Tag: botnet
-
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline.Researchers at QiAnXin’s XLab have tracked it since February 2026, and say the real story is not how big it is today, but…
-
Weak Access Controls Leave Enterprise Networks at Risk
Barracuda researchers found that weak credentials and exposed remote services continue to fuel malware, botnet, and credential attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/weak-access-controls-leave-enterprise-networks-at-risk/
-
Weak Access Controls Leave Enterprise Networks at Risk
Barracuda researchers found that weak credentials and exposed remote services continue to fuel malware, botnet, and credential attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/weak-access-controls-leave-enterprise-networks-at-risk/
-
Canada’s spy agency uses threat reduction powers to neutralize foreign botnets
First seen on scworld.com Jump to article: www.scworld.com/brief/canadas-spy-agency-uses-threat-reduction-powers-to-neutralize-foreign-botnets
-
Botnetz AryStinger infiziert tausende Router weltweit
Das neu entdeckte Botnetz AryStinger hat weltweit über 4000 veraltete Router infiziert. Die Malware nutzt die Geräte als Proxys für Cyberangriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/tausende-router-botnetz-arystinger
-
Botnetz AryStinger infiziert tausende Router weltweit
Das neu entdeckte Botnetz AryStinger hat weltweit über 4000 veraltete Router infiziert. Die Malware nutzt die Geräte als Proxys für Cyberangriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/tausende-router-botnetz-arystinger
-
Botnetz AryStinger infiziert tausende Router weltweit
Das neu entdeckte Botnetz AryStinger hat weltweit über 4000 veraltete Router infiziert. Die Malware nutzt die Geräte als Proxys für Cyberangriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/tausende-router-botnetz-arystinger
-
Botnetz AryStinger infiziert tausende Router weltweit
Das neu entdeckte Botnetz AryStinger hat weltweit über 4000 veraltete Router infiziert. Die Malware nutzt die Geräte als Proxys für Cyberangriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/tausende-router-botnetz-arystinger
-
AryStinger Botnet Converts Legacy Routers to Global Proxies
Research Links 4,300 End-of-Life D-Link Routers to Attack Staging. The AryStinger botnet is exploiting decade-old vulnerabilities in outdated and unsupported routers, turning aging devices into a proxy network for scanning targets, hiding threat actor activity and laying the groundwork for future cyberattacks First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/arystinger-botnet-converts-legacy-routers-to-global-proxies-a-32045
-
AryStinger Botnet Converts Legacy Routers to Global Proxies
Research Links 4,300 End-of-Life D-Link Routers to Attack Staging. The AryStinger botnet is exploiting decade-old vulnerabilities in outdated and unsupported routers, turning aging devices into a proxy network for scanning targets, hiding threat actor activity and laying the groundwork for future cyberattacks First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/arystinger-botnet-converts-legacy-routers-to-global-proxies-a-32045
-
âš¡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
It’s Monday again.This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control.The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are…
-
AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity
A newly analyzed botnet family, AryStinger, weaponizes long”‘neglected routers and NAS appliances to build a stealthy reconnaissance and relay infrastructure that helps attackers obscure origin and extend lateral reach. AryStinger leverages decade”‘old vulnerabilities in RTL819X”‘based routers and a more feature”‘rich Go”‘implemented “Standard” branch on NAS devices to perform distributed scanning, intranet discovery, and traffic tunneling…
-
Canada’s Spy Agency Used FirstIts-Kind Warrant to Clean Botnet-Infected Devices
Canada’s spy service got a judge’s permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets.The Federal Court released a public version of the ruling on June 15. It is the first time the Canadian Security Intelligence Service has used its threat reduction warrant powers…
-
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin’s XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising.The distinction matters. AryStinger exists for the stage of an attack…
-
AryStinger botnet infected thousands of D-Link routers worldwide
A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arystinger-botnet-infected-thousands-of-d-link-routers-worldwide/
-
Police raid malware network tied to Russia’s Evil Corp hacker group
