Team IT Security - 📰 Alle Kategorien

ESET takes part in Operation Endgame to disrupt Amadey and Stealc

Sat, 25 Jul 2026 19:04:30 +0200

ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights

Defending Against China-Nexus Covert Networks of Compromised Devices

Sat, 25 Jul 2026 09:10:14 +0200

Defending against china-nexus covert networks of compromised devices

executive summary

Defending against China-nexus covert networks of compromised devices

Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it

Summary

With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners:

Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)
Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
Germany Federal Office for the Protection of the Constitution - Bundesamt für Verfassungsschutz (BfV)
Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)
Germany Federal Office for Information Security - Bundesamt für Sicherheit in der Informationstechnik (BSI)
Japan National Cybersecurity Office (NCO) - 国家サイバー統括室
Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)
Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)
New Zealand National Cyber Security Centre (NCSC-NZ)
Spain National Cryptologic Centre – Centro Criptológico Nacional (CCN)
Sweden National Cyber Security Centre - Nationellt cybersäkerhetscenter (NCSC-SE)
United States Cybersecurity and Infrastructure Security Agency (CISA)
United States Department of Defense Cyber Crime Center (DC3)
United States Federal Bureau of Investigation (FBI)
United States National Security Agency (NSA)

Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity.

Introduction

Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices.

The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter “covert networks”), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices.

Anyone who is a target of China-nexus cyber actors may be impacted by the use of covert networks. They have been used by Chinese state-sponsored actors Volt Typhoon to pre-position offensive cyber capabilities on critical national infrastructure. The group Flax Typhoon used a different covert network of compromised infrastructure to conduct cyber espionage.

The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.

This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.

Covert Networks

Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity.

There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also assessed by the FBI to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon.

Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks – NCSC Director of Operations, Paul Chichester

Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices. The KV Botnet used by Volt Typhoon was mainly made up of vulnerable Cisco and NetGear routers. The edge devices were vulnerable because they were “end of life” – out of date and no longer receiving updates or security patches by their manufacturers.

The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a public blog in May 2024 talking about covert networks in which they highlighted a key issue for defenders – indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use.

Typical Network Topology

The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network.

Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date – and for most network defenders would not be practically useful.

However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it.

A diagram illustrating the basic setup of a covert network.

The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target.

Protective Advice

Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.

The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices.

Further guidance for all organizations facing cyber security threats is available on the NCSC website.

This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization’s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.

All organizations

The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them:

Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.
Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.
- Would you expect connections from consumer broadband ranges?
Leverage available dynamic threat feeds which include covert network infrastructure.
Implement multifactor authentication for remote connections.

Smaller organizations should consider creating and actioning a free NCSC Cyber Action Toolkit.

Larger or more at-risk organizations

Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:

Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.
Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.
Implement zero trust policies for connections.
Enforce machine certificates for Secure Sockets Layer (SSL) connections.
Reduce the internet-facing presence of the IT estate.
Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies.

The NCSC's Cyber Essentials can help protect organizations of all sizes.

Largest or most at-risk organizations

If Advanced Persistent Threat (APT) tracking is part of an organization’s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.

Active hunting – look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.
Track and map covert networks reported by industry or government by looking at banners and certificates.
Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.
Consider using NetFlow feeds to look upstream and map covert networks to find new nodes.

The NCSC Cyber Assessment Framework provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government. 

MITRE ATT&CK®

This advisory has been compiled with respect to the MITRE ATT&CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

Tactic	ID	Technique	Procedure
Resource Development	T1584.005	Compromise Infrastructure: Botnet	Botnets are used as core components of covert networks
Resource Development	T1584.008	Compromise Infrastructure: Network Devices	Devices are compromised and added to botnets
Resource Development	T1583.003	Acquire Infrastructure: Virtual Private Server	Virtual private servers (VPS) are used in covert networks, typically as on-ramps
Command and Control	T1090.003	Proxy: Multi-hop Proxy	Used by China-nexus cyber actors to route traffic

Appendix: Cyber Security Best Practices

In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory.

Protect your devices and networks by keeping them up to date: use the latest supported versions, apply security updates promptly, use antivirus and scan regularly to guard against known malware threats. See NCSC Guidance: https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software
Prevent and detect lateral movement in your organization’s networks. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement
Implement architectural controls for network segregation. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/10-steps-network-security
Set up a security monitoring capability so you are collecting the data that will be needed to analyze network intrusions. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes and https://www.ncsc.gov.uk/information/logging-made-easy
Use modern systems and software. These have better security built-in. If you cannot move off out-of-date platforms and applications straight away, there are short term steps you can take to improve your position. See NCSC Guidance: https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products
Restrict intruders' ability to move freely around your systems and networks. Pay particular attention to potentially vulnerable entry points such as third-party systems with onward access to your core network. During an incident, disable remote access from third-party systems until you are sure they are clean. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement and https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security.
Deploy a host-based intrusion detection system. A variety of products are available, free and paid-for, to suit different needs and budgets.
Further information: Invest in preventing malware-based attacks across various scenarios. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks

Disclaimer

This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about NCSC assured services.

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.

Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk.

Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers

Thu, 23 Jul 2026 13:44:42 +0200

Hackers are abusing compromised GitHub repositories and GitHub Actions workflows to build a de facto global botnet that scans and exploits web hosting servers, with a primary focus on cPanel and WHM deployments. The campaign first surfaced when malicious development…

The post Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers appeared first on IT Security News.

Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers

Thu, 23 Jul 2026 13:27:00 +0200

The post Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

German law enforcement claims to have ‘dismantled’ mega phishing-as-a-service group Kratos

Thu, 23 Jul 2026 01:57:56 +0200

A global law enforcement crackdown has seized infrastructure serving the massive phishing-as-a-service (PhaaS) group Kratos, as well resulting in the arrest of an unnamed Kratos “developer and technical administrator” in Indonesia.

The effort was managed by German law enforcement and involved agencies from the US, Indonesia and other countries.

Although a German statement claimed that the Kratos infrastructure “has been completely disabled” and that “Kratos-supported phishing campaigns can no longer be carried out,” cybersecurity analysts and consultants question how much of a dent in enterprise phishing activity will result, and how long it will last.

“A server seizure and a single arrest overseas remove infrastructure, not the intellectual property,” said Frank Dickson, group VP for security at IDC. “PhaaS kits get cloned, forked and resold routinely, and the 1,800 Kratos customers didn’t vanish. They just lost a vendor in a market where vendors get replaced fast.”

He added, “seizing 200-plus servers and arresting the developer pulls a major supplier out of that specific niche. It doesn’t touch the broader phishing economy. For every roach that you squish, there are a hundred that you do not see.”

Noah Kenney, principal consultant at Digital 520, takes an even more pessimistic view, arguing that there might not even be that much of a short-term phishing slowdown.

“What makes this different from a botnet or ransomware takedown is that the people running the attacks were never part of the organization. Kratos was just a vendor,” Kenney said. “The 1,800 customers who bought it still have their target lists, their sending infrastructure and whatever access they had already established. The tooling went dark, but the people phishing your employees last week are still working, shopping for a replacement that already exists. Enterprises should not read this as a drop in (likely) threat volume.”

One thing that the security community seems to agree on is that Kratos was a major player in the lucrative PhaaS space. But precisely determining the percentage of PhaaS activity controlled by Kratos is impossible, given that Kratos sold their kits to others. Security researchers even disagree on what they should call Kratos kits.

“Microsoft tracks this kit as SneakyLog, others tie it to Sneaky 2FA, and KnowBe4 disputes the lineage entirely. When the security industry cannot agree on what a kit is to be called, that is because renaming and reselling is continuous rather than something that happens after a raid,” Kenney said. “What actually changed this time is the arrest and the [shutdown of the] servers. Standing up new hosting is only a weekend of work, but replacing a developer who understood how to keep an adversary in the middle proxy stable and evasive at scale is harder.”

IDC’s Dickson added that the biggest value from the takedown is in the information gleaned from the seized servers.

“Kratos operated in the adversary-in-the-middle category, generating convincing fake Microsoft 365 login pages that harvest session tokens and step past MFA, the exact technique behind a lot of the business email compromise activity of the past two years,” he said. “I would love to see what law enforcement does with the customer list. That, my friend, is gold.”

Regardless, Assaf Morag, a cybersecurity researcher at Flare, dubbed the German crackdown “symbolic,” given Kratos’ reach within phishing circles.

He argued that the very nature of software makes it all but impossible to shut down in a meaningful way.

“Although this is malicious infrastructure, it is still software, and modern development and deployment practices make it relatively quick to rebuild or replicate,” he said. “Demand is likely to shift to competing providers, allowing the ecosystem to recover even if this particular operation has been disrupted.”

Pieter Arntz, malware intelligence researcher at Malwarebytes, agreed that the crackdown is disruptive but not definitive.

“This appears to be more than a routine website seizure. The reporting points to a PhaaS platform with centralized infrastructure, subscription-style customers, and Microsoft 365 session theft / MFA-bypass tooling, so taking down the backend likely hurts many downstream affiliates at once. In that sense, it is a meaningful disruption to the phishing ecosystem, not just one campaign,” Arntz said.

But, he added, “a rebrand or partial re-emergence is plausible, which is the historical pattern for PhaaS operations. Even if the core infrastructure is gone, the code, customer lists, and operator tradecraft can survive.”

This means that customers and affiliates can shift to other phishing kits, he said, so it’s likely that the takedown will create a temporary decline in Kratos-specific activity, but probably not a lasting reduction in phishing overall.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, also concluded that the impact of this crackdown will be short-lived.

“For each criminal organization that is dismantled, ten new ones pop out of nowhere. Unless there is a coordinated international effort by more than a few countries, this is a whack-a-mole exercise,” he said. “These are all loosely connected individuals and akin to a lernaean hydra, with two heads growing whenever you chop off one. Their leadership emerges from their lines organically without a real center of control. This makes it almost impossible to completely eliminate these criminal organizations.”

New Attack Framework Harvests WiFi Passwords and Launches Network Flooding Attacks

Wed, 22 Jul 2026 09:27:28 +0200

A newly uncovered Telegram-controlled attack framework, dubbed NULLZEREPTOOL, combines a functional DDoS engine with code for WiFi password extraction, wireless disruption, proxy rotation, and botnet tasking. Researchers found the Python source in a Pastebin post flagged on April 29, 2026, then identified an earlier version sharing the same hardcoded Telegram bot token, administrator ID, and […]

The post New Attack Framework Harvests WiFi Passwords and Launches Network Flooding Attacks appeared first on Cyber Security News.

New Release: UFONet v2.0 - "R3DST4R!"...

Tue, 21 Jul 2026 08:08:43 +0200

Posted by psy on Jul 20

Hi Community,

I am glad to present a new release of this tool:

- https://ufonet.03c8.net

---------

"UFONet is a free software, P2P and cryptographic -disruptive toolkit-
that allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP)
through the exploitation of Open Redirect vectors on third-party
websites to act as a botnet and on the Layer3 (Network) abusing the
protocol."

"It also works as an encrypted DarkNET to...

Sicherheits-Recap: WordPress-, SonicWall- und SharePoint-0-Days sowie KI-Service-Angriffe

Tue, 21 Jul 2026 02:37:46 +0200

BERLIN / LONDON (IT BOLTWISE) – Innerhalb weniger Tage häufen sich Server- und Endpunkt-Exploits: WordPress-Core-Codeausführung, SonicWall-SMA-Zero-Days und ein SharePoint-RCE wurden teils schon vor Patch-Verfügbarkeit in freier Wildbahn missbraucht. Dazu kommen ein OpenSSL-DoS mit nur 11 Bytes, neue Malware-Frameworks zur Abgreifung von Krypto-Seed-Phrasen und eine Botnet-Jagd auf öffentlich erreichbare KI-Services. Der Recap zeigt nicht nur, was […]

... den vollständigen Artikel »Sicherheits-Recap: WordPress-, SonicWall- und SharePoint-0-Days sowie KI-Service-Angriffe« lesen

Dieser Beitrag Sicherheits-Recap: WordPress-, SonicWall- und SharePoint-0-Days sowie KI-Service-Angriffe erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

KI-gestützter Botnet-Betrieb: Gemini CLI macht C&C-Operationen portierbar

Mon, 20 Jul 2026 20:39:11 +0200

LONDON / MÜNCHEN / LONDON (IT BOLTWISE) – Eine Untersuchung zeigt, wie ein russischsprachiger Angreifer mit der Gemini-CLI einer Künstlichen Intelligenz eine komplette Botnet- und Command-and-Control-Infrastruktur auslagert. Laut Analyse von 200 Sitzungslogs zwischen 19. März und 21. April 2026 erledigt die KI dabei nicht nur Code-Arbeit, sondern auch Migration, Debugging und Bot-Management. Besonders brisant: Das […]

... den vollständigen Artikel »KI-gestützter Botnet-Betrieb: Gemini CLI macht C&C-Operationen portierbar« lesen

Dieser Beitrag KI-gestützter Botnet-Betrieb: Gemini CLI macht C&C-Operationen portierbar erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

KI-gestützter Botnet-Betrieb: Gemini-CLI liefert Angreifern ein portables C&C-„Baukasten“-Modell

Mon, 20 Jul 2026 19:23:19 +0200

LONDON (IT BOLTWISE) – Eine neue Fallanalyse zeigt, wie ein einzelner Angreifer Künstliche Intelligenz mit Gemini-CLI nutzt, um ein Botnet aus acht PCs einer Zahnarztpraxis zu steuern. Entscheidend ist nicht nur die Automatisierung einzelner Schritte, sondern die extrem kompakte C&C-Architektur: Laut Analyse passen die kompletten Befehls- und Serverkomponenten in nur wenige Kilobytes, wodurch der Betrieb […]

... den vollständigen Artikel »KI-gestützter Botnet-Betrieb: Gemini-CLI liefert Angreifern ein portables C&C-„Baukasten“-Modell« lesen

Dieser Beitrag KI-gestützter Botnet-Betrieb: Gemini-CLI liefert Angreifern ein portables C&C-„Baukasten“-Modell erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

Mon, 20 Jul 2026 13:39:38 +0200

A solo Russian-speaking threat actor known as “bandcampro” outsourced a chunk of their operations to Google’s open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between…

The post Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs appeared first on IT Security News.

