tokens: The attackers initially injected a malicious user-defined function Downloader.Chikdos into servers in order to compromise them with the Trojan.Chikdos.A DDoS malware According to Symantec telemetry, the majority of the compromised servers are in India, followed by China, Brazil and the Netherlands.