Darktrace Details Vo1d Botnet Activity and DGA Detection in South Africa
Summary
Darktrace reports a surge in Vo1d botnet activity across customer environments, mainly in South Africa, and describes detecting DGA-generated domains, rare cloud-hosted endpoints, and outbound connections on unusual TCP ports.
Key points
- Vo1d targets smart TVs and low-cost Android TV devices; prior estimates put infections at 1.3–1.6 million devices by early 2025.
- Darktrace observed increased Vo1d-related activity among customers, with most affected environments in South Africa.
- The malware uses DGA-generated domains to find command-and-control infrastructure and can deploy additional payloads, proxy services, and ad fraud operations.
- Darktrace researchers identified a possible second DGA seed, `fc975904fc9`, not reported by OSINT vendors at the time of publication.
- Observed connections included endpoints associated with Amazon ASN 16509 and unusual TCP ports 55520 and 55521.
- Darktrace models flagged unusually frequent DNS requests and connections to rare endpoints; Cyber AI Analyst correlated the activity into an incident.
- The article lists suspected C2 indicators and DGA domains and describes the activity as an established foothold phase.
Article Details
- Attack Vectors
- Vo1d infects smart TVs and low-cost Android TV boxes, embedding components in system storage to download and execute additional modules.
- Vo1d uses a domain generation algorithm (DGA) to create candidate C2 domains, then makes DNS requests and connects to resolved attacker-controlled infrastructure.
- After a generated domain resolves, infected devices establish outbound TCP connections on uncommon high-numbered ports, including 55520 and 55521.
- Vo1d uses cloud-hosted redirectors or C2 nodes; the article reports many connections pointing to AS16509 (AMAZON-02).
- Defensive Notes
- Monitor devices for unusually high volumes of DNS requests to uncommon or algorithmically generated domains.
- Investigate outbound connections to rare endpoints and external TCP ports such as 55520 and 55521.
- Darktrace detected the activity using models for DGA beacons, domain fluxing, unusual external activity, and connections to rare endpoints.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | eusji60b33d7929a[.]com | Listed as a possible Vo1d C2 DGA endpoint. |
| HOSTNAME | g[.]sxim[.]me | Listed as a hostname for likely Vo1d C2 infrastructure. |
| HOSTNAME | ggqrb60b33d7929a[.]com | Listed as a possible Vo1d C2 DGA endpoint. |
| HOSTNAME | qilqxfc975904fc9[.]top | Listed as a possible Vo1d C2 DGA endpoint. |
| HOSTNAME | semhz60b33d7929a[.]com | Listed as a possible Vo1d C2 DGA endpoint. |
| HOSTNAME | snakeers[.]com | Listed as a hostname for likely Vo1d C2 infrastructure. |
| HOSTNAME | uacfc60b33d7929a[.]com | Listed as a possible Vo1d C2 DGA endpoint. |
| IPV4 | 3[.]132[.]75[.]97 | Listed as likely Vo1d C2 infrastructure. |
MITRE ATT&CK
T1071.004 · DNSVo1d makes DNS requests for DGA-generated domains as part of its C2 activity.T1568.001 · Fast Flux DNSThe article maps the activity to fast flux DNS and describes Vo1d operators moving nodes to new IPs within cloud infrastructure.T1568.002 · Domain Generation AlgorithmsVo1d generates candidate C2 domains using a DGA and seeds.T1571 · Non-Standard PortInfected devices connect to attacker-controlled infrastructure over uncommon outbound TCP ports, including 55520 and 55521.
People
Malware
Vendors
Products
Cyber AI AnalystThe continuation of the described activity was identified by Darktrace’s Cyber AI Analyst, which correlated individual events into a broader interconnected incident. It began with the multiple DNS requests for theDarktrace / NETWORKproviding a glimpse on the DGA seed utilized.The activity was detected by multiple models in Darktrace / NETWORK™, which triggered on devices making an unusually large volume of DNS requests for domains uncommon