A suspected Romanian botnet group known as RUBYCARP has been discovered after more than ten (10) years of activity operating their botnet. They are known to be financially motivated with similarities among their tactics that possibly link them to the Outlaw APT threat group. RUBYCARP specializes in exploiting known vulnerabilities and using brute force attacks to compromise corporate networks and servers. The cybercriminal’s arsenal has been diverse, exploiting vulnerabilities in Laravel applications (CVE-2021-3129), brute-forcing SSH servers, and targeting WordPress sites via credential dumps. The botnet, comprised of over 600 compromised servers, primarily utilizes Perl-based payloads with a significant focus on crypto mining, phishing campaigns, and distributed denial of service (DDoS) attacks. The attackers frequently rotate their infrastructure and have been observed kicking out clients whose connections are not properly configured, additionally blocking the IPs to avoid security analysts attempting to investigate the group’s infrastructure. Of the thirty-nine (39) discovered variants, only eight (8) appeared on VirusTotal, highlighting the groups sophisticated evasion tactics. Along with launching DDoS attacks from infected devices, RUBYCARP uses an array of crypto miners to mine cryptocurrencies like Monero, Ethereum, and Ravencoin at the expense of the victim’s computational resources. Additionally, phishing tactics are used to steal financial information such as credit card data, either by deploying phishing messages directly on compromised servers or sending phishing emails from them. The phishing campaigns have largely been aimed at European targets, including Swiss Bank, Nets Bank, and Bring Logistics. While RUBYCARP isn’t the largest player in the arena of botnets, their stealthiness and operational security is impressive. The group’s activities highlight the persistent threat posed by organized cybercrime groups and the importance of robust cybersecurity measures to protect against such threats.