Flotilla: Anatomy of an Undocumented Cross-Platform Covert-Browser Botnet Delivered Through the GCleaner Channel

vulone.com Threat Research · August 15, 2026 · TLP:AMBER

Summary. This report details the full reverse engineering of "Flotilla", an undocumented, professionally-engineered, Turkish-language malware platform that operates a Windows covert-browser botnet (codenamed browser-fleet) and macOS arm64 agents (warden, pilot), sharing a single epoch-synced control plane and a triple-mirror, signature-verified update pipeline. The platform is delivered through the GCleaner fake-cleaner distribution channel alongside commodity infostealers and a Rust Ethereum token sweeper ("SystemAgent"). All control-plane infrastructure was verified live during analysis; the second-stage packages were pulled from the operator's own mirrors and hash-verified.

1. Executive Summary

Finding	Detail
Platform name	Flotilla (internal module namespace `flotilla/shared`; process names `flotilla-warden`, `flotilla-pilot`)
Windows component	browser-fleet, a covert Electron browser botnet (stage 1 bootstrap + stage 2 full Electron runtime)
macOS components	warden (supervisor), pilot (agent), arm64 Mach-O
Shared modules	`flotilla/shared`: `idgen`, `protocol`, `layout`
Developer	Turkish-speaking (module handle `serhat`; complete Turkish UI corpus in both OS agents)
Control plane	Primary Caddy API on 45.94.31.71 (NL) + Cloudflare Worker fallback, epoch-synced
Update pipeline	3 mirrors (custom CDN, fleet-api, Cloudflare R2) + SHA-256/Authenticode verification
Distribution	GCleaner fake-cleaner loader → AES-256 ZIPs (`infected` password)
Status	Live and active at time of writing

Key reverse-engineering achievements

Full static RE of the Windows stage-1 bootstrap (7556bcc9…): Go string-header walk recovered the entire C2/update/signature config block.
Recovery of the live 153 MB second stage from the operator's mirror, hash-verified against the embedded value.
Full RE of the Electron control-plane JavaScript: hidden-browser botnet with residential-proxy reassignment and surveillance capture.
Discovery of macOS arm64 agents (warden/pilot) via a leaked R2 manifest.json, hash-verified at time of collection, with full protocol extraction.
Enumeration of the live control plane (/health, enrollment/WS API surface), operator domain estate, and cert rotation timeline.

On the name. "Flotilla" is the operator's own term, not a label assigned by this report. It appears in the binaries as the shared module namespace flotilla/shared, the macOS process names flotilla-warden and flotilla-pilot, and the agent configuration variables FLOTILLABRIDGE, FLOTILLARUNTIMEPORT, FLOTILLARUNTIMETOKEN, FLOTILLAMACHINEID, FLOTILLAINSTALLID, FLOTILLATAGS, and FLOTILLA_FINGERPRINT. The naming scheme is nautical and maps onto the architecture: a fleet of individual browser contexts, a pilot steering each agent, a warden supervising them, all under one control plane. No public repository, package, or organisation is implicated by this name; unrelated projects sharing the word "flotilla" have no connection to the platform described here.

2. The GCleaner Distribution Channel

GCleaner (a fake "PC cleaner") distributes its payloads as single-file AES-encrypted ZIPs:

ZIP (Info-ZIP v6.3, UNIX), WinZip AES-256, compression method 99
  └─ <sha256>.exe      (password: "infected")

Across the dropped-by-GCleaner tag (MalwareBazaar reporter: Bitsight), we observed 36 unclassified payloads and 20+ known families in 14 days (RemusStealer, Vidar, Stealc, XWorm, Amadey, HijackLoader, Socks5Systemz), a loader-as-a-service / access-broker pipeline. The payload languages span Go, Rust, .NET, and C/C++, protected with MPRESS, Themida, and Enigma.

