T1498: Network Denial of Service (Coordinated DDoS attacks)
Operational Executive Summary
T1498 (Network Denial of Service (Coordinated DDoS attacks)) is classified under the Impact tactic within the MITRE ATT&CK framework. Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 51 distinct malware families, totaling over 8,161 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Network Denial of Service (Coordinated DDoS attacks) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Network Denial of Service (Coordinated DDoS attacks), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1498 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Network Denial of Service (Coordinated DDoS attacks) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1498/.
Detection Engineering & Threat Hunting
Detecting Network Denial of Service (Coordinated DDoS attacks) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1498 (Network Denial of Service (Coordinated DDoS attacks)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Network Denial of Service (Coordinated DDoS attacks) across adjacent network segments.
Cataloged Malware Families Utilizing T1498 (51 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1498 (Network Denial of Service (Coordinated DDoS attacks)):
51 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| lethic | Spam Bot | 4,879 | Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eas... |
| wabot | Rat | 1,185 | Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for co... |
| ircbot | Rat | 348 | Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentra... |
| kasidet | Pos Malware | 294 | Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet ... |
| hosts | Trojan Generic | 267 | BrowserModifier:Win32/Hosts (or simply 'Hosts file hijacker') is a generic heuristic detection for malware or adware that maliciously modifies the Windows HOSTS... |
| rodecap | Trojan | 165 | Rodecap (cataloged by security vendors as Trojan:Win32/Rodecap.A, Trojan.Win32.Rodecap, TrojanDownloader:Win32/Rodecap, and Adware:Win64/Redcap) is an infamous ... |
| benjamin | Worm | 153 | Benjamin (cataloged across antivirus vendors as Worm:Win32/Benjamin.A, W32.Benjamin.Worm, and P2P-Worm.Win32.Benjamin) is an infamous legacy peer-to-peer (P2P) ... |
| ngrbot | Worm | 110 | NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-pr... |
| rbot | Backdoor | 109 | Rbot (widely cataloged across vendor telemetry as Backdoor:Win32/Rbot, W32.Spybot, Worm:Win32/Rbot, and RxBot) is one of the most prolific and historically sign... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| cutwail | Botnet | 92 | Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam... |
| mydoom | Worm | 88 | Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fas... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| neurevt | Trojan | 68 | Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Troja... |
| stormattack | Trojan | 62 | StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttac... |
| papras | Infostealer | 15 | Papras (classified across cybersecurity vendors as Trojan:Win32/Papras, PWS:Win32/Papras, and Trojan-PSW.Win32.Papras) is a modular password stealer and banking... |
| attack | Hacktool | 14 | Attack (classified across antimalware research as Trojan:Win32/Attack and HackTool:Win32/Attack) is a modular post-exploitation attack framework and lateral mov... |
| dnschanger | Trojan | 11 | DNSChanger is one of the largest and most commercially damaging malware operations in internet history, first detected in 2007. Operated by Estonian cybercrimin... |
| dial | Ransomware | 10 | Dialer:Win32/Dial (or generic **Dialer** heuristics) represents a historical, highly prevalent class of malware from the dial-up internet era (late 90s to early... |
| mirc | Trojan | 10 | HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the... |
| spybot | Advanced Threat | 10 | Worm:Win32/Spybot (not to be confused with the legitimate 'Spybot Search & Destroy' utility) is an extremely famous, historic IRC-based worm and botnet agent th... |
| aspxor | Trojan | 9 | Aspxor (classified in antivirus detection telemetry under designations including Trojan:Win32/Aspxor, Trojan.Win32.Aspxor, and Win32/Aspxor) is a multi-stage tr... |
| yoddos | Trojan | 9 | Trojan:Win32/Yoddos (also known as the **Yoddos Botnet**) is a significant malware family specifically engineered to compromise endpoints and recruit them into ... |
| agobot | Backdoor | 7 | Agobot (classified in antivirus detection telemetry under designations including Backdoor:Win32/Agobot, Backdoor.Win32.Agobot, and Win32/Agobot) is a interactiv... |
