Top all-time · #2814
360 Netlab Blog
Company blog · blog.netlab.360.comsecurity
360 Netlab Blog is the company blog at blog.netlab.360.com, writing about security. Since 2016, 27 different Hacker News readers have linked it 33 times, most often “An Analysis of Godlua Backdoor”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link 360 Netlab for botnet and malware analysis, such as router botnets, the B1txor20 malware, and SSH honeypot findings. Commenters cite it as a source for these threats.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Network Security Research Lab at 360
Most-linked posts?
- An Analysis of Godlua Backdoor4 people · 4 mentions · first linked 2019-07-02
- B1txor20, a Linux Backdoor Using DNS Tunnel3 people · 3 mentions · first linked 2022-03-16
- A 100k Botnet Turns Home Routers to Email Spammers2 people · 2 mentions · first linked 2018-11-12
- RotaJakiro: A long live secret backdoor with 0 VT detection2 people · 2 mentions · first linked 2021-04-29
- Fbot is now riding the traffic and transportation smart devices2 people · 2 mentions · first linked 2021-03-03
- /2 people · 2 mentions · first linked 2023-02-14
What Hacker News says?
https://blog.netlab.360.com/icnanker-trojan-downloader-shc-e... has: cp -f /usr/bin/chattr /usr/bin/lockr
Comment linking /icnanker-trojan-downloader-shc-en/
on “What You Get After Running an SSH Honeypot for 30 Days”Submitted RotaJakiro: A long live secret backdoor with 0 VT detection as a story · 434 points
HN discussionKey point: >>"kernel maintainers (and maintainers of many other free-software projects) are overworked and do not have the time to properly review every patch that passes through their hands. They are, as a result, forced to rely on the trustworthiness of the developers who submit patches to them. The kernel development process is, arguably, barely sustainable when that trust is well placed; it will not hold togethe…
Comment linking /stealth_rotajakiro_backdoor_en/
on “An Update on the UMN Affair”Submitted MikroTik routers are forwarding owners’ traffic to unknown attackers as a story · 261 points
HN discussionA much better, more thorough analysis, complete with affected router model numbers, graphs, charts, and area affected map are at the source post: https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-tu...
Comment linking /bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/
on “A 100k Botnet Turns Home Routers to Email Spammers”Submitted Blackrota: obfuscated backdoor written in Go as a story · 162 points
HN discussionI mean it's enough to make at the most a few thousand a month selling residential proxy plans on crime forums. Not really significant. There are orders of magnitude larger botnets (some 100k, 400k+ in size) you can read about on https://blog.netlab.360.com/ . Edit: I agree it is important to do takedowns. Qakbot, GameOver Zeus, Emotet, Snake, etc all had actual espionage risk / were cumulatively involved in billions…
Comment linking /
on “FBI confirms it issued remote kill command to blow out Volt Typhoon's botnet”Submitted A 100k Botnet Turns Home Routers to Email Spammers as a story · 159 points
HN discussionClick bait title; link to source: https://blog.netlab.360.com/ongoing-credit-card-data-leak/
Comment linking /ongoing-credit-card-data-leak/
on “Unless you want your payment card data skimmed, avoid these commerce sites”Submitted New Mirai Variant Has a Domain Generation Algorithm as a story · 64 points
HN discussion> Chinese just try to destroy and censor. Worked at a company which hosted presentations, one of their 5 million presentations was critical of China. We received over 10,000 phone calls and close to a million emails in two days, and a sustained 10gbps ddos attack for a week. Do you have any proof it had to do with the presentation? You're treating "China" as if it was one person. > Letting russia and china on the in…
Comment linking /
on “Cloudflare mitigates record-breaking 71M request-per-second DDoS attack”Submitted An Analysis of Godlua Backdoor as a story · 38 points
HN discussionarticle with some indicators[for now] listed. a number of sources seem to agree this is not finished ware, there are some feature stubs in the code. alternatively i would also explore the idea that a full featured ware was not paid for so, the basic user tier is in play, rather than B1txor20 premium. https://blog.netlab.360.com/b1txor20-use-of-dns-tunneling_en... has a nice breakdown of the code
Comment linking /b1txor20-use-of-dns-tunneling_en/
on “B1txor20 Malware Exploiting Log4j Vulnerability”Submitted B1txor20, a Linux Backdoor Using DNS Tunnel as a story · 21 points
HN discussionSubmitted Analysis Report of the Facefish Rootkit as a story · 4 points
HN discussionSubmitted An Analysis of Godlua Backdoor as a story · 3 points
HN discussionSubmitted Home routers are being hijacked by GhostDNS as a story · 3 points
HN discussionSubmitted B1txor20 – DNS-Tunnel Backdoor as a story · 2 points
HN discussionSubmitted Pink, a botnet that competed with the vendor to control infected devices as a story · 2 points
HN discussionSubmitted RotaJakiro, the Linux Version of the OceanLotus as a story · 2 points
HN discussionSubmitted The LeetHozer Botnet as a story · 2 points
HN discussionSubmitted An Analysis of Godlua Backdoor as a story · 2 points
HN discussionSubmitted ZHtrap botnet implements honeypot to facilitate finding more victims as a story · 1 points
HN discussionSubmitted “Z0Miner” Is Exploiting Elasticsearch and Jenkins Vulnerabilities as a story · 1 points
HN discussionSubmitted Fbot Botnet Targets Traffic and Transportation Smart Devices as a story · 1 points
HN discussionSubmitted Fbot is now riding the traffic and transportation smart devices as a story · 1 points
HN discussionSubmitted Necro is going to version 3 and using PyInstaller and DGA as a story · 1 points
HN discussionSubmitted Ghost in Action: The Specter Botnet as a story · 1 points
HN discussionSubmitted New QNAP NAS RCE in the Wild as a story · 1 points
HN discussionSubmitted An Analysis of Godlua Backdoor as a story · 1 points
HN discussion