An international operation targeted the SocGholish botnet, which has been linked to the Russia-based cybercrime group Evil Corp. First seen on therecord.media Jump to article: therecord.media/socgholish-botnet-disrupted
-
Cybercrime Initial Access Service SocGholish Disrupted
Police Seize Evil Corp-Tied Group’s Servers, Clean Subverted WordPress Sites. Long-running initial access service provider SocGholish, tied to Russian cybercrime stalwart Evil Corp, has been disrupted by law enforcement, which seized 106 botnet servers and cleaned 15,000 legitimate WordPress sites subverted by the group to launch ClickFix attacks pushing malware downloaders. First seen on govinfosecurity.com…
-
Law enforcement disrupts SocGholish botnet and Evil Corp servers
First seen on scworld.com Jump to article: www.scworld.com/brief/law-enforcement-disrupts-socgholish-botnet-and-evil-corp-servers
-
Authorities disrupt Evil Corp’s SocGholish botnet
Cybersecurity firms, researchers and officials took down 106 servers and remediated nearly 15,000 sites that were infected with the malware. First seen on cyberscoop.com Jump to article: cyberscoop.com/socgholish-malware-botnet-takedown-evilcorp/
-
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp
International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish botnet and the Evil Corp Russian cybercrime group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/law-enforcement-nukes-socgholish-malware-from-nearly-15-000-sites/
-
GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations
A notable operational pivot by the GRU-linked intrusion set APT28 (aka Fancy Bear, Sofacy, Forest Blizzard, Pawn Storm) that combines the MooBot botnet and compromised EdgeRouters to enable resilient cyber operations. This shift amplifies APT28’s long-standing focus on NATO, Ukrainian and critical-infrastructure targets by moving key capabilities from traditional cloud VPS and commodity hosting into…
-
JDY Botnet Evolves After KV Takedown, Targets Military Networks
JDY botnet scans SOHO/IoT devices globally to map services and targets, especially US military networks. Lumen’s Black Lotus Labs reported the resurgence of the JDY botnet, a covert reconnaissance network tied to Chinese state-sponsored hacking groups including Volt Typhoon. The network was first spotted in late 2023 as a cluster inside KV-botnet. The U.S. government…
-
China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits
A significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat activity. Once a component of the larger KV-botnet ecosystem, JDY has expanded to more than 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices and now functions as a high-performance, centrally controlled scanner that accelerates vulnerability discovery…
-
JDY botnet expands, enabling rapid exploitation of disclosed vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/jdy-botnet-expands-enabling-rapid-exploitation-of-disclosed-vulnerabilities
-
Digitale Revierkämpfe: Botnetz C0XMO vernichtet rivalisierende Malware
Die neue Gafgyt-Malware-Variante C0XMO attackiert DD-WRT-Router über eine Schwachstelle und eliminiert konkurrierende Schadsoftware auf den Geräten. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/rivalisierende-malware-vernichtet
-
Silent Ransom Group Uses Fast Flux Botnet to Hide Law Firm Leak Sites
Cybersecurity firm Resecurity reports Silent Ransom Group is using a fast flux botnet to hide data leak sites while targeting law firms with theft and vishing. First seen on hackread.com Jump to article: hackread.com/silent-ransom-group-fast-flux-botnet-leak-sites/
-
IoT Botnet C0XMO Adds Competitor-Killing Capability
C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoS attacks. In March 2026, FortiGuard Labs discovered a new variant of the Gafgyt botnet, dubbed C0XMO, which is noticeably more capable than its predecessors. The malware spreads through CVE-2021-27137, a stack buffer overflow in…
-
C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
-
New Gafgyt Variant Targets Linux Systems With Modular Spread Tactics
A new Gafgyt-family botnet, tracked as C0XMO, marks a notable technical shift in IoT malware design: the separation of scanning and propagation into distinct components and multi-architecture payloads that maximize reach across heterogeneous Linux devices. The operator delivered C0XMO by exploiting CVE-2021-27137 a stack buffer overflow in the UPnP SSDP parser of vulnerable DD-WRT firmware…
-
Dutch authorities disrupt massive botnet of 17 million devices
Tags: botnetFirst seen on scworld.com Jump to article: www.scworld.com/brief/dutch-authorities-disrupt-massive-botnet-of-17-million-devices