Chinese Actor SecShow performs extensive global DNS probing operation

TLDR:

• Chinese actor codenamed SecShow conducting massive DNS probing globally since June 2023.
• Rebirth botnet offering DDoS services targeted at the gaming community.

Cybersecurity researchers have identified a Chinese actor, known as SecShow, conducting Domain Name System (DNS) probing on a global scale since at least June 2023. The actor, operating from the China Education and Research Network (CERNET), aims to gather information but the end goal remains unknown. The probes are focused on identifying open DNS resolvers and amplifying queries using CERNET nameservers.

Additionally, a financially motivated threat actor has been found advertising a new botnet service called Rebirth, based on the Mirai malware family, to facilitate DDoS attacks, primarily targeting the gaming community. The botnet offers various price points for its services, focusing on disrupting game servers for financial gain.

The cybersecurity community is monitoring both SecShow and Rebirth activities closely to mitigate any potential threats posed by these actors.