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

Mon, 20 Jul 2026 12:10:02 +0200

A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential

NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure

Sun, 19 Jul 2026 07:20:46 +0200

The post NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure appeared first on IT Security News.

NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure

Sun, 19 Jul 2026 05:37:10 +0200

A sharp structural shift has been identified in the botnet landscape. Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been spreading rapidly since early July 2026. This malware marks a distinct evolution from opportunistic worm behavior toward an industrial-grade, ROI-driven attack platform aimed squarely at Artificial Intelligence (AI) and Model Context […]

The post NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure appeared first on Cyber Security News.

NadMesh: Botnet jagt KI-Services nach Cloud-Keys und Kubernetes-Tokens

Fri, 17 Jul 2026 22:08:39 +0200

LONDON (IT BOLTWISE) – Ein Go-Botnet namens NadMesh scannt gezielt exponierte KI-Dienste und versucht, über offene Schnittstellen an Cloud-Keys sowie Kubernetes-Token zu gelangen. Die Auswertung eines QiAnXin-XLab-Reports zeigt zahlreiche Inkonsistenzen in den eigenen Operator-Statistiken, aber klare Hinweise auf echte Ausnutzung. Besonders betroffen sind Faktoren, die Unternehmen oft zu spät absichern: öffentliche Docker-APIs, Jenkins-Schnittstellen und ungeschützte […]

... den vollständigen Artikel »NadMesh: Botnet jagt KI-Services nach Cloud-Keys und Kubernetes-Tokens« lesen

Dieser Beitrag NadMesh: Botnet jagt KI-Services nach Cloud-Keys und Kubernetes-Tokens erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Fri, 17 Jul 2026 19:38:55 +0200

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator’s own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and…

The post New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens appeared first on IT Security News.

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Fri, 17 Jul 2026 19:24:55 +0200

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast and firewall late. The intel feed behind that counter

New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure

Fri, 17 Jul 2026 13:22:58 +0200

The post New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure appeared first on IT Security News.

New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure

Fri, 17 Jul 2026 13:10:07 +0200

NadMesh is a new, industrial‑grade Go‑based botnet that weaponizes more than 20 RCE vectors to hijack AI and MCP infrastructure at scale, combining autonomous scanning, exploit delivery, and credential harvesting in a single closed‑loop platform. In early July 2026, researchers identified NadMesh as a high‑volume Go-written botnet that was aggressively deploying bot agents across internet‑facing […]

The post New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NadMesh Botnet Targets AI and MCP Servers With 20+ Remote Code Execution Vectors

Fri, 17 Jul 2026 11:56:03 +0200

Discovered in early July 2026, NadMesh identifies itself in code as “n4d mesh controller” and operates as a long‑lived, iteratively developed botnet rather than a one‑off worm outbreak. It is written in Go and integrates Scanning, exploitation, credential theft, and AI/MCP service intelligence collection into a single mesh‑style infrastructure centered on attacker‑controlled VPS nodes. The […]

The post NadMesh Botnet Targets AI and MCP Servers With 20+ Remote Code Execution Vectors appeared first on Cyber Security News.

Russian hacker turns Gemini CLI into a hacking agent, creates small-scale botnet

Thu, 16 Jul 2026 18:18:24 +0200

The hacker told the AI he was an authorized pentester - and the AI believed him.

IT Security News Hourly Summary 2026-07-16 15h : 16 posts

Thu, 16 Jul 2026 15:09:40 +0200

16 posts were published in the last hour 12:34 : Inside Microsoft’s Record-Breaking 622-Bug Release 12:34 : Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes 12:34 : Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM…

The post IT Security News Hourly Summary 2026-07-16 15h : 16 posts appeared first on IT Security News.

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes

Thu, 16 Jul 2026 14:53:13 +0200

The post Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes appeared first on IT Security News.

TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All

Thu, 16 Jul 2026 14:24:21 +0200

TuxBot v3, an AI-built IoT botnet for 17 architectures, shipped with LLM bugs and safety disclaimers the developer never removed. Palo Alto Networks’ Unit 42 identified a previously undocumented modular IoT botnet framework called TuxBot v3 Evolution, and it comes…

The post TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All appeared first on IT Security News.

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes

Thu, 16 Jul 2026 14:24:14 +0200

A Russian-speaking threat actor known as “bandcampro” used a jailbroken Gemini CLI, Google’s open-source terminal-based AI agent, to deploy and operate a small command-and-control (C2) botnet, according to TrendAI. Operational overview (Source: TrendAI) In more than 200 sessions between March 19 and April 21, 2026, the threat actor worked with Gemini to deploy and operate infrastructure that controlled eight computers inside a dental clinic and gain access to the clinic’s OpenDental database. Posing as an … More →

The post Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes appeared first on Help Net Security.

TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All

Thu, 16 Jul 2026 13:40:11 +0200

New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks

Thu, 16 Jul 2026 11:23:32 +0200

A newly identified IoT botnet framework, TuxBot v3 Evolution, is targeting internet-connected devices and turning compromised systems into tools for distributed denial-of-service attacks. The malware can run across a wide range of device architectures, creating a broad risk for routers,…

The post New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks appeared first on IT Security News.

New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks

Thu, 16 Jul 2026 10:39:16 +0200

The post New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks appeared first on Cyber Security News.

New IoT Botnet Uses 1,496 Default Passwords and Seven Persistence Mechanisms

Thu, 16 Jul 2026 09:24:16 +0200

Security researchers have uncovered TuxBot v3 Evolution, a modular IoT botnet framework built to compromise internet-exposed devices, maintain long-term access, and launch distributed denial-of-service (DDoS) attacks. The malware targets a broad range of Linux-based systems and uses Telnet credential brute forcing, scanning modules, encrypted command-and-control (C2), and multiple resilience features The botnet carries 1,496 username-and-password […]

The post New IoT Botnet Uses 1,496 Default Passwords and Seven Persistence Mechanisms appeared first on Cyber Security News.

LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures

Thu, 16 Jul 2026 08:37:49 +0200

TuxBot v3 Evolution, a modular IoT botnet framework capable of infecting devices running architectures ranging from ARM and MIPS to x86_64, PowerPC and RISC-V. The platform appears designed for mass compromise, persistence and distributed denial-of-service operations, with a C-based bot…

The post LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures appeared first on IT Security News.

LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures

Thu, 16 Jul 2026 08:23:55 +0200

The post LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

7/15/2026

Thu, 16 Jul 2026 01:08:22 +0200

Alleged Russian Cyber Spy in Boston Case Previously Worked for Kaspersky Compromised Logins Surge as the Most Common Entry Point for Ransomware AttacksWhite House Details ‘Gold Eagle’ Clearinghouse for AI Cyber ThreatsIs ‘Tech-xit’ Imminent? UK Steps Up Sovereignty Push Amid AI StrifeTuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Google Gemini CLI Abused … Continue reading

Top AI tools such as OpenClaw and Github Copilot can be hijacked to create new massive botnets

Wed, 15 Jul 2026 22:18:02 +0200

Researchers find nine of the most popular AI platforms are susceptible to a new attack that exploits hallucinations to set up a botnet.

TuxBot v3 Evolution: Hinweis auf LLM-unterstützte IoT-Botnet-Entwicklung

Wed, 15 Jul 2026 21:36:06 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher beschreiben ein zuvor nicht dokumentiertes IoT-Botnet-Framework namens TuxBot v3 Evolution, das offenbar mit Unterstützung durch ein LLM entstanden ist. In den analysierten Artefakten liefert die KI zwar Botnet-Code, aber mit übersehenen Sicherheits- und Funktionsdetails: Mehrere Implementierungsstellen sollen nicht zuverlässig arbeiten. Auffällig sind die modularen Komponenten, darunter ein Go-basiertes Command-and-Control-System, ein […]

... den vollständigen Artikel »TuxBot v3 Evolution: Hinweis auf LLM-unterstützte IoT-Botnet-Entwicklung« lesen

Dieser Beitrag TuxBot v3 Evolution: Hinweis auf LLM-unterstützte IoT-Botnet-Entwicklung erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Wed, 15 Jul 2026 21:09:15 +0200

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Wed, 15 Jul 2026 21:09:11 +0200

The post TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development appeared first on IT Security News.

Google Gemini CLI abused as a hacking agent, malware botnet operator

Wed, 15 Jul 2026 20:37:51 +0200

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. [...]

Your Smart TV Could Be Working for Hackers | Threat Wire

Wed, 15 Jul 2026 18:35:37 +0200

Author: Hak5 - Bewertung: 69x - Views:439

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire
0:00 0 - Intro
1 - Your Local Botnet
2 - Charging For Internet
3 - Scattered Spider
4 - BSides News
5 - Outro

LINKS
🔗 Story 1: Your Local Botnet
https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks
https://www.bleepingcomputer.com/news/security/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off/
https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html
🔗 Story 2: Charging For Internet
https://blog.cloudflare.com/monetization-gateway/
https://blog.cloudflare.com/introducing-pay-per-crawl/
🔗 Story 3: Scattered Spider
https://www.helpnetsecurity.com/2026/07/02/scattered-spider-criminal-group-suspect-extradited/
https://www.bleepingcomputer.com/news/security/alleged-scattered-spider-hacker-extradited-to-the-united-states/
https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html
🔗 Story 4: BSides News
https://cybersecuritynews.com/pamstealer-mimic-as-maccy-harvest/
https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/
https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html
https://openai.com/index/previewing-gpt-5-6-sol/
https://arstechnica.com/information-technology/2026/06/us-offers-10-million-for-info-on-group-behind-signal-and-whatsapp-hacking-spree/
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

TuxBot v3 Evolution: an IoT botnet-as-a-service framework built with LLM-generated code

Wed, 15 Jul 2026 17:02:22 +0200

submitted by /u/asherdl02
[link] [comments]

Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes

Wed, 15 Jul 2026 16:55:40 +0200

A Russian-speaking threat actor tracked as “bandcampro” used Google Gemini CLI as an end-to-end operational assistant to migrate a command-and-control server, deploy a replacement VPS, configure Cloudflare tunnels, and restore control of compromised endpoints within six minutes. The findings are…

The post Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes appeared first on IT Security News.

Hacker Used Gemini CLI to Build a Live C&C Botnet in 6 Minutes

Wed, 15 Jul 2026 16:24:53 +0200

A Russian-speaking threat actor known as “bandcampro” has weaponized Google’s Gemini CLI AI agent to migrate, deploy, and operate a live command-and-control (C&C) botnet. Remarkably, the attacker completed the entire infrastructure migration in just six minutes, contributing only 11% of the total work himself while the AI performed the rest. TrendAI™ Research published these findings […]

The post Hacker Used Gemini CLI to Build a Live C&C Botnet in 6 Minutes appeared first on Cyber Security News.

Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes

Wed, 15 Jul 2026 15:23:25 +0200

The post Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Kompromittierte AsyncAPI-npm-Packages verteilen Multi-Stage Botnet-Loader via IPFS

Wed, 15 Jul 2026 12:53:50 +0200

BERLIN / LONDON (IT BOLTWISE) – Vier kompromittierte npm-Pakete aus dem @asyncapi-Namespace verteilen einen mehrstufigen Botnet-Loader. Die Malware wird nicht über install-Skripte ausgelöst, sondern beim Laden der Bibliothek via require() in Node.js, lädt dann verschlüsselte Folgekomponenten per IPFS nach. Als Kommunikations-Backbone dienen mehrere C2-Kanäle einschließlich HTTP, Nostr-Relays, BitTorrent DHT, libp2p und Ethereum-Smart-Contracts. Entscheidend: Die Veröffentlichung […]

... den vollständigen Artikel »Kompromittierte AsyncAPI-npm-Packages verteilen Multi-Stage Botnet-Loader via IPFS« lesen

Dieser Beitrag Kompromittierte AsyncAPI-npm-Packages verteilen Multi-Stage Botnet-Loader via IPFS erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

Wed, 15 Jul 2026 12:08:33 +0200

TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.

