New Georgia Tech Tool Turns Malware Against Itself to Eliminate Botnets

[andyermjuert]

Cyberattacks can disrupt workflows, compromise sensitive client data, and cost companies and governments millions. Among the most damaging threats are botnets—networks of devices infected with malware. A new tool developed at Georgia Tech, called ECHO, automates the malware removal process, saving engineers valuable time and helping organizations avoid costly disruptions.

ECHO works by exploiting a botnet’s own update mechanisms to dismantle it from within, preventing the infected network from rebuilding. The tool is about 75% effective in removing botnets. What once took days or even weeks to fix can now be resolved in minutes. Once a security team detects a breach, they can deploy ECHO, which acts swiftly enough to stop the botnet before it cripples an entire network.

"Understanding malware behavior is typically very difficult and yields little reward for engineers," said Runze Zhang, a Ph.D. student in Georgia Tech’s School of Cybersecurity and Privacy (SCP) and School of Electrical and Computer Engineering. "So we created an automated solution."

The team presented their work, titled "Hitchhiking Vaccine: Enhancing Botnet Remediation With Remote Code Deployment Reuse," at the Network and Distributed System Security (NDSS 2025) Symposium. ECHO’s open-source code is now available on GitHub.

A New Approach to an Old Threat

Botnets have been a cybersecurity issue since the 1980s, and their power has only grown. In 2019, malware called Retadup infected thousands of Windows systems across Latin America. A Czech cybersecurity firm, Avast, working with the French government, managed to dismantle the botnet by reverse-engineering the malware and deploying a "vaccine" to neutralize it. While effective, the process was laborious and difficult to replicate.

Brendan Saltaformaggio, an associate professor at SCP, saw an opportunity to improve this approach.

"It was a great solution but extremely time-consuming," Saltaformaggio said. "Our team realized we could create a systematic, reproducible technique rather than relying on a one-off, painstaking manual process."

https://www.kumander.org/viewtopic.php?t=236
https://www.kumander.org/viewtopic.php?t=237
https://www.kumander.org/viewtopic.php?t=238
https://www.kumander.org/viewtopic.php?t=239
https://www.kumander.org/viewtopic.php?t=240
https://www.kumander.org/viewtopic.php?t=241
https://www.kumander.org/viewtopic.php?t=242
https://www.kumander.org/viewtopic.php?t=243
https://www.kumander.org/viewtopic.php?t=244
https://www.kumander.org/viewtopic.php?t=245
https://www.kumander.org/viewtopic.php?t=246
https://www.kumander.org/viewtopic.php?t=247
https://www.kumander.org/viewtopic.php?t=248
https://www.kumander.org/viewtopic.php?t=249
https://www.kumander.org/viewtopic.php?t=250
https://www.kumander.org/viewtopic.php?t=251
https://www.kumander.org/viewtopic.php?t=252
https://www.kumander.org/viewtopic.php?t=253
https://www.kumander.org/viewtopic.php?t=254
https://www.kumander.org/viewtopic.php?t=255
https://www.kumander.org/viewtopic.php?t=256
https://www.kumander.org/viewtopic.php?t=257
https://www.kumander.org/viewtopic.php?t=258
https://www.kumander.org/viewtopic.php?t=259
https://www.kumander.org/viewtopic.php?t=260
https://www.kumander.org/viewtopic.php?t=261
https://www.kumander.org/viewtopic.php?t=262
https://www.kumander.org/viewtopic.php?t=263
https://www.kumander.org/viewtopic.php?t=264
https://www.kumander.org/viewtopic.php?t=265
https://www.kumander.org/viewtopic.php?t=266
https://www.kumander.org/viewtopic.php?t=267
https://www.kumander.org/viewtopic.php?t=268
https://www.kumander.org/viewtopic.php?t=269
https://www.kumander.org/viewtopic.php?t=270
https://www.kumander.org/viewtopic.php?t=271
https://www.kumander.org/viewtopic.php?t=272
https://www.kumander.org/viewtopic.php?t=273
https://www.kumander.org/viewtopic.php?t=274
https://www.kumander.org/viewtopic.php?t=275
https://www.kumander.org/viewtopic.php?t=279
https://www.kumander.org/viewtopic.php?t=280
https://www.kumander.org/viewtopic.php?t=281
https://www.kumander.org/viewtopic.php?t=282
https://www.kumander.org/viewtopic.php?t=283
https://www.kumander.org/viewtopic.php?t=284
https://www.kumander.org/viewtopic.php?t=285
https://www.kumander.org/viewtopic.php?t=286
https://www.kumander.org/viewtopic.php?t=287
https://www.kumander.org/viewtopic.php?t=288
https://www.kumander.org/viewtopic.php?t=289
https://www.kumander.org/viewtopic.php?t=290
https://www.kumander.org/viewtopic.php?t=291
https://www.kumander.org/viewtopic.php?t=292
https://www.kumander.org/viewtopic.php?t=293
https://www.kumander.org/viewtopic.php?t=294
https://www.kumander.org/viewtopic.php?t=295
https://www.kumander.org/viewtopic.php?t=296
https://www.kumander.org/viewtopic.php?t=297
https://www.kumander.org/viewtopic.php?t=298
https://www.kumander.org/viewtopic.php?t=299
https://www.kumander.org/viewtopic.php?t=300
https://www.kumander.org/viewtopic.php?t=301
https://www.kumander.org/viewtopic.php?t=302
https://www.kumander.org/viewtopic.php?t=303
https://www.kumander.org/viewtopic.php?t=304
https://www.kumander.org/viewtopic.php?t=305
https://www.kumander.org/viewtopic.php?t=306
https://www.kumander.org/viewtopic.php?t=307
https://www.kumander.org/viewtopic.php?t=308
https://www.kumander.org/viewtopic.php?t=309
https://www.kumander.org/viewtopic.php?t=310
https://www.kumander.org/viewtopic.php?t=311
https://www.kumander.org/viewtopic.php?t=312
https://www.kumander.org/viewtopic.php?t=313
https://www.kumander.org/viewtopic.php?t=314
https://www.kumander.org/viewtopic.php?t=315
https://www.kumander.org/viewtopic.php?t=316
https://www.kumander.org/viewtopic.php?t=317
https://www.kumander.org/viewtopic.php?t=318



How ECHO Works

ECHO eliminates malware in three steps. First, it analyzes how the malware deploys its malicious code. Second, it identifies how that deployment mechanism can be repurposed to neutralize the malware. Finally, it builds and tests a custom remediation code that is deployed back into the infected system.

In tests using 702 Android malware samples, ECHO successfully neutralized the malware in 523 cases.

The team hopes ECHO’s capabilities will discourage cybercriminals by making botnet attacks more difficult and less profitable.

"Our lab philosophy is about finding the balance between attackers’ efforts and defenders’ efforts," said Saltaformaggio. "We may never achieve a perfect solution, but we can make attacks so costly and difficult that they are no longer worthwhile."

With tools like ECHO, organizations have a powerful new defense to remove botnets before they inflict serious damage. As malware continues to evolve, researchers at Georgia Tech are evolving their strategies as well—ready to meet the next cyber threat head-on.