NULLZEREPTOOL DDoS Bot Uses Telegram, Proxies to Launch 20 Attack Methods

Key Takeaways

• A new attack framework, NULLZEREPTOOL, transforms a Telegram bot into a sophisticated control panel for DDoS attacks.
• The tool employs rotating proxy infrastructure and supports twenty distinct attack methods to target web applications.
• Initial analysis reveals experimental modules for Wi-Fi deauthentication, Bluetooth jamming, and credential handling, though these are not fully operational in real-world attacks yet.
• The framework was discovered through continuous monitoring of paste sites, highlighting the importance of proactive threat intelligence.

Telegram-Controlled DDoS Framework Emerges with Multi-Function Ambitions

A recently identified attack framework, dubbed NULLZEREPTOOL, is leveraging Telegram bots as command-and-control (C2) infrastructure to orchestrate powerful distributed denial-of-service (DDoS) campaigns. This framework distinguishes itself by integrating a robust DDoS engine with dynamic proxy rotation capabilities, aiming to overwhelm targeted web applications.

The existence of NULLZEREPTOOL came to light following the detection of a Pastebin post containing the full Python source code for a Telegram-managed DDoS and attack bot during routine paste-site monitoring. Initially appearing to be a basic script, further investigation revealed a more intricate design, combining a potent DDoS engine with nascent modules for wireless disruption and credential manipulation.

Researchers were able to trace the lineage of this framework by identifying an embedded “NULLZEREPTOOL” banner, which led them to an earlier version of the codebase. This earlier variant exhibited shared hardcoded credentials and identical core logic, confirming its direct relation to the newly discovered iteration.

Flare analysts said in a report that the later variant of NULLZEREPTOOL extends beyond mere flooding techniques, incorporating features for Wi-Fi deauthentication, Bluetooth jamming, and a hierarchical botnet tasking system. However, these advanced functionalities have not yet been observed in active attacks, suggesting they are still under development.

Advanced DDoS Capabilities and Proxy Management

At its core, NULLZEREPTOOL functions as a Telegram-controlled DDoS panel, rather than a traditional self-propagating botnet, according to Flare’s analysis. The engine is capable of executing twenty different attack methods, automatically scales worker threads, and employs rotating proxies to maintain sustained pressure against resilient web applications. This operational approach is reminiscent of tactics observed in recent Telegram-coordinated DDoS campaigns.

During testing, the framework generated live statistics for operators, monitoring worker counts and request volumes against targets such as shopmuabancf[.]com and Bloomberg pages.

The newer build of NULLZEREPTOOL incorporates Wi-Fi and Bluetooth attack routines, pathways for password extraction, and a “BOTNET_HIERARCHY” structure. This hierarchy is designed to define how subordinate nodes might eventually receive tasks and report results. However, Flare’s static analysis indicates that these additions are currently server-side only, relying on absent client components and external tools. This suggests the framework is in an experimental phase rather than operating as a fully mature, multi-functional platform.

The broader implications for cybersecurity defenders lie in the ease with which a simple chat bot, readily available proxy lists, and basic Flask endpoints can be transformed into an agile attack surface. This shift towards lightweight, chat-driven orchestration mirrors trends in sophisticated Layer 7 attacks, underscoring the need for organizations to recognize that platforms like Telegram are not benign administrative tools.

Technical Deep Dive into Attack Methods

The DDoS engine within NULLZEREPTOOL utilizes a “METHODS” dictionary that maps twenty distinct attack names to dedicated worker functions. Each function operates in its own thread, executing specific flood routines such as HTTP GET requests, UDP packets, or a complex “combo” pattern. The “combo_worker” is particularly aggressive, bundling four HTTP requests, a UDP datagram, and a TCP handshake in a single pass, while dynamically adjusting per-worker delays to meet a configured requests-per-second target.

To sustain these floods, NULLZEREPTOOL employs a multi-stage proxy pipeline. It harvests free HTTP proxies from seven sources, including prominent providers like api.proxyscrape[.]com, proxylist.geonode[.]com, and free-proxy-list[.]net, along with several GitHub raw lists. Each harvested proxy undergoes rigorous testing against httpbin[.]org/ip with strict timeouts. Only fast-responding proxies are stored in a local “proxy.txt” file and maintained in an in-memory pool for live attacks.