The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42.

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Wed, 15 Jul 2026 11:54:11 +0200

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/generator-helpers@1.1.1 @asyncapi/generator-components@0.7.1 @asyncapi/generator@3.3.1 @asyncapi/specs(v6.11.2, v6.11.2-alpha.1) "The

Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet

Wed, 15 Jul 2026 04:38:11 +0200

TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself. This article…

The post Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet appeared first on IT Security News.

Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet

Tue, 14 Jul 2026 15:24:31 +0200

NPM: 148 „Student-Proxies“ wurden zu Browser-DDoS-Botnetzen

Tue, 14 Jul 2026 14:25:21 +0200

LONDON (IT BOLTWISE) – Eine Angriffsserie mit 148 npm-Paketen tarnte sich als „Student-Proxy“ und verwandelte Browser in ein DDoS-Botnetz. Laut Analyse von JFrog lief die Kampagne Anfang Mai rund zwei Wochen und nutzte dabei einen Proxy-Client als Zustellmechanismus. Im Kern wird nicht beim npm-Installieren zugeschlagen, sondern erst im geöffneten Tab: Remote-Code wird nachgeladen und anschließend […]

... den vollständigen Artikel »NPM: 148 „Student-Proxies“ wurden zu Browser-DDoS-Botnetzen« lesen

Dieser Beitrag NPM: 148 „Student-Proxies“ wurden zu Browser-DDoS-Botnetzen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

148 getarnte npm-Pakete verwandeln Browser-Proxies in DDoS-Botnetze

Tue, 14 Jul 2026 14:08:08 +0200

LONDON (IT BOLTWISE) – Eine neu analysierte npm-Kampagne nutzt 148 scheinbare Proxy-Tools als getarnte Botnet-Zellen: Jeder, der eine Proxy-Seite im Browser öffnet, gerät in den Datenstrom. Laut der Untersuchung bleibt die Schadlogik bewusst außerhalb des Install-Prozesses, um gängige Prüfmechanismen zur Build-Zeit zu umgehen. Stattdessen laden die Pakete zur Laufzeit Remote-Code über einen mutable CDN-Zweig und […]

... den vollständigen Artikel »148 getarnte npm-Pakete verwandeln Browser-Proxies in DDoS-Botnetze« lesen

Dieser Beitrag 148 getarnte npm-Pakete verwandeln Browser-Proxies in DDoS-Botnetze erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

Tue, 14 Jul 2026 10:38:46 +0200

A campaign of 148 npm packages disguised as student web proxies turned visitors’ browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog. The packages did not go after the developers who might…

The post 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet appeared first on IT Security News.

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

Tue, 14 Jul 2026 10:24:41 +0200

A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog. The packages did not go after the developers who might install them. The operators used the registry as free hosting for a booby-trapped proxy site and let the students who came to dodge

Exponential growth in DDoS attack volumes

Sun, 12 Jul 2026 08:07:01 +0200

Security threats such as distributed denial-of-service (DDoS) attacks disrupt businesses of all sizes, leading to outages, and worse, loss of user trust. These threats are a big reason why at Google we put a premium on service reliability that’s built on the foundation of a rugged network.

To help ensure reliability, we’ve devised some innovative ways to defend against advanced attacks. In this post, we’ll take a deep dive into DDoS threats, showing the trends we’re seeing and describing how we prepare for multi-terabit attacks, so your sites stay up and running.

Taxonomy of attacker capabilities

With a DDoS attack, an adversary hopes to disrupt their victim's service with a flood of useless traffic. While this attack doesn't expose user data and doesn't lead to a compromise, it can result in an outage and loss of user trust if not quickly mitigated.

Attackers are constantly developing new techniques to disrupt systems. They give their attacks fanciful names, like Smurf, Tsunami, XMAS tree, HULK, Slowloris, cache bust, TCP amplification, javascript injection, and a dozen variants of reflected attacks. Meanwhile, the defender must consider every possible target of a DDoS attack, from the network layer (routers/switches and link capacity) to the application layer (web, DNS, and mail servers). Some attacks may not even focus on a specific target, but instead attack every IP in a network. Multiplying the dozens of attack types by the diversity of infrastructure that must be defended leads to endless possibilities.

So, how can we simplify the problem to make it manageable? Rather than focus on attack methods, Google groups volumetric attacks into a handful of key metrics:

bps network bits per second → attacks targeting network links
pps network packets per second → attacks targeting network equipment or DNS servers
rps HTTP(S) requests per second → attacks targeting application servers

This way, we can focus our efforts on ensuring each system has sufficient capacity to withstand attacks, as measured by the relevant metrics.

Trends in DDoS attack volumes

Our next task is to determine the capacity needed to withstand the largest DDoS attacks for each key metric. Getting this right is a necessary step for efficiently operating a reliable network—overprovisioning wastes costly resources, while underprovisioning can result in an outage.

To do this, we analyzed hundreds of significant attacks we received across the listed metrics, and included credible reports shared by others. We then plot the largest attacks seen over the past decade to identify trends. (Several years of data prior to this period informed our decision of what to use for the first data point of each metric.)

The exponential growth across all metrics is apparent, often generating alarmist headlines as attack volumes grow. But we need to factor in the exponential growth of the internet itself, which provides bandwidth and compute to defenders as well. After accounting for the expected growth, the results are less concerning, though still problematic.

Architecting defendable infrastructure

Given the data and observed trends, we can now extrapolate to determine the spare capacity needed to absorb the largest attacks likely to occur.

bps (network bits per second)
Our infrastructure absorbed a 2.5 Tbps DDoS in September 2017, the culmination of a six-month campaign that utilized multiple methods of attack. Despite simultaneously targeting thousands of our IPs, presumably in hopes of slipping past automated defenses, the attack had no impact. The attacker used several networks to spoof 167 Mpps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SNMP servers, which would then send large responses to us. This demonstrates the volumes a well-resourced attacker can achieve: This was four times larger than the record-breaking 623 Gbps attack from the Mirai botnet a year earlier. It remains the highest-bandwidth attack reported to date, leading to reduced confidence in the extrapolation.

pps (network packets per second)
We’ve observed a consistent growth trend, with a 690 Mpps attack generated by an IoT botnet this year. A notable outlier was a 2015 attack on a customer VM, in which an IoT botnet ramped up to 445 Mpps in 40 seconds—a volume so large we initially thought it was a monitoring glitch!

rps (HTTP(S) requests per second)
In March 2014, malicious javascript injected into thousands of websites via a network man-in-the-middle attack caused hundreds of thousands of browsers to flood YouTube with requests, peaking at 2.7 Mrps (millions of requests per second). That was the largest attack known to us until recently, when a Google Cloud customer was attacked with 6 Mrps. The slow growth is unlike the other metrics, suggesting we may be under-estimating the volume of future attacks.

While we can estimate the expected size of future attacks, we need to be prepared for the unexpected, and thus we over-provision our defenses accordingly. Additionally, we design our systems to degrade gracefully in the event of overload, and write playbooks to guide a manual response if needed. For example, our layered defense strategy allows us to block high-rps and high-pps attacks in the network layer before they reach the application servers. Graceful degradation applies at the network layer, too: Extensive peering and network ACLs designed to throttle attack traffic will mitigate potential collateral damage in the unlikely event links become saturated.

For more detail on the layered approach we use to mitigate record-breaking DDoS attacks targeting our services, infrastructure, or customers, see Chapter 10 of our book, Building Secure and Reliable Systems.

Cloud-based defenses

We recognize the scale of potential DDoS attacks can be daunting. Fortunately, by deploying Google Cloud Armor integrated into our Cloud Load Balancing service—which can scale to absorb massive DDoS attacks—you can protect services deployed in Google Cloud, other clouds, or on-premise from attacks. We recently announced Cloud Armor Managed Protection, which enables users to further simplify their deployments, manage costs, and reduce overall DDoS and application security risk.

Having sufficient capacity to absorb the largest attacks is just one part of a comprehensive DDoS mitigation strategy. In addition to providing scalability, our load balancer terminates network connections on our global edge, only sending well-formed requests on to backend infrastructure. As a result it can automatically filter many types of volumetric attacks. For example, UDP amplification attacks, synfloods, and some application-layer attacks will be silently dropped. The next line of defense is the Cloud Armor WAF, which provides built-in rules for common attacks, plus the ability to deploy custom rules to drop abusive application layer requests using a broad set of HTTP semantics.

Working together for collective security

Google works with others in the internet community to identify and dismantle infrastructure used to conduct attacks. As a specific example, even though the 2.5 Tbps attack in 2017 didn't cause any impact, we reported thousands of vulnerable servers to their network providers, and also worked with network providers to trace the source of the spoofed packets so they could be filtered.

We encourage everyone to join us in this effort. Individual users should ensure their computers and IoT devices are patched and secured. Businesses should report criminal activity, ask their network providers to trace the sources of spoofed attack traffic, and share information on attacks with the internet community in a way that doesn't provide timely feedback to the adversary. By working together, we can reduce the impact of DDoS attacks.

How the FSF Sysadmins are Blocking Botnets with reaction

Sat, 11 Jul 2026 23:52:58 +0200

For nearly two years the Free Software Foundation has been fighting web crawlers (including many aggressively scraping training data for AI models). A botnet controlling about five million IPs hit one system for six months in 2025. Their systems administrator wrote this week that they view these as distributed denial-of-service attacks. How are they fighting back? We noticed patterns in the scrapers that were abnormal, which gave us material for writing regular expressions. Searching for the regular expression then gave us a large lists of IP addresses. Looking up the origin of those IP addresses revealed that some of the crawlers were using botnets of residential IP addresses to scrape faster and avoid detection. We looked for what kinds of botnets might be generating the kind of traffic that we were seeing, and one that we suspected was called the "Vo1d" botnet, comprised of smart TVs running some sort of compromised app... We got confirmation that at least some of the botnet traffic hitting GNU Savannah was originating through the Vo1d/Popa botnet. We placed our regular expressions in fail2ban, and found that we were hitting the maximum rules that could be added to UFW firewall rules on our systems which showed degradation around 65,000 rules... We learned about ipset and configured fail2ban to add IP addresses that it found to IP sets. Using ipset, we kept building larger IP sets and did not find instability with as large as five million rules... We eventually found a promising project on Framasoft's forge Framagit called reaction written by ppom... After we ran into scaling issues with our initial implementation, we developed a much faster implementation where the reaction shutdown process would export the IP sets to disk and the reaction startup process would restore the IP sets. This allowed us to have nearly instantaneous restarts of the service to apply new rules. We published both of our configurations upstream to reaction's wiki so that everyone can benefit from it. reaction's getting started documentation now leads to the method that we proposed... Many sysadmins know about fail2ban, but not enough people know about reaction. I am very grateful to ppom for the help they have provided and for the tremendous project they have released to the world with reaction. We have implemented other defenses as well, but reaction is doing the majority of the automated work keeping our sites online.

Read more of this story at Slashdot.

Australian telecom outage attributed to software bug.

Sat, 11 Jul 2026 06:19:40 +0200

FBI disrupts residential proxy network used by botnet. Zimbra patches a critical flaw in its Classic Web Client.

‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism

Fri, 10 Jul 2026 11:07:17 +0200

Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution. The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: ‘HalluSquatting’…

The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on IT Security News.

‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism

Fri, 10 Jul 2026 10:37:20 +0200

Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution.

The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on SecurityWeek.

New HalluSquatting Attack Allows Hackers to Poison AI Coding Assistants Into Installing Botnet Malware

Thu, 09 Jul 2026 14:38:32 +0200

A newly disclosed attack technique dubbed “HalluSquatting” is raising serious concerns in the cybersecurity community after researchers demonstrated how AI coding assistants can be manipulated into installing botnet malware through hallucinated resources. The research, conducted by Aya Spira, Stav Cohen,…

The post New HalluSquatting Attack Allows Hackers to Poison AI Coding Assistants Into Installing Botnet Malware appeared first on IT Security News.

New HalluSquatting Attack Allows Hackers to Poison AI Coding Assistants Into Installing Botnet Malware

Thu, 09 Jul 2026 12:23:34 +0200

The post New HalluSquatting Attack Allows Hackers to Poison AI Coding Assistants Into Installing Botnet Malware appeared first on Cyber Security News.

HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers

Thu, 09 Jul 2026 11:38:23 +0200

A newly disclosed attack technique called “HalluSquatting” is raising serious concerns in the AI security landscape. This technique demonstrates how attackers can exploit large language model (LLM) hallucinations to covertly compromise systems and potentially create botnets on a large scale. The research introduces “adversarial hallucination squatting,” a novel method that exploits AI models that generate […]

The post HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers

Thu, 09 Jul 2026 11:38:15 +0200

The post HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers appeared first on IT Security News.