MalwareBazaar dropped-by-gcleaner feed showing the Flotilla stage-1 bootstrap 7556bcc9 and the Rust SystemAgent bb4813a5 alongside RemusStealer, Vidar and PureLogsStealer, all reported by Bitsight

The stage-1 bootstrap 7556bcc9047c408e61dd… (2026-08-15 10:11 UTC) and the Rust SystemAgent bb4813a59af9068e960f3… (2026-08-14 11:21 UTC) both appear in the GCleaner feed, confirming the shared distribution channel.

3. Stage 1: The Windows Bootstrap (`7556bcc90…`)

3.1 PE Triage

Machine: 0x8664 (x86-64)   Subsystem: Windows GUI   TimeDateStamp: 0x0
EntryPoint RVA: 0x882a0    ImageBase: 0x140000000
DllCharacteristics: 0x8160  (DYNAMIC_BASE | NX_COMPAT | HIGH_ENTROPY_VA)
Sections: .text XR / .rdata R / .data RW / .pdata R / .xdata R / .idata RW / .reloc R / .symtab R

Go 1.26.5, module path github.com/serhat/browser-fleet. No public repository was found at this path at time of analysis; the path appears to be an arbitrary namespace chosen by the author rather than a reference to a published project.

3.2 Config Recovery via Go String-Header Walk

Go stores globals as {ptr, len} headers in .data pointing into .rdata. We walked the headers at 0x6c73a0 to 0x6c7400:

0x6c73a0  len= 25  "0.4.13-acceptance.2608151"                          // release version
0x6c73b0  len= 94  "https://fleet-api.45-94-31-71.sslip.io,https://browser-fleet-"
                    "control.browser-fleet.workers.dev"                  // splitControlURLs input
0x6c73c0  len=397  "https://downloads.httpstwoline.io/windows/0.4.13-acceptance.2608151/"
                    "browser-fleet-windows-0.4.13-acceptance.2608151.zip,"
                    "https://fleet-api.45-94-31-71.sslip.io/fleet-releases/windows/0.4.13-"
                    "acceptance.2608151/browser-fleet-windows-0.4.13-acceptance.2608151.zip,"
                    "https://pub-81a04d5a14c54ad992904b234bbb390e.r2.dev/windows/0.4.13-"
                    "acceptance.2608151/browser-fleet-windows-0.4.13-acceptance.2608151.zip"
0x6c73d0  len= 64  "881e52f95111b25b93db20d78242422ed7b65b613997d3029618810892ce8484"  // package SHA-256
0x6c73e0  len= 64  "bPbB5kod1/9nd2ydvEYACcjww7vEOgh2ouC3mvuaVwCY4x7DnIJBzhyDGtpi2Ri0"  // Authenticode sig (b64)
0x6c73f0  len= 18  "windows-acceptance"                                  // build flavor

Findings: dual C2 stored as one comma-separated string (split by main.splitControlURLs); triple update mirrors; embedded SHA-256 + Authenticode signature. The update chain verifies each package before applying.

3.3 Capability Inventory (symbol table)

Subsystem	Key symbols
Bootstrap installer	`bootstrap/installer.Flow.Run`, `freshInstallJournal`, `atomicWrite`, rollback
Rescue watchdog	`runRescueWatchdog`, `armRescueForBootstrap`, `prepareRescueRepair`, `rescueBackoffState`
Secure storage	`agent/securestore` (DPAPI `systemProtector.Protect/Unprotect`)
Update loop	`supervisor/update`, `SystemJunction.Swap`, `AuthenticodeVerifier`, `VerifySHA256`
Anti-analysis	`session.GuardInteractive`, `diagnostics.InspectProcessTree`, `cloneProcessWindows`, `bootstrapWindowObservation.js`
Enrollment	`generateEd25519`, `StoreAgentToken`, `Enrollment`
Inventory	`agent/inventory` (CPU, GPU, platform, registry)
Persistence	`supervisor/autostart.EnsureCurrentUser` (registry)

Notable: SESSION_ZERO: agent cannot run as a Windows service; install it in an interactive user session, an anti-sandbox guard refusing Session 0.

