Overview
This series explains how Gorilla, a Mirai-based DDoS-for-hire platform observed from late 2024 until its C2 went offline on June 28, 2025, became a comparatively durable service. It follows the inherited architecture, two software phases, centralized propagation, hybrid attack capacity, and customer-facing marketplace that connected engineering to continuity and demand. The observed attacks show practical reach and repeated disruption, while the evidence leaves total capacity, customer identities, and the suspected law-enforcement takedown unconfirmed.
Learning outcomes
- Gorilla's durability came from coordinated software, infrastructure, capacity, and customer-facing changes, not Mirai reuse alone.
- Moving propagation to centralized infrastructure separated fleet growth from attack execution but added concentrated dependencies.
- Observed traffic supported a hybrid model: about 220 controlled-test bots did not explain the strongest platform measurements alone.
- Defenders need visibility and layered mitigation across the bot fleet, central infrastructure, providers, and application paths.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Why did Gorilla last longer than many Mirai-based DDoS services?
Gorilla appears to have lasted longer because its operators combined iterative software changes, separated propagation, hybrid capacity, and customer-facing continuity; the study does not prove that one feature caused the result.
Was Gorilla just a large botnet?
No. The study found evidence that centralized infrastructure supplemented direct bot traffic, although it could not determine the platform's exact total capacity.
How did Gorilla turn botnet capacity into a service?
Gorilla hid C2, propagation, and capacity decisions behind a panel or API, subscriptions, attack options, and concurrency limits, so customers could request an effect without operating the machinery.
What can defenders learn from Gorilla's attacks?
Defenders should monitor multiple boundaries and layer controls across network, provider, and application paths; rate limiting alone cannot protect a link that is saturated upstream.