Agentic Botnets Attack Uses HalluSquatting to Hijack AI Coding Assistants

Thu, 09 Jul 2026 07:38:10 +0200

A newly disclosed attack technique, called adversarial hallucination squatting (HalluSquatting), developed by researchers at Tel Aviv University and Technion, exploits the predictable tendency of large language models to hallucinate resource identifiers. According to Google, enabling attackers to hijack popular AI coding assistants at scale and assemble them into a botnet. HalluSquatting works by having attackers […]

The post Agentic Botnets Attack Uses HalluSquatting to Hijack AI Coding Assistants appeared first on Cyber Security News.

New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware

Wed, 08 Jul 2026 20:38:12 +0200

The post New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware appeared first on IT Security News.

HalluSquatting: KI-Coding-Assistenten bauen Botnetze über Halluzinations-Fallen

Wed, 08 Jul 2026 20:23:48 +0200

LONDON (IT BOLTWISE) – KI-Coding-Assistenten können beim „Fetchen und Ausführen“ durch halluzinierte Projektnamen getäuscht werden. Forschende beschreiben eine Angriffsmethode namens HalluSquatting, bei der eine KI über ihre eigene Eingebauten-Tools in einen Hinterhalt gerät. Entscheidend ist die Kombination aus vorhersehbarer Namenshalluzination, getarnter Registrierung in Repositories oder Plugin-Stores und Prompt-Injection über extern abgerufenen Content. In Tests führte […]

... den vollständigen Artikel »HalluSquatting: KI-Coding-Assistenten bauen Botnetze über Halluzinations-Fallen« lesen

Dieser Beitrag HalluSquatting: KI-Coding-Assistenten bauen Botnetze über Halluzinations-Fallen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware

Wed, 08 Jul 2026 18:27:07 +0200

AI coding assistants have a habit of making things up. Ask one to fetch a popular tool, and it will sometimes hand back a real-sounding name for a project that does not exist. New research, which its authors call HalluSquatting, turns that habit into an attack: work out the fake names an AI reliably invents, register them first, and wait for the assistant to fetch your trap on a user's

Mycelium Framework – First-Ever Know Botnet as an AI-as-a-Service

Wed, 08 Jul 2026 15:53:11 +0200

A new cybercrime advertisement is turning heads in the security community, and for good reason. It describes a botnet that does not just infect computers, it turns them into rented artificial intelligence power for other criminals to use. The framework, called Mycelium, is sold on an underground forum as a package for breaking into machines […]

The post Mycelium Framework – First-Ever Know Botnet as an AI-as-a-Service appeared first on Cyber Security News.

AI-as-a-Service Botnet Routes Malicious Workloads Across Compromised Windows and Linux Hosts

Wed, 08 Jul 2026 11:52:52 +0200

The underground advertisement for the so-called Mycelium Framework reads like another feature‑packed botnet sales pitch: cross‑platform payloads, encrypted C2, persistence, exploit modules, credential theft, and lateral movement. Those building blocks are not new. What makes Mycelium notable is its advertised purpose to treat compromised endpoints not as disposable bots but as a capability‑aware. AI compute […]

The post AI-as-a-Service Botnet Routes Malicious Workloads Across Compromised Windows and Linux Hosts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Mycelium Botnet Uses Stolen AI API Keys and Local LLMs for Distributed AI Inference

Wed, 08 Jul 2026 11:37:46 +0200

A novel underground advertisement has surfaced, showcasing a highly sophisticated framework that transcends traditional operations by repurposing compromised infrastructure into a malicious computational cluster. Flare said in a report shared with Cyber Security News (CSN) that the Mycelium Framework represents a paradigm shift from conventional monetization toward an advanced AI-as-a-Service model. At first glance, the […]

The post Mycelium Botnet Uses Stolen AI API Keys and Local LLMs for Distributed AI Inference appeared first on Cyber Security News.

My threat feed told me it was ‘Chalubo.’ The binary disagreed

Wed, 08 Jul 2026 11:09:09 +0200

I’ve spent two years doing incident response and threat intel, and the one habit I’d keep if I had to give up every other is also the most boring. I don’t act on a piece of intelligence until I’ve checked it against the thing it claims to describe. It’s slow. It’s tedious. Almost nobody does it, because checking costs the exact time the feed was supposed to save. So, we read the report, nod and move on. That works fine most weeks. The weeks it doesn’t are the ones I remember, and the one I keep coming back to started with a feed that sounded completely sure of itself and had it backwards.

A cluster the feed got wrong

I was mapping infrastructure behind a loader operation, sweeping a single service port through a commercial platform. It handed back a cluster of hosts; all tagged the same thing: Chalubo RAT. The tag didn’t stop me. The metadata did. Every host in the cluster carried one first-seen date, down to the day.

Real infrastructure never looks that clean. Operators stand hosts up a few at a time, over weeks, whenever they get to it. A whole cluster sharing one first-seen date almost always means you’re looking at the day the feed’s pipeline ingested the batch, not the day anyone actually saw those hosts live. So now I had two things I didn’t trust: The family name and the too-perfect date. Easiest way to settle it was to close the feed and go look at the malware.

Chalubo is a Linux botnet. It brute-forces SSH and throws DDoS traffic. What I had in front of me was a Windows shellcode loader, a DonutLoader variant, the kind of thing that sits at the front of a ransomware intrusion. Different platform, different job. Calling one the other isn’t a near miss. It’s a category error.

So, I detonated it in an isolated lab, captured the traffic, mapped the C2 and pulled the config. It spoke a protocol of its own: Payload delivery on one custom channel, a steganographic beacon on a second, across a ten-host cluster, with a config format that had nothing to do with Chalubo. The reason for the bad tag turned out to be dull. The feed’s rule for that port keyed on the port plus a loose pattern, my loader tripped it and the label propagated across the whole batch with the ingest date stapled on.

This isn’t a knock on the vendor. Fingerprinting malware families across the entire internet is genuinely hard. The damage starts one step later, with whatever the reader does with that tag. Believe it, and you spend the week hardening against a Linux DDoS botnet while a Windows ransomware precursor sits quietly on your network. Wrong threat. Wrong priorities. The feed didn’t just come up empty. It pointed the response in the wrong direction, with total confidence and a familiar logo on it. Nothing about the tag looked wrong. The file was the only thing that said otherwise.

The same gap, in a federal advisory

For a while I filed this as a commercial-feed problem, the tax you pay for buying intel from a vendor cutting corners at scale. Then the same shape turned up in one of the best sources any of us get for free.

Earlier this year I spent some time inside the joint FBI and CISA advisory on Ghost, or Cring depending on who’s naming it, a ransomware crew that’s hit organizations in seventy-plus countries. Like everyone, I opened the PDF first. Its indicator table is literally headed “MD5 File Hashes”: 14 samples, each pinned to an MD5 and nothing else. MD5’s been broken for years. It’s the whole reason detection moved to SHA-256, and an MD5-only indicator doesn’t drop cleanly into half the tooling defenders actually run.

Then I opened the other copy of the same advisory. It doesn’t only ship as a PDF. There’s a machine-readable STIX bundle too, the format built to feed straight into a TIP or a SIEM. Same advisory, same code, different file. Six of those fourteen samples carried SHA-256 in the STIX, with SHA-1 and fuzzy hashes next to them, none of it in the PDF table. The stronger indicators were in the official release the entire time, sitting in the file almost nobody opens. Read the PDF like most people do, and you walk away with weaker detections than whoever opened the STIX, and nothing tells you there’s a difference.

That same bundle cut the other way too, and this is the part worth slowing down on. Down in its relationships sat a threat-actor object naming APT41, Winnti, Wicked Panda, wired to several of the Ghost indicators. The advisory’s text never says APT41. It goes out of its way to call the attribution “variable over time.” Pull on the thread and it falls apart: No vendor has ever tied Ghost to APT41, and the object looks like automated enrichment, not a human analyst’s call. The STIX isn’t lying to you. The problem is subtler. Feed it into your TIP and you’ve quietly inherited a nation-state attribution nobody actually made. One file was missing good data. The other was carrying data nobody vetted. You only catch either by looking.

And it’s not a one-country quirk. A while later I reversed a Go backdoor, GAMYBEAR, the one UAC-0241 pointed at Ukrainian schools and state bodies, documented in a CERT-UA advisory. Good report. It nailed the behavior. But the actual loader gave up more than fifteen binary-level corrections to what the advisory had: A persistence mechanism attributed to the wrong component, a broken TLS implementation and a handful of indicators that only held once I checked them against the real sample instead of the writeup. That’s the kind of detail that keeps a detection alive after the operator renames the file. Commercial vendor. Federal agency. Foreign CERT. Three sources, all accurate, all carrying something other than the full truth in the copy most people read.

What I do differently now

The lesson wasn’t trust intelligence more or trust it less. It’s narrower than that. An indicator is a claim, and a claim gets checked before you stake a defense on it, most of all when it’s the advisory covering your own organization, because that’s the one whose blind spots quietly become yours. It’s cheap enough to make routine. If I were standing up a detection program next week, three things would be in from day one.

Treat any automated family label as a guess until something specific backs it. A row of identical first-seen dates is a fact about a pipeline, not a record of an attack. When an advisory ships in more than one format, open the machine-readable copy and don’t stop at the PDF, because the structured file tends to hold both the stronger indicators and the unvetted ones, and you want to see both. And for anything that actually matters, run a live sample through your own stack before you call it covered. The gap between an indicator and a detection that fires is exactly where attackers like to live.

I still reach for all three kinds of source every week, and I’ll defend every one of them. They were never the problem. The checking was always the cheap part. Assuming I could skip it was the expensive one. A report is where the work starts. Not where it stops.

The full teardowns behind these three cases are published on GitHub: The DonutLoader protocol analysis, the Ghost detection content and the GAMYBEAR reversing notes and rule, each in its own repository.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Google and the FBI Target Massive Botnet That Quietly Used Home Devices to Mask Cybercrime

Wed, 08 Jul 2026 04:17:26 +0200

Millions of low-cost, off-brand Android devices were hijacked to help criminals hide online.

FBI disrupts residential proxy network used by botnet.

Mon, 06 Jul 2026 18:29:49 +0200

New macOS infostealer poses as a clipboard manager. AdaptHealth discloses data breach affecting patient information.

NetNut botnet takes a hit. Don’t be part of the next one.

Mon, 06 Jul 2026 14:24:50 +0200

Google, the FBI, and other partners have disrupted a residential proxy network built on millions of hijacked devices and used by criminals.

FSF Shares Update on 'LibrePhone' and New Automated Site Monitoring Tool

Sat, 04 Jul 2026 20:54:17 +0200

At the end of 2025, the FSF launched LibrePhone project, which is working to "better understand and reverse-engineer the nonfree blobs used by a great majority of (if not all) system on a chip designs available today." The FSF's summer newsletter shares this update: We started with researching the proprietary files in Android phones supported by the Lineage project, an Android-based volunteer-led mobile phone operating system with much free software already in it. Our current, primary focus is on the radio blobs that control WiFi, Bluetooth, NFC, and cellular communications. The software freedom issues with mobile computing have been around for a long time, with the most challenging issue being the baseband/modem firmware that relies heavily on proprietary software. This creates a technical and legal maze that is nearly impossible to break free from, but that doesn't mean we should ever stop working to create free systems. It certainly doesn't mean we shouldn't liberate the software that we know can be free software. Now, half a year into this project, lead developer Rob Savoye has extracted firmware from over 200 Lineage install packages, processed 85GB of files, and imported the results of these analyses into a PostgreSQL database for cross-device comparison... [M]uch of the software and blobs we need to work through are shared across multiple devices; this means even greater strides for mobile phone freedom... As insurmountable as it may seem at times, every blob we manage to free up will be progress. The FSF has proven time and time again that it can bring the free software philosophy to life, not just by advocating for it, but by making it so. The bulletin also describes how waves of botnets from "aggressive LLM scrapers, vulnerability scanners, poorly optimized CI/CD servers" inspired the FSF to create a new free-as-in-freedom automated monitoring tool: In our efforts to combat the botnets, we optimized several detection rules to ban abusive behavior. We found the upper limit of fail2ban and replaced it with reaction, an efficient alternative with our configuration that uses ipset. We also split several monolithic machines into many separate machines so that when a web service is overwhelmed the other functions of the service do not go down with it... We found quite a few ways to respond to and prevent botnet attacks, but still faced a significant related challenge: communicating when a website or service is down... Uptime Kuma is a human-readable, automated monitoring addition to our systems... You can check out our recently-launched self-hosted Uptime Kuma instance at https://status.fsf.org/. When you see the page, you will also likely say, "Wow! The FSF and GNU sure do run a ton of services!" and you would be right... If you maintain websites and services, and are looking for a simple way to communicate publicly with your users, consider using Uptime Kuma or another free software solution instead of choosing a proprietary monitoring solution." There's also an article on the state of free-as-in-freedom videogame console emulators.

