Researchers at Fortinet have recently identified new samples of the “RapperBot” malware in a campaign launching distributed denial-of-service (DDoS) attacks against game servers. This campaign is similar to an older campaign beginning in February 2022 and “mysteriously disappeared in the middle of April.” The new RapperBot samples were first identified in August 2022 and are known to “exclusively brute-force SSH servers configured to accept password authentication.” The newest samples have the capability to perform Telnet brute-forcing as well as supporting denial-of-service (DoS) attacks. This is done by using the Generic Routing Encapsulation (GRE) tunneling protocol as well as by using UDP floods to target game servers. This is facilitated by hard-coding lists of default IoT credentials in plaintext which are embedded within the Telnet brute-forcing code binary. This is a new technique, as the previous campaign was storing and retrieving the credential lists from a command-and-control (C2) server. If executed properly, the threat actor will successfully authenticate on the target device, prompting the malware to send the correct credentials back to an actor-controlled C2 and installing the RapperBot payload on the exploited device. An interesting development is the targeted nature of the malware, designed to only attack devices running on “ARM, MIPS, PowerPC, SH4, and SPARC architectures, and halt its self-propagation mechanism should they be running on Intel chipsets.” Although it has not been officially attributed, it is likely that both of these campaigns are being operated by the same threat actor. CTIX analysts will monitor this campaign and provide updates on the threat actor when definite attribution is available.