In March 2026, U.S. authorities and international partners disrupted a cluster of record-breaking IoT botnets, including successors to the infrastructure that Nosviak pioneered. Technical Characteristics

Uses string encryption to hinder security analysis and evade detection.

Systems running Nosviak2 often share SSH keys, domains, and branding, suggesting a broader "DDoS-as-a-service" ecosystem.

Nosviak2 operates as a centralized management hub for various botnet families, including and Qbot . It utilizes a MySQL database to manage client data and automation.

Nosviak-derived botnets have compromised tens of thousands of devices globally.

Supports multiple communication protocols to maintain persistent connections with infected "bots".

Analysis of samples and GitHub repositories indicates key functional components: Description

Some variants utilize (non-ICANN domains) to bypass standard DNS takedown attempts. Censys-Research/Nosviak2 - GitHub