Read more of this story at Slashdot.

NetNut cracked as Google and FBI target 2 million-device botnet

Fri, 03 Jul 2026 15:23:39 +0200

Other residential proxy brands may rely on the same network This article has been indexed from www.theregister.com – Articles Read the original article: NetNut cracked as Google and FBI target 2 million-device botnet

The post NetNut cracked as Google and FBI target 2 million-device botnet appeared first on IT Security News.

IT Security News Hourly Summary 2026-07-03 15h : 5 posts

Fri, 03 Jul 2026 15:23:33 +0200

5 posts were published in the last hour 12:37 : Pegasus Spyware Hacked European Parliament Member Investigating Spyware Abuse 12:36 : JADEPUFFER: First End-to-End AI-Driven Ransomware Operation 12:35 : NetNut cracked as Google and FBI target 2 million-device botnet 12:35…

The post IT Security News Hourly Summary 2026-07-03 15h : 5 posts appeared first on IT Security News.

NetNut cracked as Google and FBI target 2 million-device botnet

Fri, 03 Jul 2026 14:03:20 +0200

Other residential proxy brands may rely on the same network

Google and FBI Dismantle NetNut Residential Proxy Botnet

Fri, 03 Jul 2026 13:53:52 +0200

Google, the FBI and the IRS Criminal Investigation division disrupted NetNut, a residential proxy network built on two million hijacked devices and used by 316 threat clusters in a single week. Google and FBI Dismantle NetNut Residential Proxy Botnet on…

The post Google and FBI Dismantle NetNut Residential Proxy Botnet appeared first on IT Security News.

Google and FBI Dismantle NetNut Residential Proxy Botnet

Fri, 03 Jul 2026 12:53:06 +0200

Google, the FBI and the IRS Criminal Investigation division disrupted NetNut, a residential proxy network built on two million hijacked devices and used by 316 threat clusters in a single week.

Google and FBI Dismantle NetNut Residential Proxy Botnet on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

FBI, Google Take Down NetNut Proxy Network Used by Cyber Threat Actors

Fri, 03 Jul 2026 12:23:07 +0200

The NetNut proxy network and the ‘Popa’ botnet are known to have infected devices with variants of Mirai DDoS botnets This article has been indexed from www.infosecurity-magazine.com Read the original article: FBI, Google Take Down NetNut Proxy Network Used by…

The post FBI, Google Take Down NetNut Proxy Network Used by Cyber Threat Actors appeared first on IT Security News.

FBI, Google Take Down NetNut Proxy Network Used by Cyber Threat Actors

Fri, 03 Jul 2026 11:50:44 +0200

The NetNut proxy network and the ‘Popa’ botnet are known to have infected devices with variants of Mirai DDoS botnets

Erster kompletter Ransomware-Angriff durch einen KI-Agent entdeckt

Fri, 03 Jul 2026 09:07:41 +0200

Sicherheitsforscher haben erstmals einen vollständig automatisierten Ransomware-Angriff dokumentiert. Was die KI-Anbieter aktuell als Agentisierung bewerben, ist in kriminellen Kreisen also bereits in der Praxis erfolgreich. (Weiter lesen)

Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks

Fri, 03 Jul 2026 07:08:23 +0200

Google has disrupted the NetNut residential proxy botnet, a large-scale infrastructure widely exploited for malware command-and-control (C2) operations and password spray attacks. This coordinated effort involved the FBI, Lumen, and various industry partners. It was announced by Google’s Threat Intelligence Group (GTIG) on July 3, 2026. This action is part of an ongoing campaign to […]

The post Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks

Fri, 03 Jul 2026 07:08:11 +0200

The post Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks appeared first on IT Security News.

FBI Seizes NetNut Proxy Platform, Popa Botnet

Thu, 02 Jul 2026 22:38:47 +0200

The post FBI Seizes NetNut Proxy Platform, Popa Botnet appeared first on IT Security News.

FBI Seizes NetNut Proxy Platform, Popa Botnet

Thu, 02 Jul 2026 21:52:37 +0200

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.

Google’s Continued Disruption of Malicious Residential Proxy Networks

Thu, 02 Jul 2026 19:38:51 +0200

Background

Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks.

Actions Taken

As a part of this disruption we took the following actions:

Disabled Google accounts and associated Google services used by NetNut for malware command and control (C2), which directly violates Google’s Terms of Service and Acceptable Use Policy.
Shared technical intelligence on NetNut software development kits (SDKs) and backend C2 infrastructure with platform providers, law enforcement, and research firms to help drive ecosystem-wide awareness and enforcement.
We ensured Google Play Protect, Android’s built-in security protection, automatically warned users and disabled applications known to incorporate NetNut SDKs, and the system will continue to protect users against future install attempts. These efforts to help keep the broader digital ecosystem safe supplement the protections we have to safeguard Android users on certified devices.

We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions. In addition to selling access to the network under the NetNut brand, NetNut has a robust reseller program that allows whitelabeling of its network. Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet. While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers. We will continue to observe the composition of the NetNut network and map out how its peers adapt to this action.

Why it Matters

NetNut is among the largest and most popular residential proxy networks. Estimating the size of residential proxy networks is extremely challenging, but Google Threat Intelligence Group (GTIG) estimates the size of the NetNut network to be at least 2 million devices, distributed across the world. Public reporting by KrebsOnSecurity and others, confirmed by Google, illustrates that NetNut populates its botnet by distributing SDKs for devices commonly found in homes, such as smart TVs and streaming boxes. GTIG has also identified NetNut botnet plugin components for large-scale botnets such as Badbox 2.0.

Residential proxy networks sell the ability to route traffic through IP addresses owned by internet service providers (ISPs), allowing attackers to mask malicious activity by hijacking these IP addresses. A robust residential proxy network requires controlling millions of residential IP addresses to sell to customers for use. To accomplish this, operators need code running on home devices to enroll them into the malicious network as exit nodes. Home devices become part of proxy networks either because they are pre-installed with malware before purchase or because users unknowingly download applications containing hidden proxy code. This creates serious risks for unsuspecting device owners, as their home IP addresses can be used by attackers as a launchpad for hacking and other unauthorized activities. Consequently, users can have their legitimate traffic flagged as suspicious, or blocked by their service providers.

In a single week during June 2026, GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups. These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks. Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats. Public reports by Synthient, Spur, Nokia Deepfield, and others have documented the use of NetNut to infect devices with variants of Mirai DDoS botnets.

Empowering and Protecting Consumers

Consumers should be extremely wary of applications that offer payment in exchange for "unused bandwidth" or "sharing your internet." These applications are primary ways for malicious proxy networks to grow, and could open security vulnerabilities on the device’s home network. We urge users to stick to official app stores, review permissions for third-party VPNs and proxies, and ensure built-in security protections like Google Play Protect are active.

Consumers should be careful when purchasing connected devices, such as set top boxes, to make sure they are from reputable manufacturers. For example, to help you confirm whether or not a device is built with the official Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your Android device is Play Protect certified.

Future Work

As we noted earlier this year, the residential proxy industry appears to be rapidly expanding, and this coordinated disruption is not the end of our work combating malicious residential proxy networks. This industry is deeply connected and operators depend on overlapping botnet networks that are constantly resold. While point-in-time disruptions are a critical tool to protect our users, continued and coordinated effort is needed to reduce malicious proxy networks in the long run. We encourage mobile platforms, ISPs, and other tech platforms to continue sharing intelligence and to take direct action to block malicious C2 infrastructure.

RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow

Wed, 01 Jul 2026 13:38:17 +0200

RustDuck is a small, evolving DDoS botnet migrating to Rust. It uses advanced encryption, anti-analysis evasion, and exploits known IoT flaws. Since February 2026, researchers at QiAnXin’s XLab have been tracking a new malware family, called RustDuck, that hijacks routers,…

The post RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow appeared first on IT Security News.

RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow

Wed, 01 Jul 2026 12:38:46 +0200

New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits

Wed, 01 Jul 2026 10:08:37 +0200

A sophisticated new botnet family dubbed RustDuck emerged in early 2026, leveraging a two-stage Loader and Core architecture to compromise IoT devices, routers, and enterprise servers through brute-force credential attacks and remote code execution vulnerabilities. RustDuck employs a multi-pronged infection strategy combining weak password attacks against Telnet and SSH services with exploitation of known RCE […]

The post New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits

Wed, 01 Jul 2026 10:08:32 +0200

The post New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits appeared first on IT Security News.

RustDuck Botnet Exploits Telnet, SSH, Android ADB, TP-Link, ZTE, and Jenkins Flaws

Wed, 01 Jul 2026 09:22:55 +0200

Built with a two-stage Loader + Core design and increasingly written in Rust, RustDuck is notable for rapid technical iteration, strong anti-analysis features, and a wide set of infection methods. Its primary goal so far is large-scale DDoS, but its propagation techniques let it reach routers, cameras, Android devices and servers a broad and growing […]

The post RustDuck Botnet Exploits Telnet, SSH, Android ADB, TP-Link, ZTE, and Jenkins Flaws appeared first on Cyber Security News.

RustDuck: Botnetz-Malware wird von C auf Rust umgebaut und tarnt sich vor Analyse

Wed, 01 Jul 2026 05:34:38 +0200

LONDON (IT BOLTWISE) – RustDuck nutzt infizierte Router, IP-Kameras und Server für Distributed Denial of Service. Auffällig ist die komplette Umschreibung zentraler Komponenten von C nach Rust sowie ein mehrstufiger Tarnmechanismus, der Analyseumgebungen früh erkennt. Damit verlagert sich der Fokus für Verteidiger von einzelnen Fixes auf das Schließen ganzer Angriffswege: schwache Fernzugänge, ungepatchte Geräte und […]

... den vollständigen Artikel »RustDuck: Botnetz-Malware wird von C auf Rust umgebaut und tarnt sich vor Analyse« lesen

Dieser Beitrag RustDuck: Botnetz-Malware wird von C auf Rust umgebaut und tarnt sich vor Analyse erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Amazon Blames Piracy Apps With Malware For Killing New Fire Stick Sideloading

Wed, 01 Jul 2026 01:08:25 +0200

Amazon says it is ending sideloading on new Fire Sticks because "apps that facilitate piracy, and other apps, can carry malware," adding that there is "a good amount of evidence" that sideloaded apps may contain unwanted code or behavior. However, the company did not provide specific examples of Fire Stick users being harmed. Ars Technica reports: Amazon has released two Fire Stick models that use its proprietary, Linux-based operating system, Vega OS. Previous Fire Sticks ran Fire OS, which is an Android fork based on the Android Open Source Project. One of the biggest differences between Vega OS and Fire OS is that the former doesn't support sideloading. [...] In a recent interview, Or Goren, editor-in-chief of Cord Busters, a UK-based streaming news outlet, noted the negative reaction to Vega being a closed OS. [Aidan Marcuss, VP of Fire TV, advertising, and Appstore] responded, per the publication, by saying that Vega OS was Amazon's opportunity to "innovate and deliver more capabilities, even on the least expensive devices." He also said that making a platform around security and privacy was "sort of utmost in my mind." The statement is somewhat ironic, considering Vega OS blocks custom launchers and other third-party apps that helped users avoid Amazon tracking and ads. Goren asked whether Amazon had evidence that sideloaded devices caused users harm. "Apps that facilitate piracy, and other apps, can carry malware," Marcuss responded. Marcuss also said that there is "a good amount of evidence that apps can carry unwanted code and behavior on them when they're sideloaded." Marcuss didn't provide specific examples of Fire Stick users being hurt by sideloaded apps. There are some potential examples, though. In 2025, Amazon claimed to blacklist (which blocked the apps from being sideloaded to Fire Sticks) four video streaming apps for malicious behavior. At the time, AFTVnews reported that two of the apps served as residential proxy providers and were considered riskware, and that the other two had APK files that were flagged by virus-scanning tools. Safari and Chrome also flagged one of the apps' official websites, the publication reported. And in 2018, a botnet that infected Android devices with cryptocurrency-mining malware appeared on some Fire Sticks, per discussion on XDA Forums. That said, Amazon also has a history of disabling apps that let users circumnavigate its home screen that Fire devices, including Fire Sticks and Fire TVs, have increasingly used for ads. Worth noting: developers can continue sideloading apps onto Vega OS devices if they register them with Amazon.

Read more of this story at Slashdot.

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

Tue, 30 Jun 2026 21:08:28 +0200

A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin's XLab have tracked it since February 2026, and say the real story is not how big it is today, but how fast it is changing. The end goal is a

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

Tue, 30 Jun 2026 21:08:18 +0200

The post RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS appeared first on IT Security News.

IT Security News Hourly Summary 2026-06-30 21h : 3 posts

Tue, 30 Jun 2026 21:08:16 +0200

3 posts were published in the last hour 19:2 : RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS 19:2 : Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data 18:32 : libssh2 CVE-2026-55200…

The post IT Security News Hourly Summary 2026-06-30 21h : 3 posts appeared first on IT Security News.