During an active attack, the get_random_proxy() function continuously rotates through this validated pool, retesting entries and removing any that fail. This ensures that the bot consistently channels traffic through healthy endpoints, circumventing stale or blocked IP addresses. The /proxy command in Telegram allows the operator to trigger a full refresh and validation cycle, providing a straightforward mechanism to rebuild their proxy fleet. This mirrors tactics used by attackers to bypass basic IP rate limits with extensive and rapidly changing proxy sets.

NULLZEREPTOOL integrates its engine with Telegram through a hardcoded BOT_TOKEN and an ADMIN_ID check. This authentication mechanism gates commands such as /attacks, /proxy, /key, and /cvv behind a /login sequence. Once authenticated, the administrator can initiate floods, modify worker counts, and receive real-time status updates directly within the chat interface. This control pattern overlaps with how some operators utilize Telegram bots to establish persistent backdoors in targeted environments.

Flare advises security teams to monitor for mixed HTTP methods accompanied by random headers, high-volume UDP and TCP bursts directed at ports 80 and 443, and DNS or NTP amplification traffic targeting public resolvers like 8.8.8.8, 1.1.1.1, time.google.com, and pool.ntp.org. Organizations should also establish baselines for normal application behavior, deploy robust DDoS and Layer 7 protections, and be prepared to trace floods through multiple proxy layers rather than solely focusing on individual IP addresses.

Emerging Multi-Function Attack Framework

Beyond its DDoS capabilities, the later variant of NULLZEREPTOOL introduces Wi-Fi and Bluetooth attack routines. These modules wrap external tools like aireplay-ng, netsh wlan, nmcli, hcxdumptool, hcxpcapngtool, and hashcat. The functionalities include deauthenticating clients, reading saved Wi-Fi passwords, and attempting dictionary-based cracking of captured handshakes. The success of these features is highly dependent on the host environment and available hardware.

The framework also defines a BOTNET_HIERARCHY structure, incorporating Flask endpoints such as /slave_register, /slave_get_task, and /slave_report, alongside Telegram commands for creating tasks like wifi_scan, browser_steal, and full_steal. However, Flare’s investigation found no implemented browser password harvesting logic, and the absence of a client binary means this architectural design remains theoretical, not a proven distributed botnet in practice.

A notable addition is the “Quantum” branded WiFi7QuantumExploit and Bluetooth6QuantumExploit classes. Despite their advanced-sounding names, these classes rely entirely on standard cryptographic primitives such as hashlib.sha3_512, hashlib.pbkdf2_hmac, os.urandom, secrets.token_hex, and struct.pack. Researchers concluded that the “quantum” label serves as marketing rather than reflecting genuine technological advancement, a common practice in low-tier Malware-as-a-Service ecosystems where conventional methods are rebranded to appear cutting-edge.

Regarding data handling, NULLZEREPTOOL includes a manual CVV logging system, utilizing a cvv_logs table in c2.db, and a key management store that employs single-use secrets.token_hex keys for access control. This license-style design suggests a commercial intent, where access keys might be sold or shared, and card data centrally stored. This raises concerns similar to those addressed in API security guidance regarding how credential misuse can fuel broader fraud campaigns.

Flare’s report emphasizes that effective defense begins with proactive, continuous monitoring of public paste sites, dark web forums, and Telegram channels. This vigilance allows for the early detection of frameworks like NULLZEREPTOOL before they achieve operational maturity. Once hardcoded bot tokens, admin IDs, C2 endpoints, and proxy sources are identified, they can be integrated into detection and blocking systems, enabling defenders to stay ahead of evolving tools that combine DDoS, wireless attacks, and credential-harvesting capabilities within a single package.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement continuous monitoring of public paste sites, dark web forums, and Telegram channels for early detection of emerging threats like NULLZEREPTOOL.
• Establish baseline network and application behavior to quickly identify anomalies indicative of DDoS attacks, including mixed HTTP methods, high-volume UDP/TCP bursts, and DNS/NTP amplification.
• Deploy robust DDoS mitigation solutions and Layer 7 protections capable of identifying and blocking sophisticated attack vectors that utilize rotating proxies.
• Ensure your security infrastructure can trace and analyze attack traffic through multiple proxy layers, rather than solely relying on single IP address blocking.
• Integrate identified IoCs (bot tokens, admin IDs, C2 endpoints, proxy sources) into your security information and event management (SIEM) and threat intelligence platforms for enhanced detection and blocking capabilities.
• Educate security teams on the evolving threat landscape, particularly the use of chat-based platforms for command and control, and the potential for multi-functional attack frameworks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.