{"id":15608,"date":"2012-04-19T13:30:10","date_gmt":"2012-04-19T20:30:10","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=15608"},"modified":"2025-05-29T03:37:56","modified_gmt":"2025-05-29T10:37:56","slug":"digging-into-the-nitol-ddos-botnet","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/","title":{"rendered":"Digging Into the Nitol DDoS Botnet"},"content":{"rendered":"<p>Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently analyzed a few samples; we offer here the communications protocol and the Trojan\u2019s capabilities.<\/p>\n<p>Most of the samples we encountered were not packed and were very easy to reverse engineer. The Trojan was written in Visual C++ either in a hurry or by an untrained programmer. We found a lot of bugs in the code.<\/p>\n<p>Nitol copies itself to a random filename ******.exe (where every * is a randomized alphabet character) in the Program Files directory. The new file is registered as a service, &#8220;MSUpdqteeee,&#8221; with the display name \u201cMicrosoft Windows Uqdatehwh Service.\u201d<\/p>\n<h2><strong>Bot Activities<\/strong><\/h2>\n<p>After installation, the malware connects to its command server (we found between one and three hardcoded addresses per sample) using a TCP socket and sends a digest of the victim\u2019s computer information.<\/p>\n<p>Both incoming and outgoing packets are 1082 bytes long (including TCP\/IP headers, 1028 bytes of raw data) without regard to the actual size of the data.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=15613\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-15613\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png\" alt=\"\" width=\"300\" height=\"226\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo.png 616w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The transmission to the server can be described by the following structure:<\/p>\n<p>typedef struct _ComputerInfo{<\/p>\n<p style=\"padding-left: 30px;\">DWORD Command; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ Always &#8220;1&#8221; Computer Info.<\/p>\n<p style=\"padding-left: 30px;\">char LocaleLanguage[0x40];<\/p>\n<p style=\"padding-left: 30px;\">char ComputerName[0x80];<\/p>\n<p style=\"padding-left: 30px;\">char WindowsVersion[0x40];<\/p>\n<p style=\"padding-left: 30px;\">char PhysicalMemorySize[0x20];<\/p>\n<p style=\"padding-left: 30px;\">char CPU_Speed[0x20];<\/p>\n<p style=\"padding-left: 30px;\">char Ndis_Version[0x20];<\/p>\n<p>}ComputerInfo;<\/p>\n<p>It appears this information is used mainly to get an\u00a0estimation\u00a0of the botnet&#8217;s power and diversity. The data can be used to decide what type of DDoS tasks to give this specific bot. However, this is not enough information for the server to decide whether\u00a0the bot is running on a virtual machine or is\u00a0being debugged.<\/p>\n<p>After receiving the information, the command server usually returns a command and parameters.<\/p>\n<p>Possible commands:<\/p>\n<p>enum commands{<\/p>\n<p style=\"padding-left: 30px;\">GenericFlood = 2,<\/p>\n<p style=\"padding-left: 30px;\">HTTPFlood = 3,<\/p>\n<p style=\"padding-left: 30px;\">RawDataFlood = 4,<\/p>\n<p style=\"padding-left: 30px;\">StopRunning = 5,<\/p>\n<p style=\"padding-left: 30px;\">UninstallAndDie = 6,<\/p>\n<p style=\"padding-left: 30px;\">DownloadFileFromUrlExecUrl = 16, \u00a0\/\/ ?!?!?!?<\/p>\n<p style=\"padding-left: 30px;\">DownloadFileFromUrlExecFile = 17,<\/p>\n<p style=\"padding-left: 30px;\">UpdateBot = 18,<\/p>\n<p style=\"padding-left: 30px;\">ExecuteIE_NoWindow = 19,<\/p>\n<p style=\"padding-left: 30px;\">ExecuteIE_ShowWindow = 20<\/p>\n<p>}<\/p>\n<p>&nbsp;<\/p>\n<h2><strong>DDos Attacks<\/strong><\/h2>\n<p>In the preceding group of commands, the DDoS functionality is represented by GenericFlood, HTTPFlood, and RawDataFlood.<\/p>\n<p>Each of the flood commands implements several other commands:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=15611\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-15611\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_Flood_Reply-300x76.png\" alt=\"\" width=\"300\" height=\"76\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_Flood_Reply-300x76.