Operation Endgame Disrupts SocGholish, StealC Malware Networks

Mon, 29 Jun 2026 09:54:43 +0200

Operation Endgame has dealt another blow to cybercriminal operations after international law enforcement agencies and private sector partners dismantled infrastructure supporting the SocGholish, Amadey, and StealC malware families. The coordinated operation resulted in the seizure of more than EUR 41 million in criminal cryptocurrency assets, the recovery of 27 million stolen login credentials, and the disruption of hundreds of servers and domains used to distribute malware.

Led by Europol and Eurojust, the operation brought together authorities from Canada, Denmark, Germany, the Netherlands, the United Kingdom, the United States, Microsoft, and several cybersecurity organizations. Officials said the objective was to disrupt the infrastructure cybercriminals rely on to launch ransomware attacks, financial fraud, and attacks against critical infrastructure.

Operation Endgame Targets Cybercrime Infrastructure

During the coordinated action, authorities targeted the infrastructure supporting malware delivery rather than focusing on a single malware family.

Law enforcement and industry partners took action against 326 servers and 142 domains, significantly disrupting malware distribution channels. Investigators also identified and restricted criminal cryptocurrency assets currently valued at more than EUR 41 million (USD 47 million) while recovering approximately 27 million stolen login credentials.

According to Europol, the operation aimed to disrupt the "assembly line" used by cybercriminals to gain initial access to victim systems before deploying ransomware or stealing sensitive information.

[caption id="attachment_112936" align="aligncenter" width="600"] Image Soure: Europol[/caption] [caption id="attachment_112937" align="aligncenter" width="600"] Image Source: Europol[/caption]

SocGholish, Amadey and StealC Malware Played Different Roles

The operation focused on three malware families that are commonly offered under the cybercrime-as-a-service model.

SocGholish functioned as a malware loader that distributed fake browser updates through compromised WordPress websites. Users who installed these fake updates unknowingly infected their systems, allowing attackers to gain initial access and later deploy ransomware or other malicious tools.
StealC malware primarily targeted sensitive information stored on infected devices, including passwords, authentication data, and digital identities. The stolen information was later used for fraud or traded within cybercriminal marketplaces.
Amadey was mainly distributed through phishing campaigns. It provided attackers with initial access to compromised systems while also offering information-stealing capabilities that enabled the theft of sensitive user data.

Microsoft reported that during the first two weeks of May 2026 alone, Amadey and StealC malware were linked to more than 140,000 infected computers worldwide.

Thousands of Infected WordPress Sites Cleaned

One of the largest actions under Operation Endgame targeted SocGholish, also known as FakeUpdates.

Authorities remediated 14,971 infected WordPress websites, including websites belonging to restaurants, automotive repair businesses, and other organizations. Investigators also disabled the SocGholish botnet by taking control of domains and shutting down supporting servers.

Website owners whose credentials had been exposed were notified through platforms including Have I Been Pwned, DIVD, Spamhaus, CheckjeHack, NoMoreLeaks, Shadowserver, and NL-NCSC.

The Dutch Police urged WordPress administrators to change passwords, enable multi-factor authentication, remove unknown administrator accounts, and keep their websites updated to reduce future compromise risks.

SocGholish Linked to Evil Corp

Authorities said SocGholish has been linked to Evil Corp, a Russian cybercriminal group previously associated with the Zeus and Dridex malware families, as well as multiple ransomware and money laundering operations.

Rather than targeting only malware operators, investigators focused on disrupting the broader infrastructure supporting cybercriminal activity. Europol said this strategy increases operational costs for threat actors and makes large-scale cyberattacks more difficult to execute.

Europol Coordinates Global Cyber Operation

Europol's European Cybercrime Centre (EC3) coordinated operational intelligence sharing through SIENA while providing analytical, technical, and cryptocurrency tracing support throughout the investigation.

The operation forms part of Operation Endgame, described by Europol as the largest international initiative to disrupt ransomware enablers worldwide.

Officials said the latest disruption reflects a growing international strategy of targeting the infrastructure that enables cybercrime operations, rather than responding only after attacks have occurred.

Operation Endgame: Microsoft zerschlägt 200+ Botnet-Server - Ad-hoc-news.de

Sun, 28 Jun 2026 22:51:44 +0200

Microsoft und Europol legen 200 Schadsoftware-Server lahm. Neue Phishing-Kampagnen zielen auf Microsoft-365-Nutzer.

6 Best Managed DDoS Testing Services to Stress-Test Without Risking an Outage

Sun, 28 Jun 2026 18:53:11 +0200

In this post, I will talk about the best managed DDoS testing services to stress-test without risking an outage. Last year, a single botnet hurled 31.4 Tbps of junk traffic at one target—shattering every distributed-denial-of-service (DDoS) record on the books. Regulators moved fast: under Europe’s NIS2 directive and the new U.S. four-day disclosure rule, boards […]

The post 6 Best Managed DDoS Testing Services to Stress-Test Without Risking an Outage appeared first on SecureBlitz Cybersecurity.

Weak Access Controls Leave Enterprise Networks at Risk

Sat, 27 Jun 2026 01:08:31 +0200

Barracuda researchers found that weak credentials and exposed remote services continue to fuel malware, botnet, and credential attacks. The post Weak Access Controls Leave Enterprise Networks at Risk appeared first on eSecurity Planet. This article has been indexed from eSecurity…

The post Weak Access Controls Leave Enterprise Networks at Risk appeared first on IT Security News.

Weak Access Controls Leave Enterprise Networks at Risk

Sat, 27 Jun 2026 00:52:32 +0200

Barracuda researchers found that weak credentials and exposed remote services continue to fuel malware, botnet, and credential attacks.

The post Weak Access Controls Leave Enterprise Networks at Risk appeared first on eSecurity Planet.

STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

Thu, 25 Jun 2026 16:09:20 +0200

Written by: Jordan Jones

Introduction

Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing cyber espionage, this backdoor shares significant code and functional overlaps with KAZUAR, a successful toolkit previously attributed to Turla. The group has a long history of targeting a wide range of industries, with a particular focus on western Ministries of Foreign Affairs, and defense organizations within the context of heightened political tensions.

Turla, and specifically their longstanding Snake implant, has been publicly attributed by the United States Cybersecurity and Infrastructure Security Agency (CISA) to Center 16 of Russia’s Federal Security Service (FSB). Turla is one of the oldest known cyber espionage groups with suspected activity dating back to at least 2004. The actor remains active and continues to evolve its delivery methods, as demonstrated by its deployment of specialized scripts to intercept secure communications from Signal Messenger users, its hijacking of legacy criminal botnets to target Ukrainian organizations, and its recent campaigns targeting military defense sectors using the highly sophisticated KAZUAR toolkit. As part of our continued tracking of this group, this blog post provides an overview of our STOCKSTAY analysis, includes a timeline of key developmental and operational observations, and examines its similarities to KAZUAR to contextualize this new capability within Turla’s ever-growing arsenal.

STOCKSTAY Overview

STOCKSTAY is a multi-component backdoor written in .NET, using the Windows Forms framework, which communicates with its command and control (C2) via a secure WebSocket connection, utilizing the open-source websocket-sharp library. STOCKSTAY consists of several distinct components that communicate with one another via an inter-process communication (IPC) channel, based on the exchange of WM_COPYDATA messages.

STOCKSTAY was originally designed to masquerade as a stock market data viewing tool, incorporating this disguise in both its file naming scheme and its storage of implant configuration, control messages, and response data. While initial versions of the malware observed by GTIG retained the internal aspects of this disguise, in 2025 we identified variants of STOCKSTAY masquerading as other benign applications, such as PDF viewers and calculator utilities.

Figure 1: Overview of STOCKSTAY malware architecture

STOCKSTAY.STOCKBROKER

STOCKSTAY.STOCKBROKER is a proxy-aware tunneler which provides network communication capabilities to the wider STOCKSTAY ecosystem. STOCKSTAY.STOCKBROKER, internally referred to as "net", can be instructed to establish a secure WebSocket connection to a specified remote server, after which it acts as a relay between the server and the STOCKSTAY.STOCKMARKET orchestrator. As a result, all C2 communication between STOCKSTAY and the configured C2 server are handled by STOCKSTAY.STOCKBROKER, isolating the malware’s network communications from other malicious host-based activity on the infected machine.

STOCKSTAY.STOCKMARKET

STOCKSTAY.STOCKMARKET, internally referred to as “cor”, is the orchestrator of the STOCKSTAY ecosystem, and enables the implant’s configurability. The malware’s configuration is loaded from an encrypted on-disk configuration file which specifies several options regarding the malware’s execution, including the details of the remote WebSocket server required by STOCKSTAY.STOCKBROKER. The configuration file attempts to disguise itself as a legitimate file by including various legitimate URLs associated with cryptocurrency markets, as well as falsified descriptions of each configuration field (Figure 2). Encrypted configuration data is embedded within the decoy fields, which is decrypted by STOCKSTAY.STOCKMARKET.

{
  "Name": "StockMarket",
  "Description": "An application for getting information about current events on trading platforms. To set the time for updating information, enter a value in minutes in the `Interval` field. In the future, support for themes will be added. The `SystemConfiguration` field stores the system settings of the application. In the `services` field, fill in the list of addresses of services that provide the `WebSocket protocol`.",
  "Theme": "Dark",
  "SystemConfiguration": [
    "1D.AA.79.9F.45.AA.04.B3..68.0A.5D.A3.E6.A3.82.FA",
    "6F.41.4D.6D.C3.20.E5.32..00.B8.26.DF.E1.13.0A.21",
    "4.4.3.12"
  ],
  "Interval": 10,
  "Services": [
    "wss://ws-api.binance.com:443/ws-api/v3",
    "wss://ws-feed.exchange.coinbase.com",
    "wss://ws-feed-public.sandbox.exchange.coinbase.com",
    "wss://stream.bybit.com/v5/public/spot",
    "wss://stream.bybit.com/v5/public/linear"
  ],
  "Version": "2022-12-21"
}

Figure 2: Encrypted STOCKSTAY configuration file format, falsely describing itself as an application for trading information

{
  "internal_id": "",
  "internal_key": "",
  "interval_engine": "600000",
  "level_info": "0",
  "time_scale": "1",
  "span_min": "9",
  "span_max": "18",
  "rate": "2700",
  "rate_control": "false",
  "service": "",
  "days_not_work": "Saturday;Sunday;",
  "system_properties": "eyJzeXN0ZW1fZGF0YV9zaXplIjoiNDAwMDAwIn0="
}

Figure 3: Decrypted STOCKSTAY configuration file format (extracted from SystemConfiguration field)

STOCKSTAY.STOCKMARKET communicates with STOCKSTAY.STOCKBROKER in order to provide details of the WebSocket server, and to subsequently send and receive messages via the established WebSocket connection, usually containing the results of executed commands. STOCKSTAY.STOCKMARKET also communicates with the STOCKSTAY.STOCKTRADER component in order to issue commands to be executed on the infected host.

On first execution, STOCKSTAY.STOCKMARKET generates a unique 4096-bit RSA key pair, to be used throughout the implant’s lifecycle to encrypt outbound data prior to being sent via WebSocket. The implant’s public key is sent to the server in the malware’s first request, to enable the server to decrypt task responses. STOCKSTAY.STOCKMARKET also generates a unique infection identifier to be used by the C2 server to determine the intended receiver of tasking. STOCKSTAY’s configuration file specifies an “internal_id” field, which GTIG assesses represents an identifier for the server-side component of the malware ecosystem. We assess that this identifier is used by the malware’s operators to retrieve responses from interim C2 servers which may be used by multiple operators. To date, GTIG has observed only a single unique value for this identifier and is unable to determine whether multiple operators are leveraging STOCKSTAY at this time due to insufficient telemetry.

STOCKSTAY.STOCKTRADER

STOCKSTAY.STOCKTRADER, internally referred to as “sys”, is the backdoor component of the STOCKSTAY ecosystem, and supports a range of registry, file, and command execution operations on the infected host, as detailed in Table 1.

