Malware News Flare reveals NULLZEREPTOOL, a Telegram‑controlled Python DDoS framework with wireless, credential theft, and botnet features added in code.

[Khushal]

Content source

https://flare.io/learn/resources/blog/nullzereptool-telegram-controlled-ddos-multi-function-attack-framework

A single Pastebin post, flagged by Flare’s paste-site monitoring on April 29, 2026, contained the full Python source code for a Telegram-controlled attack framework. That discovery led to a second, earlier variant of the same codebase and a window into the operator’s live Telegram session. What emerged is a tool with a split personality: a proven DDoS engine on one side and a growing list of wireless attack, credential-theft, and botnet features that exist only in code, never observed in use. NULLZEREPTOOL offers a case study of how low-tier Malware-as-a-Service (MaaS) tools evolve, how operators test and market them, and where defenders should focus detection efforts.

NULLZEREPTOOL is a Python-based attack framework controlled via Telegram. Two source variants were observed and analyzed: an earlier variant with a focused DDoS and proxy management feature set, and a later variant that retains all previous functionality while adding WiFi/Bluetooth attack modules, credential extraction, and a hierarchical botnet tasking structure. Both variants share the same hardcoded credentials (bot token, admin ID, password, master key). Static analysis of both source variants confirms a complete server-side implementation. The later variant’s wireless, credential, and botnet additions are implemented in code but absent from any client artifact in the analyzed set.

Inside NULLZEREPTOOL - Flare

NULLZEREPTOOL is a Python-based attack framework controlled via Telegram.

flare.io

Key Findings About NULLZEREPTOOL:

• The same bot token, admin ID, and static credentials appear in both code variants, establishing a direct code lineage between both variants.
• The Telegram-controlled DDoS engine (20 methods, auto-scaling, proxy rotation) is fully implemented in source: worker threads, auto-scaler, watchdog, and proxy pipeline are all present and coded to function as described in the analysis below.
• The later variant adds WiFi discovery, password extraction (/wifipass), cracking (/wificrack), deauthentication (/deauth), Bluetooth disruption (/btdeauth), “Quantum” packet classes (standard crypto only), and a slave tasking hierarchy (BOTNET_HIERARCHY). These wireless and credential-theft features represent an atypical expansion beyond DDoS, aligning with feature creep common in low-tier MaaS tools.
• The Flask‑based botnet API (/register, /get_command, /report) is implemented in both variants, but /listbots returned “no clients connected” – no client code is present in the analysed artifact set.
• The later variant’s wireless attack, credential extraction, and botnet tasking features are implemented in server-side code only. No client binary (client.py) is present in the analyzed artifact set; end-to-end functionality of these features cannot be confirmed from the available source.

 

[Bot]

Assessment

The distinction between implemented code and observed activity is important here. The analysis supports that NULLZEREPTOOL contains a functional Telegram-controlled DDoS component, while the wireless, credential-extraction, and hierarchical botnet features should be treated as capabilities present in source code rather than confirmed operational behavior.

Defensive priorities

• Monitor for unauthorized Python processes, unusual worker-thread activity, proxy-related network connections, and sustained outbound traffic patterns consistent with application-layer or packet-flooding activity.
• Audit Telegram bot usage in environments where it is not required, including outbound connections to Telegram infrastructure and hardcoded or exposed bot credentials.
• Search source repositories, archives, and endpoints for the shared token, administrator identifier, passwords, and master key. Any exposed credentials should be considered compromised and revoked or rotated.
• Review systems for Flask services exposing endpoints such as /register, /get_command, and /report, while confirming that these paths are not part of legitimate software.
• Treat the WiFi, Bluetooth, credential-theft, and botnet functionality as high-risk code requiring isolation and controlled analysis. Static presence alone does not prove that those features were successfully deployed or used.
• Preserve relevant logs, including process creation, DNS, proxy, Telegram API, wireless-interface, and outbound connection records, before removing suspected tooling.

The absence of a client artifact is a meaningful limitation: it prevents confirmation of end-to-end botnet or wireless functionality from the analyzed set. Detection should therefore focus first on the confirmed Telegram-controlled DDoS and management components, while retaining coverage for the additional modules if related client files are later identified.