Overview

The study reconstructed two Gorilla attack paths: C2-coordinated direct bot traffic and early traffic containing spoofed UDP packets and DNS amplification, with about 35% associated with DNS amplification. The paper hypothesizes that this mixture came from centralized infrastructure. Public DStat observations reached almost 13 gigabits per second per concurrent in one case, while about 220 bots in controlled tests were estimated at roughly 7 gigabits per second in the studied configuration. The comparison supports a hybrid model, not an exact capacity total, because vantage points, filtering, sampling, provider scope, and spoofing limit the measurements.

Learning outcomes

Gorilla combined direct bot traffic with centralized spoofed or amplified traffic; distributed endpoints and centralized coordination were not opposites.
About 220 controlled-test bots were estimated at roughly 7 gigabits per second, below some DStat observations above 10 gigabits per second per concurrent.
C2 logs, controlled captures, DStat, and Netflow answer different questions, so no single measurement proves total capacity or botnet size.

Keywords

GorillaDDoSbotnetspoofingamplificationNetflow

The Attack Was Bigger Than the Botnet

For Gorilla, the visible bot fleet was only one part of the attack system. This chapter reconstructs how commands, direct bot traffic, centralized infrastructure, and measurement vantage points fit together, then asks what the platform's impressive firepower figures actually establish. The goal is a safer and more accurate judgment: a small observed bot population can coexist with a powerful service, but no single measurement proves the full size of that service.

Two paths to the victim

The familiar path starts with the C2. A customer-facing request is translated into a command, and the C2 distributes that command to active bots. The bots then generate traffic from their compromised devices and send it toward the victim service. Because the traffic comes from many endpoints, it can consume bandwidth or processing capacity at the target while making the directing actor harder to identify. This is the part of Gorilla that most closely resembles the inherited Mirai model.

The researchers' controlled observations show that Gorilla also used another path. Before the bot command reached their controlled infrastructure, they saw traffic containing DNS amplification and generic UDP packets with spoofed source addresses. About 35% of the packets in that early traffic were associated with DNS amplification. The paper hypothesizes that this mixture came from centralized servers or other centralized infrastructure rather than from the bots observed later. The important architectural distinction is that a server outside the infected-device fleet could contribute traffic that did not look like ordinary packets sent directly by a bot.

A spoofed packet presents a source address that does not identify the machine that sent it. An amplified response is produced when an intermediary turns a smaller request into a larger response directed at the victim. Both ideas matter here because they change what defenders can infer from the traffic. A direct bot path may expose a population of participating devices. A centralized path may hide the sender behind false sources or make the response traffic appear to come from systems that were used as intermediaries. The two paths can serve the same customer request while leaving different traces.

The resulting system is better described as a hybrid service than as a botnet alone:

flowchart TD R["Customer request"] --> C["C2 command"] C --> B["Bot fleet"] C --> H["Centralized attack infrastructure"] B -->|"direct traffic without spoofing"| V["Victim service"] H -->|"spoofed or amplified traffic"| V B -.-> M["Controlled measurement"] V --> D["DStat observation"] V --> N["Netflow lower bound"]

The arrows do not mean that every request always used both paths, or that every observation saw every component. They show the relationships the study was able to reconstruct. The C2 could coordinate a bot fleet and centralized infrastructure, while the victim experienced their combined effect. Controlled measurement could reveal characteristics of bot-generated traffic. DStat services could display traffic arriving at a public measurement endpoint. Netflow could record traffic crossing a participating provider's network. Those observations overlap, but they are not interchangeable.

The distinction between the two attack paths also changes how to think about scale. If an analyst counts only participating bots, they may describe the direct component while missing traffic supplied elsewhere. If they count every apparent source address in a spoofed attack, they may count addresses that do not correspond to actual senders.

Published by DeepMox

FAQ

What is the difference between Gorilla's direct and centralized attack paths?

The direct path sends traffic from C2-controlled bots, while the centralized path can contribute spoofed or amplified traffic outside the observed fleet; both may serve one request.

What does the roughly 220-bot observation prove?

It shows direct bot participation and an estimated roughly 7-gigabit-per-second contribution in that controlled configuration, not the size of Gorilla's entire fleet or total capacity.

Can DStat readings establish Gorilla's total attack capacity?

No. DStat readings show traffic at particular public endpoints and fluctuate, while tests, customer activity, and different vantage points prevent treating them as a stable capacity specification.

Previous8 minGorilla's DDoS Software Evolution

Next10 minGorilla's DDoS Marketplace

Gorilla's Hybrid DDoS Capacity

The Attack Was Bigger Than the Botnet

Two paths to the victim

FAQ