Task Command Name	Description
`Del`	Delete the specified files. Requires a semi-colon-separated list of file paths, each of which will be deleted. Confirmation of each deleted file, or deletion failure, is returned to the C2.
`Dir`	Generate a listing of the specified directories. Requires a semi-colon-separated list of directory paths, each of which will be enumerated with the paths of all contained files and subdirectories being returned to the C2. Optionally performs recursive directory listing.
`Get`	Retrieve one or more specified files. Allows for collection of files with specific extensions. Requires a semi-colon-separated list of file or directory paths, and a list of target file extensions. If a file path is included in the list, this file will be returned. If instead a directory path is included in the list, the malware will perform an optionally recursive search of the directory to identify any files matching the target file extensions. All files matching either the specified file paths, or the target file extensions, will be added to an in-memory ZIP archive and subsequently base64-encoded for transmission to the C2.
`Image`	Perform a screen-capture of the victim’s screen. The resultant image is base64-encoded for transmission to the C2.
`MkDir`	Create one or more directories. Requires a semi-colon-separated list of directory paths, each of which will be created. Confirmation of each created directory, or any resultant error, is returned to the C2.
`MultyTask`	Process multiple tasks at once. Requires a semi-colon-separated list of tasks, each of which must be a serialized JSON object containing an individual task. Each task is submitted to the malware’s command-manager in-turn, with all command output being discarded; no data is returned to the C2 when processing multiple tasks at once.
`Put`	Upload a file to the device. Requires a base64-encoded string representation of the file content to be written to the specified filepath. The required file write operation is performed in “Append” mode. Confirmation of file upload, or details of any relevant error, is returned to the C2.
`RegDelete`	Delete a registry value. Requires a registry key and corresponding value name to delete.
`RegRead`	Read a registry value. Requires a registry key and corresponding value name to read.
`RegWrite`	Set a registry value. Requires a registry key and corresponding value name, as well as the value and data type used to populate the registry value.
`RmDir`	Delete the specified directories. Requires a semi-colon-separated list of directory paths, each of which will be deleted. Confirmation of each deleted directory, or deletion failure, is returned to the C2.
`Run`	Execute a new process. Requires a path to the file to execute and its corresponding arguments. A default timeout of 60 seconds is hard-coded into the malware, however this can be overridden by the task configuration. All subprocesses are created windowless with redirected stdout.
`Sysinfo`	Conduct a system survey to gather key information about the infected host. Operating system information is collected via the Windows Management Instrumentation (WMI) ManagementObjectSearcher, specifically the following fields: OSVersion Architecture SerialNumber CodeSet CountryCode Locale InstallDate BootupTime MachineName SystemDirectory LocalTime AnsiCodePage UserName With respect to hardware, WMI is queried for the following: ProcessorName NumberCores ClockSpeed MemoryCapacity MemoryType DiskModel DiskSize The malware also captures a list of the names of running processes.
`UnpackArchive`	Extract the specified ZIP file to its current directory.

Table 1: Backdoor commands supported by STOCKSTAY.STOCKTRADER

Related Downloaders and Installers

STOCKSTAY.MARKETMAKER

STOCKSTAY.MARKETMAKER is a proxy-aware downloader written in .NET using the Windows Forms framework that downloads and extracts additional payloads from a remote server, establishes persistence through Windows registry modifications, and runs silently in the background with no user interface. This downloader has been observed masquerading as "MicrosoftUpdateOneDrive" to appear legitimate while setting up multiple autorun entries to execute the core components of STOCKSTAY.

.NET AppDomainManager

During our analysis, GTIG identified what we believe to be an early development sample of STOCKSTAY.MARKETMAKER which, instead of downloading the required components, was dependent on external mechanisms (such as .NET AppDomainManager injection) for the initial deployment of samples to the target host.

STOCKSTAY Server-Side Controller

GTIG identified a publicly accessible GitHub repository containing a Python implementation of the victim-facing STOCKSTAY WebSocket server controller. The lightweight design of the server component appears to supplement the threat actor’s usage of third-party hosting platforms such as Render platform which provides a platform for hosting web services, including WebSockets. The inability for the server to decrypt inbound messages prevents introspection by platform operators, and further obfuscates the location of the threat actor’s dedicated infrastructure. This architecture somewhat resembles Turla’s multi-hop KAZUAR C2 infrastructure.

Figure 4: Overview of STOCKSTAY C2 Infrastructure

The server extends tornado.websocket.WebSocketHandler to provide the interface described in Table 2, under the path /ws; aligning with all observed STOCKSTAY WebSocket C2 URLs.

Event	Description
WebSocketHandler.check_origin	Hard-coded to return True to accept all cross-origin traffic.
WebSocketHandler.open	Logs the client’s IP address using the following string format: `WebSocket open. IP: {client_ip}`
WebSocketHandler.on_message	Handles inbound messages from the connected client. Inbound messages are base64-decoded before being parsed as JSON into an object internally known as a “package”. Each “package” contains an “action” and a “container”, which provide the request’s type and associated data, respectively. The following describes the handling logic of each action type. Action: send The server extracts the following attributes from the inbound message’s “container” and inserts them into a new row within the local `weather_data` database table. `container.target` The STOCKSTAY client populates this field with the `internal_id` or `i_id` field from the config file. `container.sender` The STOCKSTAY client populates this field with the unique client uuid generated on first execution. `container.message` This field contains the encrypted message body in a format referred to within the STOCKSTAY client as “CryptoContainer”. On completion, the server logs the following message: `Action: send; trgt={target_id}; sndr={sender_id}` Action: recv Inbound `recv` requests simply specify the `container.sender` attribute, which corresponds with the client’s unique identifier. The server then retrieves all messages from the `weather_data` database table where the target identifier (“degrees” column) matches the specified `container.sender`. This has the effect of allowing the client to retrieve all messages intended for it, such as those sent to the server by an upstream C2 controller. Each matching row is returned to the client in the following format, before being deleted from the database. `{ "target": degrees, "sender": pressure, "message": wdata, "ip": coords, "time": datetime }` On completion, the server logs the following message: `Action: recv; sndr={sender}`
WebSocketHandler.on_close	Logs the client’s IP address using the following string format: `WebSocket close. IP: {client_ip}`

Table 2: Overview of STOCKSTAY WebSocket Server Interface

Database Structure

The server maintains a local SQLite3 database under the filename weather_data1.db, structured as shown in Tables 3 and 4.

Column	Description
`id`	Primary key
`degrees`	Recipient's UUID from `container.target`
`pressure`	Sender's UUID from `container.sender`
`wdata`	Message data from `container.message`
`coords`	Sender's IP address, extracted from `X-Forwarded-For` header, or `none_ip` if no sender specified.
`status`	Defaults to 0 - doesn't appear to be used or returned to the client.
`datetime`	Time of row creation

Table 3: weather_data database table structure

Column	Description
`id`	Primary key
`data`	Log message
`datetime`	Time of creation

Table 4: log database table structure

Key Operational Characteristics

Consistent Use of Academic or Diplomatic Lure Content

The threat actor(s) involved in STOCKSTAY operations appear to have an affinity for integrating academia and diplomacy into their infrastructure and lure/decoy content, including:

compromising an email account belonging to a Ukrainian university to disseminate phishing emails;
using the names of an academic institution within the file name of a malicious RDP file;
compromising a diplomatic education platform for phishing and distribution of malicious RDP files;
using “education” and “diplo” within registered phishing domains; and
using “DiplomacyEduAI” as the product name within STOCKSTAY MSI files.

Persistent Ukrainian Targeting

A significant proportion of STOCKSTAY operations observed by GTIG have been targeted at Government or Military organizations within Ukraine, consistent with Russian interests in relation to the ongoing conflict between the two countries. The threat actor has been observed utilizing in-country compromised infrastructure, including compromised government services, to deploy both STOCKSTAY and a range of supplementary payloads, in support of these operations.

Suspected European Targeting

A smaller number of STOCKSTAY operations observed by GTIG appear to have been targeted at European entities. Early development samples of STOCKSTAY were identified in various European nations, including Italy, the Netherlands, Poland, and Germany; however, we have been largely unable to confirm the intended victims for the majority of these early infections, nor whether these samples were identified as a result of the threat actor testing their capabilities against publicly available virus scanning services such as VirusTotal. GTIG was able to identify, in at least one case, the targeting of entities associated with, or interested in, a foreign affairs ministry in Europe in relation to phishing and suspected STOCKSTAY activity.

Deployment via Malicious RDP Files

GTIG observed STOCKSTAY being deployed following successful phishing attempts using malicious RDP configuration files. The RDP files were designed to create a connection from the victim’s device to actor-controlled infrastructure, through which the actor could then deploy subsequent payloads.

In one operation in early 2025, GTIG identified a phishing email, claiming to be sent by a defense-related training academy, containing a malicious RDP file attachment. A short time following the victim’s connection to the actor’s infrastructure, the actor deployed STOCKSTAY.MARKETMAKER, a .NET downloader designed to retrieve and install the full STOCKSTAY suite on the victim’s device.

Later, in mid-2025, GTIG identified similar malicious RDP files being hosted on a compromised diplomatic-themed education platform, luring victims into downloading and executing the file under the guise of enabling access to an online training portal. GTIG was unable to confirm whether STOCKSTAY was ultimately deployed as a result of this operation; however, overlaps in the actor’s infrastructure and education-themed lures for both operations may suggest STOCKSTAY was the intended payload.

Deployments at Multiple Stages of Operations

Through GTIG’s visibility, we have identified that the threat actor uses STOCKSTAY at multiple distinct stages of their operations.

In the first instance, the threat actor uses STOCKSTAY during operations to gain initial access into environments which haven’t yet been subject to the group’s reconnaissance activities. In these instances, STOCKSTAY is configured with hard-coded configuration passwords, which can be trivially extracted by analysts. We observed this type of infection stemming from the group’s phishing operations, where the threat actor is unable to determine exactly where in the victim’s network they are going to gain their initial foothold.

When the threat actor deploys STOCKSTAY at a later stage of operation, following reconnaissance, STOCKSTAY is configured to incorporate environmental keying for its configuration, requiring the malware to be executed either on a specific host, by a specific user, within a specific domain, or a pre-determined combination of the these attributes. This configuration implies that, at this stage, the actor knows exactly which machine is being targeted, likely through existing accesses to the target environment. This was seen within Ukrainian networks where STOCKSTAY was deployed toward the end of an operation which had previously relied heavily on the group’s other tools, such as KAZUAR.

Overlaps with KAZUAR

K1MORPHER String Obfuscation

In April 2025, GTIG observed STOCKSTAY being updated to implement a new string obfuscation mechanism, based around an obscure pseudo-random number generation algorithm named “Squirrel3”, which was presented at Game Developers Conference 2017.

GTIG later identified versions of STOCKSTAY containing some of their original class-names, which showed the code responsible for runtime string deobfuscation being contained within a class named “K1.Morpher”. Analysis of K1MORPHER shows the ability to perform runtime deobfuscation of a range of datatypes, such as strings, integers, and arrays.

In June 2025 GTIG noticed K1MORPHER code appearing in samples of KAZUAR. KAZUAR has historically used its own simple but effective code and string obfuscation techniques to evade detection, such as: the insertion of junk code; replacing static constant values with the results of XOR operations; and large quantities of unique character substitution tables. The actor’s use of K1MORPHER within STOCKSTAY appears to be trending toward mimicking KAZUAR’s multi-class obfuscation techniques, where obfuscation is handled by multiple distinct classes, as observed in suspected test builds of STOCKSTAY hosted on a compromised Cypriot website in April 2024.

Implant Architecture

Since at least 2024, KAZUAR has been observed being deployed using a multi-component architecture, whereby C2 communication, task orchestration, and task execution are managed by separate components. Within the KAZUAR ecosystem, these components are referred to as “BRIDGE”, “KERNEL”, and “WORKER”, respectively.

As of late 2023, GTIG identified a similar separation of responsibilities within the STOCKSTAY ecosystem, with the same responsibilities being separated into distinct components. C2 communication is managed by the component tracked by GTIG as STOCKSTAY.STOCKBROKER, while task orchestration and execution are handled by STOCKSTAY.STOCKMARKET and STOCKSTAY.STOCKTRADER, respectively.

Environmental Keying

Both KAZUAR and STOCKSTAY ecosystems have been observed using environmental keying to protect themselves from detection and analysis.

DIAMONDBACK, a dropper often deployed prior to KAZUAR in the execution chain, has made use of a hash of the target’s hostname in decrypting its payload, to prevent divulgence of its intentions outside of the target environment. Later versions of DIAMONDBACK can be configured to incorporate the target’s username and domain name in the hash required to decrypt the payload.

STOCKSTAY has been observed using the hash of the target’s hostname or domain name during the decryption of its configuration data, preventing disclosure of C2 infrastructure unless operating in the intended environment.

Summary of Overlaps

GTIG assesses with moderate confidence that STOCKSTAY and KAZUAR may be developed in-part by a common developer or team, with active development occurring in tandem between the two malware ecosystems. We believe that STOCKSTAY is being developed in KAZUAR’s image, with several design decisions likely spawning from the threat actor’s wealth of experience in conducting operations using this long-standing toolkit. Both ecosystems rely heavily on .NET development, and have been observed using compromised WordPress sites during various stages of their operations.

We assess with low confidence that our observations of STOCKSTAY being deployed alongside KAZUAR during active operations may be a result of the threat actor seeking to test new capabilities in active operations, particularly where they may be expecting their existing access to be remediated in the near future.

STOCKSTAY Timeline

GTIG has conducted a thorough investigation into the history of STOCKSTAY, identifying suspected development activity as far back as December 2022. What follows is our assessment of the timeline of events surrounding STOCKSTAY’s development and deployment. To assist the wider community in hunting and identifying activity outlined in this blog post, we have included indicators of compromise (IOCs) within each observed operation section, and in a GTI Collection for registered users.

