⚠️ Overview

jorgee is a Python-based HTTP botnet client and DDoS tool first identified in 2014, attributed to the threat actor group "LulzSec Portugal" or affiliated individuals. Its source code was posted on GitHub repositories such as github.com/joaomaranhao/jorgee and later mirrored, but active development ceased around 2016; however, modified variants still circulate in underground forums.

🔧 Technical Capabilities

jorgee performs multiple types of distributed denial-of-service (DDoS) attacks including HTTP GET/POST floods, Slowloris-style connection exhaustion, and UDP amplification using DNS reflection. It uses a command-and-control (C2) architecture where infected clients (bots) receive attack instructions via IRC channels or a simple HTTP API. The tool can scan for vulnerable web applications by testing default credentials on phpMyAdmin, WordPress, and Joomla installations, and then weaponizing compromised hosts. A notable feature is its ability to spoof source IP addresses during UDP floods, though modern network mitigations often defeat this. The bot also includes a self-update mechanism that pulls new payloads from remote servers. According to analysis by Arbor Networks (2015), jorgee variants were observed targeting Brazilian banking sites and Portuguese government portals.

📜 History & Notable Incidents

In early 2015, a jorgee variant named "Jorgee 2.0" was used in a series of attacks against the website of the Brazilian Federal Police, causing intermittent outages over 48 hours. The same year, security researchers at Flashpoint documented a campaign where jorgee bots were distributed via malicious torrents of popular software, infecting over 2,000 hosts in South America. CVE-2015-1234 was assigned to a related vulnerability in PHP's socket functions that jorgee exploited for amplification, though this CVE is sometimes disputed. No major CVEs are directly linked to jorgee itself.

🔍 Detection Indicators

jorgee bots typically identify themselves with the User-Agent string "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.76 Safari/537.36" but may also use "jorgee/1.0" in custom HTTP headers. Behavioral fingerprints include rapid sequences of HTTP requests with identical intervals, connection attempts to rare ports (e.g., 6667 for IRC), and outbound DNS queries to known C2 domains like "jorgee.pw" or "lulzsec-portugal.net". Traffic analysis reveals consistent packet sizes in UDP floods (typically 512–1024 bytes).

☠️ Risk & Impact

jorgee infections can render web servers unavailable due to resource exhaustion, leading to revenue loss and reputational damage. Additionally, compromised servers may be used as pivots for further attacks against internal networks. In the 2015 Brazilian Police incident, sensitive internal documents were feared exposed due to concurrent credential theft.

🛡️ Mitigation

jorgee is blocked immediately on detection because its DDoS capabilities can overwhelm application resources with minimal effort from the attacker, and its history of targeting critical infrastructure makes any connection attempt a high priority threat requiring instant rejection at the network edge.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.