“Abcbot”, a botnet with its earliest versions dating back to July 2021, has been found in the wild with new capabilities. These features allow it to propagate similar to a worm, which targets Linux systems to launch distributed denial-of-service (DDoS) attacks. Building on a report from Trend Micro released in early October, researchers from Qihoo 360’s Netlab security team analyzed the newest variants observed as recently as October 30th. Netlab researchers explained that the botnet uses weak passwords and recently disclosed vulnerabilities to target databases and webservers running on Linux. After infecting a host, it attempts to target random IP addresses to spread itself further. It then starts a web server to receive commands and checks its command-and-control (C2) server using Tor for updates. Finally, Abcbot waits for a target to perform one of its many DDoS attack functions, which includes HTTP GET, SlowLoris, Hulk, TLS, TCP, UDP, ACE, BandwidthDrain, and GoldenEye. With all of this functionality, the researchers note that it does not seem to be fully mature yet and the authors of this malware may be testing new capabilities in the future as the botnet matures.