Tadashi

Executive Summary

Actor named Tadashi operates a Mirai‑derived IoT botnet called xlabs_v1 that delivers DDoS-for-hire services targeting game servers, notably Minecraft hosts. The botnet leverages Android Debug Bridge on port 5555 to compromise millions of vulnerable devices, employs ChaCha20 encryption with weaknesses, and is housed behind a single bulletproof /24 netblock in the Netherlands. Financial gain through paid attack tiers and ancillary cryptojacking infrastructure appears to be the primary motivation.

Goals & Targeting

Strategic objectives of Tadashi appear to be purely financial: monetizing a large-scale IoT botnet through a paid DDoS-for-hire business model. The actor targets high‑value, cost‑sensitive sectors such as online gaming and virtual server hosting where even brief downtime can result in direct monetary loss for service providers and end‑users. Victims are typically small to medium‑sized game server operators or individuals hosting community servers; the choice of target is driven by the availability of exploitable IoT devices and the potential for high billing rates from clients demanding large bandwidth attacks.

Key Capabilities

• Mirai‑derived IoT botnet (xlabs_v1)
• Automated exploitation of Android Debug Bridge over TCP/5555
• Compromise of >4 M Android‑TV and router devices worldwide
• Provision of DDoS-for‑hire services with multiple flood variants
• Bandwidth profiling and tiered pricing model
• ChaCha20 encryption with identified weaknesses in key management
• Competing botnet detection and eradication routines
• Hosting infrastructure within a single bulletproof /24 netblock in the Netherlands
• Cryptojacking capabilities integrated into compromised machines

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

First known activity surfaced via an exposed open directory in the Netherlands; Tadashi has consistently used a single bulletproof netblock, indicating a dedicated command‑and‑control infrastructure. The operation structures DDoS offerings around price-tiered bandwidth provisions and maintains competitor-eradication routines to reduce lateral movement from other botnets. The presence of cryptojacking subsystems suggests revenue diversification: infected devices run lightweight mining scripts after initial payload delivery, creating multiple income streams for the actor.

IOC Patterns

• Open directory listing exposing xlabs_v1 binaries
• Outbound traffic to a /24 netblock in the Netherlands via TCP/5555 (ADB)
• ChaCha20‑encrypted C2 communication to IPs within that netblock
• DDoS traffic signatures targeting Minecraft server ports
• Cryptocurrency mining process named 'miner' on infected devices

Recommended Actions

• Block outbound DNS and HTTP(S) requests to known C2 netblocks identified for Tadashi.
• Implement firewall rules to reject unsolicited traffic to port 5555 (ADB) from external sources.
• Apply hardening guidelines to all Android‑based IoT devices, disabling remote debugging features by default.
• Deploy a DDoS mitigation service or appliance that deflects volumetric floods against game hosting environments.
• Monitor for suspicious cryptojacking signatures and terminate unknown miner processes on corporate endpoints.

Suggested Tags