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_Flood_Reply.png 617w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Here we have command number 2\u2013GenericFlood\u2013followed by the GenericFloodData structure:<\/p>\n<p>typedef struct _GenericFloodData{<\/p>\n<p style=\"padding-left: 30px;\">char Address[0x80]; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x00<\/p>\n<p style=\"padding-left: 30px;\">DWORD NumberOfMinutesToRun;\u00a0 \/\/ 0x84<\/p>\n<p style=\"padding-left: 30px;\">DWORD NumberOfThreads; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x88<\/p>\n<p style=\"padding-left: 30px;\">DWORD Command; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x8C<\/p>\n<p>}GenericFloodData;<\/p>\n<p>enum GenericFloodCommands<\/p>\n<p>{<\/p>\n<p style=\"padding-left: 30px;\">send_Random_TCP_Data_Every_10_MS = 1,<\/p>\n<p style=\"padding-left: 30px;\">Send_UDP_Packets_Every_20_MS = 2,<\/p>\n<p style=\"padding-left: 30px;\">Send_ICMP_Packet_Sleep_Missing = 3,<\/p>\n<p style=\"padding-left: 30px;\">Open_Socket_Every_500_MS = 4,<\/p>\n<p style=\"padding-left: 30px;\">Send_UDP_Packets_Every_20_MS_Random_Source_Address_On_Server = 9,<\/p>\n<p style=\"padding-left: 30px;\">Send_UDP_Packets_Every_20_MS_Random_Source_Address_On_Server_number_of_threads_plus_20 = 16,<\/p>\n<p style=\"padding-left: 30px;\">Send_UDP_Packets_Every_20_MS_Random_Source_Address_On_Server_number_of_threads_plus_20_no_Passthru = 17,<\/p>\n<p style=\"padding-left: 30px;\">Send_TCP_Packets_Random_Source_Address_On_Server_number_of_threads_plus_20\u00a0 = 18,<\/p>\n<p style=\"padding-left: 30px;\">Send_TCP_Packets_HardCoded_Source_Address_On_Server_number_of_threads_plus_20\u00a0 = 19,<\/p>\n<p style=\"padding-left: 30px;\">Same_As_1_20_More_Threads_If_Client_64_If_Server = 20,<\/p>\n<p style=\"padding-left: 30px;\">Send_UDP_Packets_Every_20_MS_Source_Address_On_Server_number_of_threads_plus_20\u00a0 = 23,<\/p>\n<p style=\"padding-left: 30px;\">Send_TCP_Packets_Every_10_MS_Source_Address_On_Server_number_of_threads_plus_20\u00a0 = 24,<\/p>\n<p style=\"padding-left: 30px;\">Open_Socket_Send_1000_TCP_Packets = 25,<\/p>\n<p style=\"padding-left: 30px;\">Connect_Disconnect_loop = 32,<\/p>\n<p>}<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=15614\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-15614\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/HTTP_Flood-300x114.png\" alt=\"\" width=\"300\" height=\"114\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/HTTP_Flood-300x114.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/HTTP_Flood.png 618w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Next we have command number 3\u2013HTTPFlood\u2013followed by the HTTPFloodData structure:<\/p>\n<p>typedef struct _HTTPFloodData{<\/p>\n<p style=\"padding-left: 30px;\">char Address[0x80]; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x000<\/p>\n<p style=\"padding-left: 30px;\">char Path[0x80]; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x080 \/\/ BUG!!! The second DWORD is also NumberOfMinutesToRun<\/p>\n<p style=\"padding-left: 30px;\">unsigned short Port; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x100<\/p>\n<p style=\"padding-left: 30px;\">unsigned short dummy; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x102<\/p>\n<p style=\"padding-left: 30px;\">DWORD dummy1; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x104<\/p>\n<p style=\"padding-left: 30px;\">DWORD NumberOfThreads; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x108<\/p>\n<p style=\"padding-left: 30px;\">DWORD IsDummyGetRequest;\u00a0\u00a0\u00a0\u00a0 \/\/ 0x10c<\/p>\n<p style=\"padding-left: 30px;\">DWORD dummy2; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x110<\/p>\n<p style=\"padding-left: 30px;\">DWORD Command; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x114<\/p>\n<p>}HTTPFloodData;<\/p>\n<p>enum HTTPFloodCommands<\/p>\n<p>{<\/p>\n<p style=\"padding-left: 30px;\">Get_Image_Every_50_MS = 5,<\/p>\n<p style=\"padding-left: 30px;\">Get_HTML_Every_50_MS_OR_GET_WITH_IE = 6, \u00a0\/\/BUG<\/p>\n<p style=\"padding-left: 30px;\">Get_HTML_Every_10_MS = 7,<\/p>\n<p style=\"padding-left: 30px;\">Get_Image_Every_5_MS = 8<\/p>\n<p>}<\/p>\n<p>None of the samples we ran returned the RawDataFloodData, so we don\u2019t have a recording.