4. Stage 2: The Live Windows Covert-Browser Botnet

Downloaded from the operator's mirror:

URL:  https://downloads.httpstwoline.io/windows/0.4.13-acceptance.2608151/browser-fleet-windows-0.4.13-acceptance.2608151.zip
HTTP 200, 153,156,696 bytes
SHA-256: 881e52f95111b25b93db20d78242422ed7b65b613997d3029618810892ce8484   ✔ MATCHES embedded hash

The package (105 files) installs a full Electron browser:

bin/fleet-supervisor.exe       7,276,032  (Go 1.26.5)
bin/fleet-updater.exe          5,281,792  (Go 1.26.5)
versions/.../agent.exe         8,099,840  (Go 1.26.5)
runtime/electron/…             full Electron runtime
runtime/app/*.js               control-plane source (plaintext)
manifest.json                  signed release manifest (all hashes verified)

4.1 Control Protocol (`ipc-server.js`)

Line-delimited JSON over named pipe \\.\pipe\browser-fleet-runtime with {id, action, params} envelope. Full action surface:

Group	Actions
Runtime	`runtime.status`, `runtime.shutdown`
Profiles	`profile.create`, `profile.health`
Proxy	`proxy.reassign`, `proxy.test` (per-profile proxy reassignment, admin-gated)
Contexts	`context.open/navigate/reload/back/forward`, `waitFor`, `setViewport`, `close/closeAll`, `list`
Consent	`context.consent` (accept-all/reject-all), `consent.status`
Windows	`window.show/hide`, `window.moveOffscreen`, `window.setBounds`
Media	`media.status/play/pause/mute/unmute`
Capture	`artifact.screenshot/dom/har/console/video/trace` → `signedPutUrl`

4.2 Stealth Browser Construction

new BrowserWindow({
    width: 1280, height: 800, show: false, skipTaskbar: true, frame: false,
    backgroundColor: "#000000", paintWhenInitiallyHidden: true,
    ...(process.platform === "win32" ? { type: "toolbar" } : {}),   // WS_EX_TOOLWINDOW, no Alt+Tab
    webPreferences: { partition, backgroundThrottling: false, sandbox: true, contextIsolation: true },
});

Every window is hidden, taskbar-excluded, frameless, Alt+Tab-excluded, muted, and rendered even when invisible. AutomaticConsent auto-accepts cookie banners.

4.3 Residential-Proxy Botnet Primitive

partitionFor(profileId) => persist:${profileId}
reassignProxy(id, proxyRules, approval):
    if (!approval.admin) throw "proxy.reassign requires local admin enablement"
    if (!approval.acknowledgeFingerprintRisk) throw "RISK_ACK_REQUIRED"

Each profile is an isolated Electron partition with its own proxy rules, the primitive of a residential-proxy / traffic-laundering botnet.

4.4 Surveillance Capture

const image = await source.capturePage(undefined, { stayHidden: true, stayAwake: true });
if (becameVisible || window.isVisible()) throw new Error("Hidden page became visible during capture");

Screenshots, DOM, HAR, console, video, traces captured from hidden pages, then exfiltrated via signedPutUrl.

5. macOS Agents: "warden" and "pilot"

Discovered via the leaked R2 manifest.json (see §7). Both are Mach-O 64-bit arm64 (Apple Silicon), Go 1.26.5:

Artifact	SHA-256	Size
warden (supervisor)	`56330a04fb6e5cf59ca219f8e6428a7d20b73e6fb9a4d0eb0afffdb6b52ce338`	3.6 MB
pilot (agent)	`5f72ac9685e9147332f84a533d0d7a7a1c89c00145d70d4c7bb842bbaac70d91`	9.8 MB

Availability note (2026-08-15). At the time of publication the public R2 path (pub-81a04d5a14c54ad992904b234bbb390e.r2.dev/fleet-releases/1.0.0/warden) returns HTTP 404, Object not found. The manifest and both binaries were retrieved and hash-verified during the original collection window; the operator appears to have restricted or relocated the macOS train since. The hashes above are published so other researchers can match the artifacts if they surface elsewhere. This section rests on artifacts collected earlier in the analysis window and is not independently re-verifiable at the public path as of publication.

