Avast Threat Labs published a technical analysis on Avast Threat Labs of DDoSia's evolution from Python to Go and the layered C2 architecture of the NoName057(16) DDoSia project. The Go rewrite (late 2022) delivers approximately eight times the performance of the initial Python implementation — attributed to native compilation and the absence of Python's GIL, which severely limited threaded network code efficiency. The botnet supports Windows, macOS, Linux, and Android across x64 and ARM64 architectures.
Go Bot: GeoIP Preflight, OS Machine UUID Client-Hash, and 20-Thread Attack Execution
On startup, the bot queries nordvpn.com to obtain detailed GeoIP information, then sends a POST to /login including the User-Hash (Bcrypt hash from client_id.txt, format $2a$16$) and a Client-Hash derived from the OS native machine UUID/GUID via an open-source Go MachineID library, suffixed with the current PID. If the bot's IP or ISP is on the blocklist (e.g., Avast ranges), C2 returns HTTP 401 Unauthorized. On success, C2 returns a Unix timestamp token valid for approximately 15 minutes. Each subsequent request must add the constant 0xF to the token before including it as the Time HTTP header, with each C2 response containing a fresh token for the next request. Targets are retrieved via GET /client/get_targets and wrapped in a data key alongside a fresh token. Four attack types are supported: http, http2, nginx_loris, and tcp. Attack execution uses approximately 20 synchronized threads; successful connections (HTTP 200 responses) are counted and reported back to C2 every ~4 minutes via POST /set_attack_count, with target configuration refreshed every ~10 minutes.
C2 Architecture: Central Server + Two Proxies, Port 5001 Internal, Port 80 External
The C2 infrastructure operates as a three-node cluster: one central server (M) and two proxy servers (P1, P2). Bots connect to the proxies over HTTP port 80; proxies forward requests to the central server over port 5001. All three nodes returned identical target configurations in Avast's monitoring. Outages manifest as HTTP 502 Bad Gateway errors from the proxy layer. The most significant observed outage lasted several hours during initial authentication mechanism deployment; subsequent outages were resolved within one hour, suggesting improved operational procedures.
C2 Protection Evolution: Midnight-Rotating DNS Records Then Token Authentication
Two C2 protection mechanisms were observed sequentially. The first (January 28–29, 2023) used temporary DNS records rotated at midnight to non-existent addresses, preventing online monitoring services from recording the valid C2 IP in DNS history. Two builds used this mechanism before it was abandoned — likely due to a measurable drop in claimed attack targets on January 28, indicating user connectivity issues. The second mechanism (March 7, 2023) implemented token-based authentication with IP/ISP blocklisting, preventing researchers from freely downloading target configurations.
Automatic Bot Updater: Hours-Long C2 Recovery Suggests ~7,200-Client Automated Distribution
The most significant finding is evidence of an automatic bot update mechanism. Following observed C2 takedowns, DDoS activity resumed within hours rather than the several-day delay expected for manual updates across the ~7,200 active clients Avast estimated at the time. The rapid return to operation makes manual individual client updates implausible at this scale. The updater mechanism remained under active investigation at publication time, but its existence — inferred from operational continuity — significantly increases DDoSia's resilience to infrastructure disruption compared to a purely manual distribution model.