It’s unfortunate that Krebs has switched to posting AI slop.

His latest story is entirely fabricated and LLM generated, the phishing kit he advertises does not even actually exist.

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

I guess "predictably" is valid but what actually went wrong? After going through multiple sources I can't tell if the botnet nodes were breaking the protocol on purpose, breaking the protocol on accident, or correct implementations that nevertheless overwhelmed something.

> Why does i2p (per the article) expect state sponsored attacks every February?

Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication

> Where are those forming from, what does the regularity achieve?

At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents.

> How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

How would you identify someone as 'operators of giant botnets' before they identified themselves as 'operators of giant botnets'?

please read https://en.wikipedia.org/wiki/I2P

Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.

Those are some weird-ass visualizations. I can only assume they were AI-generated.

I'll save everyone else a click: AI slop text coupled with the strangest, most pointless visualizations I've ever seen.

Communication between bots use network protocols, it doesn't matter in which language those protocols are implemented.

The official router implementation is Java. i2pd is an alternative written in C++.

Once established communication can transparently be processed through a socks proxy, or integration with SAM or similar https://i2p.net/en/docs/api/samv3/

Computers are so fast it doesn’t matter

Why wouldn't they? There are Discord servers about anything you can imagine and also what you can't or don't want to image. As long as they don't start disrupting their infra Discord couldn't care less.

Also, how would you even go about classifying them as botnet operators?

There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

Ever tried to ban a botnet owner from a service they want to use?

It’s basically impossible. They have money, IPs, identities, anything you could possibly want to evade.

Discord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.

I imagine because banning these things is both whack-a-mole and like finding a needle in a hay stack.

botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.

botnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.