5.1 warden (supervisor)

Modules: internal/supervisor (New, ExecRunner, Runner), shared/layout (DefaultRoot)
Crash watchdog: incRestarts, recordCrash, CrashWindow, ErrQuarantined
Process name: flotilla-warden
Build path leak: /opt/homebrew/Cellar/go/1.26.5 (macOS Homebrew Go toolchain)

5.2 pilot (agent)

Modules: internal/client (New, Backoff, Executor, idempotency guard, reconciler), internal/inventory (Collect, Fingerprint, Sample), internal/runtime (freePort, randToken, decodeBase64, Executor)
Uses coder/websocket, gopsutil/v4 HostID
Local control surface: ws://127.0.0.1:8080/agentcontext, http://127.0.0.1:%d/context/screenshot, /exec, /context/open|navigate|close, /commands
Error codes: UPLOADFAILED, SCREENSHOTFAILED, CAPABILITY_DENIED
Config env: FLOTILLABRIDGE, FLOTILLARUNTIMEPORT, FLOTILLARUNTIMETOKEN, FLOTILLAMACHINEID, FLOTILLAINSTALLID, FLOTILLATAGS, FLOTILLA_FINGERPRINT
Deep inventory: cpu (cores/cacheSize/vendorId/family), gpu, disk (fstype/inodes), ram (hugePages/slab/swap), virtualizationRole/System, kernel, hostname, hardwareFingerprint

5.3 Shared Protocol (`flotilla/shared/protocol`)

Messages: Hello, Welcome, Heartbeat, LastWill, Command, Ack, Result, PolicySet, DesiredContext, RuntimeStatus
Envelope: { id, type, data }
PolicySet: { "epoch": int64, "contexts": [DesiredContext] }

Epoch = fleet policy version pushed to all agents.

6. Turkish Attribution

The complete UI corpus of all components is Turkish. Recovered strings include:

warden: süreç karantinaya alındı (process quarantined), süreç beklenmedik şekilde sonlandı, layout manifest okunamadı, kurulum kökü belirlenemedi, warden başladı/kapandı, süreç çalışıyor, aktif sürüm yok, önce kurulum gerekli.

pilot: protocol zarf çözülemedi (protocol envelope could not be decoded), kimlik belirsizken context açılmaz, gerçek yetenek yürütme aktif, politika context açılamadı, welcome beklenirken, gelen mesaj çözülemedi, bağlantı koptu (connection dropped), bridge bağlantıyı reddetti (bridge refused connection).

browser-fleet (Windows): Kurulum başarıyla tamamlandı, Windows paketi indirildi ve SHA-256 doğrulandı, Etkileşimli Windows oturumu doğrulandı, Agent kimliği Windows DPAPI ile korundu, UYARI: Bu imzasız Windows kabul sürümüdür; yalnız test makinesinde kullanın.

Together with the serhat handle, this identifies a Turkish-speaking developer with high confidence.

7. Infrastructure & Live Exposure

7.1 Control Plane (verified live 2026-08-15)

Node	URL	Status
Primary C2	`fleet-api.45-94-31-71.sslip.io` → 45.94.31.71 (Caddy/Ubuntu, NL "1337 Services GmbH")	`/health` = `{"epoch":73,"mode":"primary"}`
Secondary C2	`browser-fleet-control.browser-fleet.workers.dev` (Cloudflare Worker)	`/health` = epoch 73, `snapshotAt` updating continuously
Update CDN	`downloads.httpstwoline.io` (Cloudflare)	Serves 153 MB package (hash-verified)
Update mirror	`fleet-api.../fleet-releases/`	Same build; rate-limits unauthenticated (~30 MB cap)
R2 bucket	`pub-81a04d5a14c54ad992904b234bbb390e.r2.dev`	Served the leaked `manifest.json` + macOS packages during collection; returns 404 as of publication
R2 storage	`8cc3c447184df35411d936352cd65e13.r2.cloudflarestorage.com`	Auth-required for direct access
Data node	`api.httpstwoline.io` → 207.180.58.24 (US IPXO)	Up; TLS-fingerprint-gated

