CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Apex2

tool · tool:apex2-botnet single-source

Golang-based IoT/Linux/Windows DDoS botnet, a structural evolution of the earlier Apex botnet, delivered via Telnet credential brute-force; supports a Cloudflare-bypass HTTP(S) flood ('cf'), UDP/game/Discord floods, and TLS floods; Linux builds cover arm/arm64/mipsle/ppc64 (Nozomi Networks Labs, 2026-07-06).

Aliases: Apex

Coverage
1
first 2026-07-09 → last 2026-07-09
Latest activity
2026-07-09
Two Golang DDoS botnets, Apex2 and c2c/meow, flood exposed Telnet/SSH Linux and IoT with fake-systemd…
Peak priority
notable
1 notable
Targets
energy
sectors: energy, water, transport
Sources cited
2
2 hosts

Action items (3)

Do-now tasks recorded on the entries about Apex2, newest first. Check the date before acting on an older one.

  • Remove Telnet and SSH management-interface exposure from internet-facing IoT and embedded-Linux devices (the initial-access vector for both families) and eliminate default/weak credentials, both botnets rely entirely on credential brute-force, not exploitation.
    2026-07-09Two Golang DDoS botnets, Apex2 and c2c/meow, flood…
  • Hunt for the c2c/meow persistence and escalation markers: systemd unit files created outside package-manager/config-management workflows (auditd on unit-file writes), a binary at /usr/local/bin/cpufreqd or a 'CPU Frequency Daemon' unit, and processes probing passwordless sudo via 'sudo -n true'.
    2026-07-09Two Golang DDoS botnets, Apex2 and c2c/meow, flood…
  • Alert on outbound plaintext-TCP-carrying-JSON to non-standard ports (the C2 channel) and segment OT-adjacent Linux systems from business-critical networks with restricted outbound connectivity to limit both C2 reach and DDoS participation.
    2026-07-09Two Golang DDoS botnets, Apex2 and c2c/meow, flood…

Defender insights

What each entry about Apex2 tells a defender to do, newest first.

2026-07-09NOTABLETwo Golang DDoS botnets, Apex2 and c2c/meow, flood exposed Telnet/SSH Linux and IoT with fake-systemd persistence and passwordless-sudo escalation

Story timeline

  1. 2026-07-09Nozomi documents two new Golang IoT/Linux DDoS botnets (Apex2, c2c/meow) built for speed and reuse over sophistication
    active-threatsTwo Golang DDoS botnets, Apex2 and c2c/meow, flood exposed Telnet/SSH Linux and IoT with fake-systemd persistence and passwordless-sudo escalation

Hunting pivots

Tags
botnetddosot-ics
ATT&CK techniques (6 across 6 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • PersistenceCreate or Modify System Process: Systemd Service
  • Privilege EscalationCreate or Modify System Process: Systemd Service · Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  • StealthMasquerading: Match Legitimate Resource Name or Location
  • Credential AccessBrute Force
  • Command and ControlIngress Tool Transfer
  • ImpactNetwork Denial of Service

Persistence TA0003

T1543.002Create or Modify System Process: Systemd Service×1

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Privilege Escalation TA0004

T1543.002Create or Modify System Process: Systemd Service×1

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

T1548.003Abuse Elevation Control Mechanism: Sudo and Sudo Caching×1

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Credential Access TA0006

T1110Brute Force×1

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Impact TA0040

T1498Network Denial of Service×1

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-07-09/nozomi-apex2-c2c-meow-golang-iot-linux-ddos-botnets · ATT&CK page ↗

Entries about Apex2 (1)

2026-07-09 · view entry permalink →

NOTABLENATOB2

Nozomi documents two new Golang IoT/Linux DDoS botnets (Apex2, c2c/meow) built for speed and reuse over sophistication

Nozomi Networks Labs' AI-assisted honeypot triage flagged two Golang-based DDoS botnet samples this spring that stand out from the routine volume of Mirai-derived variants: Apex2 and c2c (distributed under the filename "meow") (Nozomi Networks Labs, 2026-07-06). Apex2 is a direct structural evolution of the earlier Apex botnet: infection begins with Telnet connections and credential brute-forcing, followed by download-and-execute of the Golang payload, which registers with its C2 over a plaintext protocol (host OS/architecture) and ships builds for Linux (arm, arm64, mipsle, ppc64) and Windows (386, amd64). Its named flood commands include cf (an HTTP(S) flood specifically tuned to bypass Cloudflare via randomized User-Agent lists and long keep-alive timeouts), udp/pps, discord/game UDP floods, and three TLS-flood variants (tls, tlsplus, tlsplusbypass). c2c/meow is architecturally simpler, a Golang flooder with no built-in propagation (a separate SSH scanner handles brute-forcing and delivery) that authenticates to a hardcoded C2 over plaintext JSON-over-TCP, checks for passwordless sudo (sudo -n true) to self-escalate, then persists by copying itself to /usr/local/bin/cpufreqd and registering a fake systemd unit masquerading as a "CPU Frequency Daemon", supporting ten flood-module types (icmp, dnsudp, udp, http, directhttp, fasthttp, betterhttp, tcp, tcphandshake, dnstcp).

Nozomi's stated point for defenders is that neither family is sophisticated (both lean on commodity Golang tooling, weak/default credentials and exposed Telnet/SSH interfaces rather than novel exploitation) and that the lack of sophistication does not reduce the risk at scale, because the build-and-deploy cycle for such botnets is getting faster. ATT&CK mapping: T1110 Brute Force (Telnet/SSH), T1105 Ingress Tool Transfer, T1548.003 Abuse Elevation Control Mechanism: Sudo (c2c's passwordless-sudo self-escalation), T1543.002 Create or Modify System Process: Systemd Service with T1036.005 Masquerading (the fake cpufreqd unit), and T1498 Network Denial of Service for the flood modules.

It checks whether passwordless sudo is available by running sudo -n true and evaluating the return value. If successful, it relaunches itself with increased privileges, copies to /usr/local/bin/cpufreqd, and creates a fake systemd service named "CPU Frequency Daemon"

In both cases, the emphasis is not on sophistication, but on speed, reuse and scalability.

Nozomi Networks Labs 2026-07-06
threat09 Jul 12:33Zsingle-sourceOpen finding →
Sources: Nozomi Networks Labs · Industrial Cyber

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • industrialcyber.co1 (50%)
  • nozominetworks.com1 (50%)
All cited sources (2)