Tracking Diicot: An Emerging Romanian Threat Actor
Cado researchers (now part of Darktrace) identified a campaign by the threat actor Diicot, focusing on SSH brute-forcing and cryptojacking. Diicot utilizes custom tools, modified packers, and Discord for C2, and has expanded its capabilities to include doxxing and DDoS attacks via a Mirai-based botnet.