with the following threat categories: source engine, honeypot analysis, vietnam infrastructure, game servers, win_sys.exe, opportunistic attacks.
Threats of this type affect organisations that rely on internet-facing infrastructure, cloud services, or employee-facing authentication systems. The window between public disclosure and active exploitation in production environments has narrowed significantly. Security teams that wait more than 48 hours to review new campaigns routinely find themselves responding to incidents that were preventable.
Knowing your organisation's attack surface is the first line of defence. You cannot protect assets you have not mapped.
Organisations running internet-facing services in financial services, critical infrastructure, and enterprise software are the primary targets in campaigns of this type. The techniques involved are not industry-specific. Any organisation with exposed authentication endpoints or unmonitored external assets is a viable target. The threat categories here (source engine, honeypot analysis, vietnam infrastructure, game servers, win_sys.exe, opportunistic attacks) are among the most active in the current landscape.
If you are investigating whether your environment may be affected, the following indicators of compromise have been identified:
45.148.10.212103.177.110.20294.154.172.43CVE-2025-329751fc0a876a121882ffaad6677f444cf5bea690c3acfa6592c601e4b5dd6122805063bac53Start with the indicators of compromise above. Run them against your endpoint detection tools, firewall logs, and SIEM. If you find a match, isolate the affected system immediately before taking further action. No matches does not confirm you are unaffected: it means the known indicators were not found. Behavioural analysis and threat hunting are the next steps.
Close exposed services that should not be publicly reachable, rotate credentials that may have been compromised, and enforce MFA on all external-facing authentication. These steps take hours, not weeks, and reduce exposure across a wide range of active campaigns.
Yes. The threat categories involved (source engine, honeypot analysis, vietnam infrastructure, game servers, win_sys.exe, opportunistic attacks) are general-purpose techniques reused across industries. Any organisation that has not reviewed its defences against these specific categories in the past 90 days should treat this as a prompt to do so.
Campaigns that are new today are actively exploiting vulnerable organisations within 24 to 72 hours of public disclosure. Weekly reviews are the minimum. Automated monitoring that surfaces new campaigns in real time gives your team the lead time needed to act before exploitation begins.