curl request to the primary C2 health endpoint returning epoch 73, mode primary, service browser-fleet-control

Primary control plane, live. {"epoch":73,"mode":"primary","service":"browser-fleet-control"}

curl request to the Cloudflare Worker fallback returning epoch 73, mode secondary, with a snapshotAt timestamp of 2026-08-15T13:49:28Z

Cloudflare Worker fallback, live and epoch-synced with the primary at the same instant. mode: secondary, epoch: 73, snapshotAt: 2026-08-15T13:49:28.152282624Z, restricted: true. The matching epoch across two independent nodes confirms the shared, actively-maintained control plane described in §5.3.

DNS propagation check for fleet-api.45-94-31-71.sslip.io resolving to 45.94.31.71 across resolvers worldwide

Global DNS resolution for the primary C2 hostname, consistent across public resolvers worldwide.

7.2 Leaked R2 Manifest (macOS train)

{
  "version": "1.0.0",
  "bundles": [
    { "name": "warden", "url": "…/fleet-releases/1.0.0/warden", "sha256": "56330a04…" },
    { "name": "pilot",  "url": "…/fleet-releases/1.0.0/pilot",  "sha256": "5f72ac96…" }
  ]
}

Both artifacts were fetched via the public custom domain (pub-…/1.0.0/{warden,pilot}) and hash-verified during the collection window. See the availability note in §5; the path now returns 404.

7.3 API Surface (enrollment/control, auth-gated)

/            → 401  {"error":{"code":"UNAUTHORIZED","message":"valid API credentials are required"}}
/health      → 200  {"epoch":73,"mode":"primary","service":"browser-fleet-control"}
/enroll      → 404 (primary) / 401 (worker; path exists)
/api/ws      → 404 (primary) / 401 (worker)
/api/ping, /api/metrics, /api/graphql → auth-gated

Worker error: {"ok":false,"data":null,"error":{"code":"UNAUTHORIZED","message":"valid dashboard credentials are required"}}

7.4 Domain Estate & Cert Rotation

Domain	Registered	Registrar	Notes
`httpstwoline.io`	2026-04-20	Cloudflare	Wildcard certs `.httpstwoline.io`, `.downloads.httpstwoline.io`; rotated Apr 20, Jun 18, Aug 11
`niggas-in-europol.com`	2026-05-01	PDR/PublicDomainRegistry	Wildcard cert, Cloudflare NS. Operator-chosen domain, reproduced verbatim for detection accuracy.

Certificate transparency log for httpstwoline.io showing wildcard certificates issued on 2026-04-20, 2026-06-18 and 2026-08-11, plus api.httpstwoline.io issued 2026-08-11

Certificate transparency confirms the three rotation dates and the fresh api.httpstwoline.io certificate issued 2026-08-11, four days before the 0.4.13-acceptance.2608151 release.

WHOIS record for httpstwoline.io showing creation date 2026-04-20, Cloudflare registrar, redacted registrant, Cloudflare nameservers

Domain registered 2026-04-20 through Cloudflare with registrant data redacted, 117 days old at time of analysis.

Timeline: fleet-api C2 cert and api.httpstwoline.io cert both issued 2026-08-11; release 0.4.13-acceptance.2608151 on 2026-08-15, a coordinated fresh deployment.