<\/p>\n<p>Command number 4\u2013RawDataFlood\u2013should be followed by the RawDataFloodData structure:<\/p>\n<p>typedef struct _RawDataFloodData{<\/p>\n<p style=\"padding-left: 30px;\">char Address[0x80]; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x000<\/p>\n<p style=\"padding-left: 30px;\">char Buf[0x208]; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ 0x080\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ BUG!!! The second DWORD is also NumberOfMinutesToRun<\/p>\n<p style=\"padding-left: 30px;\">DWORD NumberOfThreads;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ 0x288<\/p>\n<p style=\"padding-left: 30px;\">DWORD Command; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ 0x28C<\/p>\n<p>}RawDataFloodData;<\/p>\n<p>RawDataFlood takes two\u00a0possible commands: SendUDPData and SendTCPData. To use\u00a0SendUDPData you need to set the command parameter to 21, else\u00a0SentTCPData will be used. Both commands\u00a0interpret the Buf parameter as a null-terminated string.<\/p>\n<p>We encountered two important bugs:<\/p>\n<ul>\n<li>It looks like the function to stop the attack after a certain amount of minutes was designed to work with the GenericFlood command and only later was also used for the HTTP and RawData floods, so it uses unrelated data as the amount of time to wait in seconds (always using the DWORD at offset 0x84 from the start of the parameters structure).<\/li>\n<li>The function in charge of getting the path to the Internet Explorer executable concatenates the string coming back from the GetWindowsDirectory function (usually c:\\Windows) to \u201c\\Program Files\\Internet Explorer\\iexplore.exe,\u201d which is normally not the path to the IE executable. The problem resides in the HTTPFlood&#8217;s command 6, which performs an infinite loop of running IE from that path.<\/li>\n<\/ul>\n<p>The following recording shows the traffic of the ICMP attack.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=15612\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-15612\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_Flood-300x98.png\" alt=\"\" width=\"300\" height=\"98\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_Flood-300x98.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_Flood-1024x334.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_Flood.png 1255w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The following recording shows the traffic of the UDP attack.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=15610\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-15610\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/UDP_Flood-300x62.png\" alt=\"\" width=\"300\" height=\"62\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/UDP_Flood-300x62.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/UDP_Flood-1024x214.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/UDP_Flood.png 1239w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2><strong>Other Commands<\/strong><\/h2>\n<p>StopRunning: Stops current DDoS attacks<\/p>\n<p>UninstallAndDie: Unregisters the service, runs another process to delete the file, and exits the current process<\/p>\n<p>DownloadFileFromUrlExecUrl: Looks like another bug, downloads a file from a URL to a local temp file, then tries to execute the URL<\/p>\n<p>DownloadFileFromUrlExecFile: Downloads a file from a URL to a local file (random name in %temp% \u201c*****.exe\u201d) and executes the file using WinExec API call<\/p>\n<p>UpdateBot: Downloads a file from a URL to \u201c%temp%\\stf******.exe.\u201d If download succeeds, deletes the service, executes the file, and exits. (The current version is not deleted from the disk.)<\/p>\n<p>ExecuteIE_NoWindow: Executes Internet Explorer with command-line arguments supplied by the server, doesn\u2019t show the IE window<\/p>\n<p>ExecuteIE_ShowWindow: Executes Internet Explorer with command-line arguments supplied by the server, shows the IE window<\/p>\n<h2><strong>Command Servers<\/strong><\/h2>\n<p>We identified the following command server domain names:<\/p>\n<p>zwx5060.3322.org: 121.235.113.52<\/p>\n<p>guangkuo119.3322.org: 125.211.195.29. Targets some diet products hosted on godaddy.com<\/p>\n<p>yezi999.3322.org: 125.211.195.29. Targets some diet products hosted in Hong Kong<\/p>\n<p>kankan902.3322.org: 118.126.16.81<\/p>\n<p>maple110.3322.org: 121.10.24.74<\/p>\n<p>mybaccy.3322.org: 58.221.58.148. Targets a site in China<\/p>\n<p>bcl5736120.3322.org: 121.12.172.67<\/p>\n<p>ylddos.3322.org: 