| egroupdial | Advanced Threat | 7 | Dialer:Win32/Egroupdial represents a legacy classification of malware that was highly prevalent during the era of dial-up internet modems. It is designed to com... |
| hostspatcher | Trojan | 6 | Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary fu... |
| ircnite | Trojan | 4 | Backdoor:Win32/Ircnite (often associated with older, legacy botnets) is a trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC... |
| autofixerpro | Adware | 3 | Autofixerpro (classified in antivirus detection telemetry under designations including Adware:Win32/Autofixerpro, Adware.Win32.Autofixerpro, and Win32/Autofixer... |
| fakesmoke | Trojan | 3 | Trojan:Win32/Fakesmoke is a form of **Rogue Security Software** (often called Fake AV or Scareware). It masquerades as a legitimate, high-end antivirus program,... |
| krepper | Trojan | 3 | Worm:Win32/Krepper is a highly virulent, self-replicating network worm designed to spread rapidly across vulnerable corporate environments. Unlike a trojan that... |
| pcmega | Trojan | 3 | Adware:Win32/Pcmega (often branded as PCMega Optimizer) is a form of **Rogue Security Software** (Fake AV or Scareware). It masquerades as a legitimate, high-en... |
| vanbot | Trojan | 3 | Backdoor:Win32/Vanbot (derived from the Agobot/Spybot family) is a legacy trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC... |
| fakeinstaller | Trojan | 2 | Trojan:AndroidOS/Fakeinstaller is a massive, historically significant classification for a family of Android mobile malware designed to commit SMS Toll Fraud. T... |
| ircfast | Trojan | 2 | Worm/Trojan:Win32/Ircfast is a network worm and botnet agent that leverages the Internet Relay Chat (IRC) protocol for command and control. Prevalent during the... |
| napolar | Trojan | 2 | Trojan:Win32/Napolar (also widely tracked as Solarbot) is a highly sophisticated banking trojan and botnet client that gained prominence around 2013. It is desi... |
| wootbot | Advanced Threat | 2 | Worm:Win32/Wootbot (also known as W32.Wootbot) is a classic, historically significant network worm and IRC botnet agent that was highly prevalent in the mid-200... |
| amnesia | Ransomware | 1 | Amnesia (classified in antivirus detection telemetry under designations including Ransom:Win32/Amnesia, Ransom.Win32.Amnesia, and Win32/Amnesia) is a crypto-ran... |
| bototer | Trojan | 1 | Bototer (classified in antivirus detection telemetry under designations including Trojan:Win32/Bototer, Trojan.Win32.Bototer, and Win32/Bototer) is a multi-stag... |
| emudbot | Ransomware | 1 | <h3>Executive Summary</h3> Emudbot is a persistent trojan designed to recruit infected endpoints into a distributed botnet architecture. Once a machine is compr... |
| kraken | Ransomware | 1 | <h3>Executive Summary</h3> Kraken is a notorious, highly sophisticated Botnet and Trojan malware family. At its peak in 2008, it was considered one of the large... |
| kranet | Trojan | 1 | <h3>Executive Summary</h3> Kranet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into ... |
| mytob | Backdoor | 1 | <h3>Executive Summary</h3> Mytob is a highly prolific and historically significant mass-mailing worm and botnet agent that first emerged in the mid-2000s. Based... |
| peed | Advanced Threat | 1 | <h3>Executive Summary</h3> Peed (also widely known as the Storm Worm or Peacomm) was one of the most prolific and sophisticated botnets of the late 2000s. Origi... |
| proteus | Ransomware | 1 | <h3>Executive Summary</h3> Proteus represents a sophisticated, multi-purpose Botnet and Trojan framework designed to subjugate infected Windows systems. Once a ... |
| storm | Botnet | 1 | Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infe... |
| tobor | Trojan | 1 | <h3>Executive Summary</h3> Tobor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into a... |
| tron | Ransomware | 1 | <h3>Executive Summary</h3> Tron is a sophisticated Botnet and Trojan framework designed to subjugate infected Windows systems. Once a machine is compromised, Tr... |
| urcs | Ransomware | 1 | <h3>Executive Summary</h3> URCS (often associated with the URC Bot) is a sophisticated Remote Access Trojan (RAT) and Botnet framework engineered to provide att... |
| zdowbot | Trojan | 1 | <h3>Executive Summary</h3> Zdowbot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into... |
| zoldon | Ransomware | 1 | <h3>Executive Summary</h3> Zoldon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the infected machi... |
| blasterx | Worm | Sampled | BlasterX is a variant of the notorious Blaster worm that caused widespread disruption on the internet in the early 2000s. Operating as a network worm, BlasterX ... |