8. Companion Rust "SystemAgent" Token Sweeper

sha256 bb4813a59af9… / f50e1120cc6c… (identical Rust builds, ring::signature)
Distributed through the same GCleaner channel (see §2 screenshot, 2026-08-14 11:21 UTC)
Queries Etherscan txlist endpoints and sweeps approved tokens via MEV-blocker RPC (rpc.mevblocker.io)
Local control: 127.0.0.1:8888 AUTH-token, Global\SystemAgentSingleInstanceMutex, tunnel via bore.pub:7890

Scope note. The wallet addresses embedded in the binary are published in §11 as static indicators recovered from the sample. On-chain activity for these addresses has not been independently confirmed as operator-controlled drainer activity, and no fund-sweep event is claimed by this report. Researchers should treat the addresses as leads requiring their own on-chain verification rather than as confirmed drainer wallets.

9. GCleaner Channel Commodity Go Stealers

6 additional unclassified Go samples (5c76bc92…, 7a07f4e2…, 8d9a8edd…, cce7a3a4…, d98b123c…, e3e21306…), all built with -trimpath -s -w, obfuscated function names, identical encrypted C2 blob, steal/credit/2fa/login string profiles. Commodity obfuscated Go infostealers, separate from Flotilla but on the same channel.

10. MITRE ATT&CK Mapping

Technique	ID
Boot or Logon Autostart Execution (registry/launchd)	T1547.001
Scheduled Task / Job	T1053
Proxy (residential proxy reassignment)	T1090
Web Session Cookie / Credential harvesting (covert browser)	T1539
Screen Capture	T1113
Process Injection / Hidden windows	T1055 / T1027
Application Layer Protocol: WebSocket (C2)	T1071.001
Encrypted Channel (TLS)	T1573
Data Encoding (base64 artifacts)	T1132.001
Exfiltration Over Web Service (signed PUT)	T1567.002
Virtualization/Sandbox Evasion (Session 0 guard, geo-gate, window inspection)	T1497
Network Denial of Service (potential misuse of botnet)	T1498

11. IOCs

Network

45.94.31.71
207.180.58.24
fleet-api.45-94-31-71.sslip.io
browser-fleet-control.browser-fleet.workers.dev
downloads.httpstwoline.io
api.httpstwoline.io
pub-81a04d5a14c54ad992904b234bbb390e.r2.dev
8cc3c447184df35411d936352cd65e13.r2.cloudflarestorage.com
niggas-in-europol.com
ipgo.at
tchpeagfdkrlay.com
express-package.site
bricoshop.ch
bore.pub

Files, Windows

7556bcc9047c408e61dd0fc1ffb56b3d96f052064f69d0b84fb17dd365baba79   browser-fleet Go bootstrap
881e52f95111b25b93db20d78242422ed7b65b613997d3029618810892ce8484   browser-fleet-windows-0.4.13-acceptance.2608151.zip
74f562090bf6a852414528efa4332792fd2326d3fd2e15e3a2db29d1e5bef3af   fleet-agent.exe
a9396eb50cea5700e33ccb0d1d0912bfb54ff096e24a416566de0435dd0a8046   fleet-supervisor.exe
8425f3585240aa5fb22f9f5a05c35d7409d36bc030a3eb8bd58cb53172ed4b01   fleet-updater.exe
31a0176b7c1a81cf379e55e109c57a56493a4d4a9e9b0d2475a678fd7df234dc   runtime/electron/electron.exe
fae10608b1cf57ee69e610554adb4edfe5c10cadceba5404a66d1679a6f710d8   runtime/app/main.js

Files, macOS (arm64)

56330a04fb6e5cf59ca219f8e6428a7d20b73e6fb9a4d0eb0afffdb6b52ce338   warden (supervisor)
5f72ac9685e9147332f84a533d0d7a7a1c89c00145d70d4c7bb842bbaac70d91   pilot (agent)

Files, Rust SystemAgent

bb4813a59af9068e960f3f77da130729686d7bb442724c2f755f3e00b6f55165
f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702

