The same Skype ID malware author used to run IoT Botnet and apply for jobs

True to the biggest failure of all time, a malware developer uses the same Skype address to advertise his IoT botnet and also the Skype ID itself to apply for freelance jobs.

Nicknamed DadyL33T, this developer is the man behind DaddyHackingTeam, the home of an upcoming future botnet. It is still in the development phase, but the website has also contained some of the source code of the leaked malware variants over the past few years.

DaddyL33T will not be a real hacker if he does not have an account on HackForums. This account is registered under DaddyPvP and most of his posts are asking for help or introducing their botnet.

Most people who want to be hackers on HackForums are harmless, but DaddyL33T seems to be skilled, at least enough for his botnet to work.

The person behind the hybrid botnet QBot-Gr1n IoT

Researcher at NewSky Security Ankit Anubhav has tracked DaddyL33T's botnet, apparently the modified version of the QBot botnet. On HackForums, DaddyL33T also asked some questions about QBot.

The same Skype ID malware author used to run IoT Botnet and apply for jobs Picture 1
DaddyL33T asks about QBot on HackForum

The researcher said DaddyL33T's botnet uses a binary file that was used during infection from DaddyHackingTeam. Private chat with DaddyL33T via Skype, Anubhav said DaddyL33T admitted his botnet is trying to infect about 300 devices, a very small number compared to other IoT botnets.

The same Skype ID malware author used to run IoT Botnet and apply for jobs Picture 2
Source code on DaddyHackingTeam

When analyzing the QBot model, Anubhav also found many similarities with the malware Gr1n IoT, also used to create IoT botnet. So it seems that DaddyL33t's botnet is just a copy.

DaddyL33T is a 13-year-old boy

This, he admitted in a private conversation with Anubhav. The lack of malware development experience and OpSec is obvious when Anubhav says he found a job application on the freelance job site, where DaddyL33T uses the same Skype address he used to advertise his botnet. In it, he also said that he is 13 years old, just as he confessed to Anubhv.

The same Skype ID malware author used to run IoT Botnet and apply for jobs Picture 3
DaddyL33T's freelance job application

botnet malware

David Pac

Update 23 May 2019

You should read it

May be interested

The Linux subsystem on Windows 10 allows malware to hide without being detected
microsoft has shown how favorably linux has been for nearly three years and this love ultimately cost them.
Billions of devices are affected by the new Bluetooth attack
on tuesday, researchers at armis labs published details of a new attack that they thought could potentially affect all devices that could use bluetooth.
The attacker can pass SKEL Protection on the macOS High Sierra
the new security feature on macos high siera (10.13), named secure kernel extension loading, can be bypassed, allowing downloading of kernel kernel extensions.
Malicious ads dig virtual money right on the browser
the author of the malicious code uses javascript code transmitted via malvertising and digs a lot of digital currency on the user's browser without them knowing.
Ransomware 'Your Windows has been banned' extorting users with a face value of 50 USD Bitcoin
recently, the new version of ransomware 'your windows has been banned' has been reported by many websites and warned that all computers and infected users should remember that this is a scam.
New bank trojan detection on Android Red Alert
network security researchers have discovered a new android banking trojan called red alert 2.0 that has been developed for the past few months and has just been launched.