Cybersecurity researchers have identified a new botnet family called “Gorilla Botnet” that has been particularly active through the month of September. The Botnet issued over 300,000 attack commands targeting over 100 countries, although most of the attacks were directed at the U.S., China, Canada, and Germany. Targets allegedly included universities, governments, telecommunications companies, banks, and the gaming industry. Researchers determined that the Botnet relied heavily on UDP Floods as its preferred method of attack followed by ACK Bypass Flood and VSE Flood methods. The Botnet can carry out many different types of attacks and uses encryption algorithms similar to those employed by the Keksec group to hide key information, suggesting that the attackers behind this campaign could be related to Keksec. Examination of Gorilla Botnet’s source code indicates that it appears to be a variant of the leaked Mirai Botnet. The Botnet infection supports multiple CPU architectures, connects with one of five predefined command-and-control (C2) servers, and embeds functions to exploit a security flaw in Apache Hadoop YARN RPC to achieve remote code execution. The Botnet maintains persistence by creating a service file named “custom.service” within the “/etc/systemd/system/” directory which is configured to run automatically at system start up. This service downloads a shell script “lol.sh” from remote server “pen[.]gorillafirewall[.]su” to the “/tmp/” directory, sets execution permissions, and executes the script. Denial of Service attacks continue to be one of the most prevalent cybersecurity threats. CTIX analysts recommend that organizations implement controls to mitigate the risk posed by DOS attacks. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.