Crypto (static indicators recovered from sample, see §8 scope note)

0x0d62AE989761a567122Fa02e940F113ae0F32871
0xf29100983e058b709f3d539b0c765937b804ac15

Host

\\.\pipe\browser-fleet-runtime
%LOCALAPPDATA%\BrowserFleet\ (state\profiles.json, state\contexts.json, Partitions\persist:*)
Global\SystemAgent_SingleInstance_Mutex
ws://127.0.0.1:8080/agentcontext
127.0.0.1:8888

12. Detections

YARA and Sigma rules shipped with this report (output/yara/, output/sigma/).

Hunting Queries

DNS:      QueryName contains ".sslip.io" OR "httpstwoline.io" OR "browser-fleet"
          OR endswith "ipgo.at" OR "bore.pub"
Pipe:     \\.\pipe\browser-fleet-runtime
Process:  fleet-supervisor.exe | fleet-updater.exe | agent.exe | flotilla-warden | flotilla-pilot
          electron.exe under %LOCALAPPDATA%\BrowserFleet\runtime
Window:   WS_EX_TOOLWINDOW + skipTaskbar + hidden Electron windows
Network:  WebSocket connections to operator fleet endpoint
Files:    %LOCALAPPDATA%\BrowserFleet\ state\profiles.json, Partitions\ (persist:<id>)
          macOS: LaunchAgent plist + flotilla-warden/pilot processes

13. Assessment

Attribution: Professional Turkish-speaking framework author ("serhat") licensing a covert-browser platform to criminal operators. Not a state-linked APT; the operational style (fake-cleaner distribution, bulletproof hosting) is commodity cybercrime.

Novelty: Undocumented in public threat intelligence at time of writing. Cross-platform (Windows and macOS arm64), epoch-synced control plane, triple-mirror signature-verified update pipeline, residential-proxy covert-browser botnet.

Scale: Bot count cannot be measured via passive probing (behind auth-gated enrollment/WS). Epoch 73 indicates at least 73 policy updates since deployment; the rotation cadence is unknown, so no timeline should be inferred from that number. Live activity confirmed via continuously updating snapshotAt values on the Worker and active mirror serving.

14. Method & Caveats

Static RE only; no samples executed. Behavior inferred from Go symbols, type metadata, embedded JS, and protocol strings.
Stage 2 recovered live from operator mirrors and hash-verified against embedded/manifest values.
The macOS train (§5) was collected and hash-verified during the analysis window; the public R2 path returned 404 at publication and could not be re-verified. Flagged inline.
No on-chain activity is claimed. The wallet addresses in §11 are static strings recovered from the Rust sample and have not been confirmed as active drainer infrastructure.
The WebSocket C2 endpoint is provisioned post-enrollment; live botnet traffic was not observed.
Language attribution identifies developer language (Turkish), not nationality.
All probing was passive (public endpoints, DNS, CT logs). No auth bypass, credential guessing, or C2 compromise was attempted.
Disassembly and symbol-table screenshots are available to vetted researchers on request.

15. Recommendations

Block the update pipeline (highest-impact disruption): Cloudflare abuse report for browser-fleet-control…workers.dev, downloads.httpstwoline.io, the R2 bucket, and the pub-…r2.dev custom domain.
Report to IC3 / FBI / CISA / national CERT, covering the botnet control plane and live update pipeline.
Abuse reports: RIPE / "1337 Services GmbH" (45.94.31.71), IPXO (207.180.58.24), PDR/PublicDomainRegistry.
IOC distribution: ThreatFox, MISP, URLhaus.
Monitor: output/monitor/flotilla-monitor.sh (epoch drift, mirror rotation, manifest changes) running every 30 min.

Prepared by vulone.com Threat Research. TLP:AMBER. Publishable after responsible-disclosure review. All artifacts under output/.

Walless Al Essa, Adem Al Edeb