What the Attacks Reveal
Gorilla's attack record shows what a rentable service did in practice, but it does not identify every customer or measure every packet the platform could produce. This chapter reads the observed totals, target patterns, repeated commands, and high-profile incidents as evidence about use and consequence. The distinction helps readers judge the service as a campaign-capable system without turning a measurement window into a complete history or a command correlation into an accusation.
A broad attack pattern
The study recorded 740,351 attacks against 146,213 unique IP addresses during its measurement period. Those figures establish the scale of the activity the researchers could observe; they are not a count of every attack Gorilla ever launched. They also describe events grouped from C2 commands rather than a direct census of customers. One customer could issue repeated or concurrent commands, and several commands could belong to one continuing event. The number of attacks is therefore useful as a measure of observed platform activity, but it should not be read as the number of people involved or as a universal property of the service.
The target distribution suggests that Gorilla was used against a wide range of Internet services, with the largest concentration in hosting providers and Internet service providers. The study classified 70,859 unique hosting victims associated with 574,397 attacks, and 68,028 ISP victims associated with 175,008 attacks. Business targets accounted for a smaller share, while education and government targets appeared less often. These categories refer to the type of autonomous system associated with an IP address, so they are a useful proxy rather than a perfect description of the final application being attacked. A hosting provider may contain gaming servers, small businesses, or unrelated services; an IP address alone does not identify the customer's intent.
That qualification matters because Gorilla's attack options had a strong gaming context. The client supported service-specific vectors for platforms such as Discord, TeamSpeak, and FiveM, and the study observed many attacks aimed at gaming-related services. Attack start times also tended to cluster in the evening from the victim's perspective. Together, those patterns support the researchers' hypothesis that gaming activity was an important use case. They do not prove that every evening attack targeted a game, that every target in a hosting network was a gaming service, or that the timing reveals the identity of a customer.
The traffic mix was broader than the gaming examples. Approximately 60% of observed attacks targeted UDP services, 39% targeted TCP services, and 1% used lower-layer methods. UDP and TCP describe different network transport protocols, so this split indicates that the service was not tied to one single traffic behavior. Gorilla also carried attack functionality that targeted specific services or attempted to work around particular mitigations. Yet the most frequently used behavior was a more general volumetric UDP mode, even when specialized choices were available. A long menu did not mean that every option was equally popular or equally effective.
The separation between the menu and the backend complicates interpretation further. The service could show a customer one label while sending a different command to the bots. The paper gives examples in which a requested option mapped to another backend vector, and it reports that those mappings changed as the operators adjusted their strategy.