Botnet Exposed: Hackers Leave Worker Access and Root Passwords Wide Open

Gbhackers •Mayura Kathir • April 14, 2026

Hackers have left a live Twitter/X credential‑stuffing botnet effectively unlocked, exposing its full command‑and‑control stack, worker fleet, and root passwords to anyone who knows where to look. The C2 runs on a Windows Server 2019 instance hosted by Hetzner in Falkenstein, Germany, with RDP, SMB, and WinRM all exposed alongside the Flask panel, indicating a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Credential Stuffing Botnet Exposed with Full Access to Attack Infrastructure A credential stuffing botnet targeting Twitter/X accounts has been discovered fully exposed online, allowing unrestricted access to its command-and-control infrastructure. The botnet, named 'Twitter Checker Master Panel – FULL FIX v2.3', is hosted on a Windows Server 2019 instance in Germany and has left its control panel and worker server credentials publicly accessible without any password protection. This exposure includes root SSH passwords for all 18 worker servers, enabling potential attackers to manipulate the botnet easily. The incident raises significant concerns about the security of user accounts on Twitter/X, as the botnet is actively engaged in credential stuffing attacks. No specific vulnerabilities (CVEs) were mentioned, but the lack of security measures poses a critical risk. The botnet's full operational capabilities are currently available to anyone who knows where to look. As of today, the botnet remains exposed and operational. 2 sources 64

Extracted Entities

Botnet Exposed: Hackers Leave Worker Access and Root Passwords Wide Open

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Platforms (2)