New NULLZEREPTOOL Uses Telegram to Launch 20 DDoS Methods With Rotating Proxies

NULLZEREPTOOL is a newly uncovered attack framework that turns a Telegram bot into a remote control panel for powerful distributed denial of service campaigns backed by rotating proxy infrastructure.

The framework came to light when a single Pastebin post was flagged during continuous paste‑site monitoring, exposing the full Python source for a Telegram‑managed DDoS and attack bot.

What initially looked like yet another low tier script quickly revealed a more complex design, combining a proven DDoS engine with experimental modules for wireless disruption and credential handling.

That discovery allowed researchers to pivot on the embedded “NULLZEREPTOOL” banner and uncover an earlier variant of the same codebase, showing clear lineage through shared hard coded credentials and identical core logic.

As they dug deeper, analysts from Flare noted that the later variant expands beyond pure flooding, hinting at WiFi deauthentication, Bluetooth jamming, and hierarchical botnet tasking that have not yet been fully exercised in real world attacks.

Flare analysts said in a report shared with Cyber Security News (CSN) that at its core, NULLZEREPTOOL behaves like a Telegram‑controlled DDoS panel rather than a classic self spreading botnet.

The engine supports twenty different attack methods, auto scales worker threads, and rotates proxies to maintain pressure against hardened web applications, similar in spirit to the tactics seen in recent Telegram coordinated DDoS campaigns.

Test runs against sites such as shopmuabancf[.]com and Bloomberg pages produced live statistics for the operator, tracking worker counts and request volumes during each flood.

Under the hood, the later build adds WiFi and Bluetooth attack routines, password extraction paths, and a “BOTNET_HIERARCHY” structure that defines how slave nodes might one day receive tasks and report results.

Flare’s static analysis confirms that these additions are server side only and depend on missing client components and external tools, which suggests the operator is still in a feature testing phase rather than running a mature multi function platform.

For defenders, the broader story is how easily a chat bot, public proxy lists, and simple Flask endpoints can be turned into an agile attack surface.

That shift toward lightweight, chat driven orchestration echoes trends covered in discussions of the new breed of layer 7 attacks and shows why organizations cannot treat Telegram or similar channels as harmless administrative helpers.

The DDoS engine relies on a METHODS dictionary that maps twenty attack names to dedicated worker functions, each running in its own thread and looping through specific flood routines such as HTTP GET, UDP packets, or the mixed “combo” pattern.

The combo_worker is the most aggressive, bundling four HTTP requests, a UDP datagram, and a TCP handshake in a single pass while calculating per worker delays to hit a configured requests per second target.

To sustain those floods, NULLZEREPTOOL implements a multi stage proxy pipeline that harvests free HTTP proxies from seven sources, including api.proxyscrape[.]com, proxylist.geonode[.]com, free‑proxy‑list[.]net, and several GitHub raw lists.

Each proxy is tested against httpbin[.]org/ip with strict timeouts, and only fast responders are written into proxy.txt and kept in an in memory pool for live attacks.

During an attack, get_random_proxy() constantly rotates through that validated pool, retesting entries and removing ones that fail, so the bot keeps sending traffic through healthy endpoints rather than stale or blocked IPs.

The /proxy command in Telegram triggers a full refresh and validation cycle, giving the operator a simple way to rebuild their proxy fleet, which mirrors how attackers described in best DDoS protection tools try to bypass basic IP rate limits with wide, fast changing proxy sets.

NULLZEREPTOOL binds this engine back to Telegram via a hard coded BOT_TOKEN and an ADMIN_ID check that gates commands like /attacks, /proxy, /key, and /cvv behind a /login sequence.

Once logged in, the admin can start floods, adjust worker counts, and receive status updates directly in chat, a control pattern that overlaps with how some operators turn Telegram bots secret backdoor into persistent footholds inside targeted environments.

Flare recommends that security teams watch for mixed HTTP methods with random headers, high volume UDP and TCP bursts to ports 80 and 443, and DNS or NTP amplification traffic hitting resolvers like 8.8.8.8, 1.1.1.1, time.google.com, and pool.ntp.org.

Organizations should also baseline normal application behavior, deploy strong DDoS and layer 7 protections, and be ready to trace floods back through proxy layers, rather than focusing only on single IP addresses.

Emerging Multi‑Function Attack Framework

Beyond flooding, the later NULLZEREPTOOL variant introduces WiFi and Bluetooth attack routines that wrap external tools such as aireplay‑ng, netsh wlan, nmcli, hcxdumptool, hcxpcapngtool, and hashcat.

These modules can deauthenticate clients, read saved WiFi passwords, and attempt dictionary based cracking of captured handshakes, although their success depends heavily on the host environment and available hardware.

The framework also defines a BOTNET_HIERARCHY structure with Flask endpoints like /slave_register, /slave_get_task, and /slave_report, plus Telegram commands to create tasks such as wifi_scan, browser_steal, and full_steal.

In practice, Flare did not find any implemented browser password harvesting logic, and the missing client binary means this architecture exists only in theory today, not as a proven distributed botnet.

Another notable addition is the “Quantum” branded WiFi7QuantumExploit and Bluetooth6QuantumExploit classes, which advertise advanced sounding functions but rely entirely on standard cryptographic primitives such as hashlib.sha3_512, hashlib.pbkdf2_hmac, os.urandom, secrets.token_hex, and struct.pack.

Researchers conclude that the “quantum” label is marketing rather than real technology, a common move in low tier Malware as a Service ecosystems where naming tries to make conventional methods appear cutting edge.

On the data handling side, NULLZEREPTOOL implements a manual CVV logging system backed by a cvv_logs table in c2.db and a key management store that uses single use secrets.token_hex keys to control access.

That license style design signals a commercial mindset where access keys might be sold or shared, and card data stored centrally, raising concerns similar to those discussed in API security guidance about how credential misuse can fuel broader fraud campaigns.

Flare’s report stresses that the most effective defense begins early with continuous monitoring of public paste sites, dark web forums, and Telegram channels so that frameworks like NULLZEREPTOOL are discovered before they reach operational maturity.

Once hard coded bot tokens, admin IDs, C2 endpoints, and proxy sources are identified, they can be fed into detection and blocking systems, helping defenders stay ahead of evolving tools that blend DDoS, wireless attacks, and credential features in a single package.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

! ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposuremalware to businesses an