67.215.65.132. This American IP address is registered to opendns.com<\/p>\n<p>xiong97.3322.org: 124.236.128.136<\/p>\n<p>xinxin168.3322.org<\/p>\n<p>sousou123.3322.org<\/p>\n<p>maguss.3322.org<\/p>\n<p>aisini1314.3322.org<\/p>\n<p>fuck0313.6600.org<\/p>\n<p>ksattack.6600.org: 116.255.180.34<\/p>\n<p>fangqi.6600.org<\/p>\n<p>xin9liao.gnway.net<\/p>\n<p>fangqi.7766.org<\/p>\n<p>1.ccddos.net: 182.16.1.42. Hong Kong<\/p>\n<p>rvbwtbeitwjeitv.com: 50.62.3.118. American IP for godaddy.com<\/p>\n<p>rterybrstutnrsbberve.com: 82.165.39.88. German IP for domain registered to a Russian individual<\/p>\n<p>erwbtkidthetcwerc.com: 82.165.39.88<\/p>\n<p>(All the nonspecified IP addresses are in China.)<\/p>\n<p>As we can see, most of the hardcoded domain names are resolved by Chinese dynamic DNS services.<\/p>\n<p>&nbsp;<\/p>\n<p>I would like to thank my colleagues Zheng\u00a0Bu\u00a0and\u00a0Benjamin\u00a0Cruz for their input.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[49,18],"coauthors":[3973],"class_list":["post-15608","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-botnet","tag-network-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Digging Into the Nitol DDoS Botnet | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Digging Into the Nitol DDoS Botnet | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2012-04-19T20:30:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-29T10:37:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo.png\" \/>\n\t<meta property=\"og:image:width\" content=\"616\" \/>\n\t<meta property=\"og:image:height\" content=\"466\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Digging Into the Nitol DDoS Botnet\",\"datePublished\":\"2012-04-19T20:30:10+00:00\",\"dateModified\":\"2025-05-29T10:37:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\"},\"wordCount\":1089,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png\",\"keywords\":[\"botnet\",\"network security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\",\"name\":\"Digging Into the Nitol DDoS Botnet | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png\",\"datePublished\":\"2012-04-19T20:30:10+00:00\",\"dateModified\":\"2025-05-29T10:37:56+00:00\",\"description\":\"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Digging Into the Nitol DDoS Botnet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Digging Into the Nitol DDoS Botnet | McAfee Blog","description":"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Digging Into the Nitol DDoS Botnet | McAfee Blog","og_description":"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2012-04-19T20:30:10+00:00","article_modified_time":"2025-05-29T10:37:56+00:00","og_image":[{"width":616,"height":466,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Digging Into the Nitol DDoS Botnet","datePublished":"2012-04-19T20:30:10+00:00","dateModified":"2025-05-29T10:37:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/"},"wordCount":1089,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png","keywords":["botnet","network security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/","name":"Digging Into the Nitol DDoS Botnet | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png","datePublished":"2012-04-19T20:30:10+00:00","dateModified":"2025-05-29T10:37:56+00:00","description":"Nitol is a distributed denial of service (DDoS) botnet that seems to be small and not widely known. It mostly operates in China. McAfee Labs recently","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/04\/ICMP_ComputerInfo-300x226.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/digging-into-the-nitol-ddos-botnet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Digging Into the Nitol DDoS Botnet"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/15608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=15608"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/15608\/revisions"}],"predecessor-version":[{"id":214718,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/15608\/revisions\/214718"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=15608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=15608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=15608"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=15608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}