Figure 5: Timeline of STOCKSTAY observations

December 2022

The version of the open-source websocket-sharp.dll bundled with the majority of observed STOCKSTAY.STOCKBROKER samples was last modified, according to timestamp information in MSI files and ZIP archives containing STOCKSTAY. Although built from an open-source library, this specific instance appears to have been compiled by the actor themselves, thus creating a uniquely identifiable artifact with which to track this malware’s continuous development.

Filename	Description	SHA-256
`websocket-sharp.dll`	Instance of open-source library used by the threat actor	`d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e`

Table 5: File indicators

September 21, 2023: Germany

An early version of STOCKSTAY was uploaded to VirusTotal from Germany, under the filename “DriversPrinterGraphic.rar”. From the archive’s timestamps, it appears as though the sample was submitted within 20 minutes of being created, likely indicating this was submitted by the malware’s developer.

This version predates the malware’s separation into distinct role-based components, instead incorporating all core functionality into a single executable: StockMarketNews.exe. Additionally, this version of STOCKSTAY contained the user interface shown in Figure 6, which enables viewing/editing of configuration options and command messages, while still presenting as a stock market utility.

Figure 6: Early STOCKSTAY user-interface

This particular STOCKSTAY sample uses a slightly different configuration file format; however, the underlying configuration options are consistent with later versions. This sample also utilizes environmental keying for its configuration file; using the lower-cased hostname of the intended target as the decryption password. GTIG has been unable to recover the password at this time.

Filename	Description	SHA-256
`DriversPrinterGraphic.rar`	RAR archive containing STOCKSTAY	`e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6`
`StockMarketNews.exe`	STOCKSTAY combined executable	`1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24`
`sample.conf`	STOCKSTAY configuration file	`1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f`

Table 6: File indicators

December 5 – 6, 2023: Netherlands

A further RAR archive containing STOCKSTAY was submitted to VirusTotal at 2023-12-06 08:52:49 from the Netherlands, under the filename “apps_libwallets_v1.3.rar”. This archive was last modified the previous day at 2023-12-05 16:47:42. This pattern may indicate that the archive was created by the individual at the end of their working day, and then submitted the following day when they returned to the office.

This instance of STOCKSTAY was the first case observed by GTIG of the malware’s core functionality being separated into distinct role-based components, using the filenames shown in Table 7.

Component	Filename
STOCKSTAY.STOCKMARKET	StockMarketView.exe
STOCKSTAY.STOCKBROKER	StockMarketNet.exe
STOCKSTAY.STOCKTRADER	StockMarketSystem.exe

Table 7: STOCKSTAY component filenames observed in December 2023

Similar to the sample observed in September 2023, this instance of STOCKSTAY also used environmental keying, however this instance used the target computer’s domain name as the configuration password. GTIG has been unable to recover the password at this time.

Filename	Description	SHA-256
`apps_libwallets_v1.3.rar`	RAR archive containing STOCKSTAY components	`81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac`
`StockMarketView.exe`	STOCKSTAY.STOCKMARKET orchestrator	`9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec`
`StockMarketNet.exe`	STOCKSTAY.STOCKBROKER tunneler	`34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b`
`StockMarketSystem.exe`	STOCKSTAY.STOCKTRADER backdoor	`0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b`
`default.conf`	STOCKSTAY configuration file	`2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7`

Table 8: File indicators

January 2024: Ukraine

GTIG conducted a review of an incident response conducted by Mandiant relating to a late-2023 compromise of a Ukrainian organization, in which we observed Turla deploying a wide range of tools into the victim’s network, including WILDDAY, DIAMONDBACK and KAZUAR, via malicious GPO installation from a compromised domain controller. This activity was accompanied by other simple scripts and backdoors to deploy malware across multiple machines in the infected organization.

During the review, GTIG identified evidence of STOCKSTAY execution on one of the hosts impacted by the infected domain controller. Multiple ZIP archives, each containing one of the core components of STOCKSTAY or its configuration, were uploaded to the domain controller. The files were found in a directory used for staging registry files used to install WILDDAY both prior to and after STOCKSTAY appeared on the host, as well as for staging output from an otherwise unknown Powershell backdoor (iclsClient.ps1) which was also observed running from the domain controller.

During this operation, an initial STOCKSTAY configuration file was deployed to the domain controller alongside the STOCKSTAY core component executables, however this file was not able to be decrypted using any known passwords or environmental identifiers. A short while later, Mandiant observed a second configuration file being deployed to the domain controller, this time encrypted using the domain name associated with the compromised network. GTIG assesses with moderate confidence that the deployment of the initial configuration file was either a mistake by the threat actor - perhaps deploying a configuration file associated with a different victim - or the result of a default or invalid configuration file being bundled with STOCKSTAY during initial deployment to prevent sensitive C2 details from being captured in the event of early detection of the malware in the victim’s environment.

The successfully decrypted configuration defined a STOCKSTAY WebSocket C2 URL of wss://wool-basalt-clock.glitch.me/ws. Additionally, the configuration specified an operational time-frame of Monday to Friday between the hours of 0900 and 1800 on the victim's system. This time-based restriction is likely intended to blend C2 communications with normal business operations in the victim's network. This same time-frame has been observed in a majority of STOCKSTAY configuration files analyzed by GTIG.

Of particular note, toward the end of this operation, Mandiant identified firewall detections relating to one of KAZUAR’s C2 endpoints. GTIG assesses, with low to moderate confidence, that the threat actor could have been aware of the suspicion surrounding its C2 and deployed STOCKSTAY as a failsafe in case KAZUAR was identified and remediated, thus enabling reinfection at a later date, in the event that STOCKSTAY remained undetected.

Indicator	Description
`wss://wool-basalt-clock.glitch.me/ws`	STOCKSTAY WebSocket C2

Table 9: Network indicators

February 2024: Italy

An MSI file configured to install STOCKSTAY was uploaded to VirusTotal at 2024-02-20 11:45:26 from Italy, under the filename “Copia.msi”. The MSI masqueraded as the ILSpy application developed by ICSharpCodeTeam, and contained a large number of legitimate benign components. The MSI installed the core STOCKSTAY components under %LOCALAPPDATA%/Programs/SMN/, and enabled persistent execution via registry run keys.

The STOCKSTAY samples contained in the MSI were compiled between January 29 and January 31, 2024, with the configuration file last being modified on February 13, 2024, just a week before being submitted to VirusTotal.

In addition to the installation of STOCKSTAY, the MSI file contains a custom MSI action named “OpenUrl”. This action has the sequence number 1 in the InstallUISequence table, indicating it should be executed before any other actions. The custom action is configured to execute the following command:

viewer.exe
https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php

When viewed, the URL contains references to elections (“elezioni”) and the Italian organization “Circolo Degli Esteri”, which according to their official website (https://www.circoloesteri.it/), was founded to “represent the Ministry of Foreign Affairs”. We do not currently assess that the actor was directly targeting Italian elections, and was instead using elections-related phishing lures to target victims. Due to limited visibility, we have been unable to identify any earlier stages of this particular operation, and cannot confirm the identity of the intended targets of any potential related phishing campaigns.

Foreign Affairs Club 1936

Approval of the 2023 Financial Statement

Analysis of the status of those registered to vote (automatically updates every 60 seconds)...
update 6:26:50

Total Voters: 915
Currently registered members with 2-tonte status: 364
Currently registered with status 4 Ready to vote: 5
Currently registered with status 3 - Voted 46
Voter turnout (votes cast on registered voters): 5.03%

Figure 7: Italian-language decoy claiming to relate to Italy’s Circolo Degli Esteri

Although inconclusive, this appears to indicate an intention to deploy STOCKSTAY against Italian-speaking individuals or organizations, specifically with a focus on foreign affairs.

In following with previous STOCKSTAY instances, this sample utilized environmental keying for its configuration file. GTIG was able to recover the domain name used to decrypt the configuration file in order to identify the WebSocket C2 address wss://wool-basalt-clock.glitch.me/ws. This matches the C2 address used in January 2024.

Filename	Description	SHA-256
`Copia.msi`	MSI containing STOCKSTAY components	`b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cff`
`StockMarketView.exe`	STOCKSTAY.STOCKMARKET orchestrator	`82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb`
`StockMarketNet.exe`	STOCKSTAY.STOCKBROKER tunneler	`249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb`
`StockMarketSystem.exe`	STOCKSTAY.STOCKTRADER backdoor	`b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5a`
`default.conf`	STOCKSTAY configuration file	`40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50`

Table 10: File indicators

Indicator	Description
`https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php`	Italian language lure relating to voting on matters related to the Italian Ministry of Foreign Affairs.
`wss://wool-basalt-clock.glitch.me/ws`	STOCKSTAY WebSocket C2

Table 11: Network indicators

March 18 – April 3, 2025: Ukraine

On April 2, 2025, GTIG identified a compromised email account sending a phishing email containing a message purporting to originate from a Ukrainian university, relating to the testing of a new distance learning environment. The threat actor attached a malicious Remote Desktop Protocol (RDP) file to the email, which upon opening resulted in a connection being established between the victim and an open RDP port (3389) hosted on the actor-registered domain chosen to imitate the same academic institution.

Once the victim connected to the actor's infrastructure, GTIG observed the actor deploying STOCKSTAY.MARKETMAKER to the client. STOCKSTAY.MARKETMAKER was configured to download a ZIP containing STOCKSTAY from a legitimate but compromised website belonging to the State Regulatory Service of Ukraine. In contrast to the majority of earlier observations, the configuration file observed during this operation was protected with a hard-coded password. This appears to correspond with this particular operation’s focus on initial access to a victim’s environment via spear-phishing, through which the specific domain or host name may not be known to the threat actor, and thus cannot be used for environmental keying. GTIG was able to identify the malware using the WebSocket C2 URL wss://weatherdataai.theworkpc.com/ws.

According to the metadata associated with the ZIP archive downloaded by STOCKSTAY.MARKETMAKER, the core STOCKSTAY components used during this operation were last modified between March 18 – 26, with the configuration file last being modified on March 31.

Filename	Description	SHA-256
`MicrosoftUpdateOneDrive.exe`	STOCKSTAY.MARKETMAKER Downloader	`da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40`
`docs.zip`	ZIP archive containing STOCKSTAY components	`9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73`
`SMEditor.exe`	STOCKSTAY.STOCKTRADER backdoor	`e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722`
`SMNet.exe`	STOCKSTAY.STOCKBROKER tunneler	`dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22`
`StockMarketView.exe`	STOCKSTAY.STOCKMARKET orchestrator	`2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0`
`fonts`	STOCKSTAY configuration file	`40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3`

Table 12: File indicators

Indicator	Description
`https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip`	Compromised State Regulatory Service of Ukraine infrastructure serving ZIP archive containing STOCKSTAY components
`wss://weatherdataai.theworkpc.com/ws`	STOCKSTAY WebSocket C2

Table 13: Network indicators

May 14, 2025: Poland

GTIG identified two samples of STOCKSTAY.STOCKBROKER being uploaded to VirusTotal on May 14, 2025 from Poland.

The first sample, named “ClientMNGR2.exe”, matched previously observed versions, however the second sample, named “GR3.exe”, was heavily obfuscated using large quantities of junk code, and a previously unknown string obfuscation mechanism. GTIG tracks this obfuscation mechanism as K1MORPHER, and we have since observed its inclusion in all core STOCKSTAY components, and within select samples of KAZUAR; increasing our confidence that STOCKSTAY exists within the same development ecosystem as other malware leveraged by Turla.

Filename	Description	SHA-256
`ClientMNGR2.exe`	STOCKSTAY.STOCKBROKER tunneler obfuscated with K1MORPHER	`d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43`
`GR3.exe`	STOCKSTAY.STOCKBROKER tunneler obfuscated with K1MORPHER	`98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397`

Table 14: File indicators

May 28 – August 8, 2025: Ukraine — Deployment via Malicious HTA

On August 8, 2025, GTIG identified a RAR archive, “calculator.rar”, being submitted to VirusTotal. The archive had been hosted on compromised infrastructure belonging to a Ukrainian IT company since at least July 22, 2025. The archive contained a malicious HTA file named “Калькулятор грошового забезпечення військовослужбовців 2025.hta” (translation: "Military personnel cash benefit calculator 2025.hta"). The HTA was designed to execute a variant of the STOCKSTAY.MARKETMAKER downloader, which was also included in the archive, using the code shown in Figure 9.

Figure 8: Lure HTML page displayed by Калькулятор грошового забезпечення військовослужбовців 2025.hta

Figure 9: JavaScript code contained in Калькулятор грошового забезпечення військовослужбовців 2025.hta

The STOCKSTAY.MARKETMAKER variant retrieved a ZIP archive, “EditorToolsPdf.zip”, containing the core STOCKSTAY components from a second compromised server located in Ukraine, this time hosting the archive within a compromised WordPress instance.

Analysis of the modification timestamps within the military calculator lure archive show that this operation dated as far back as May 28, 2025, when the majority of the contents of the “calculator_2025_files” folder were last modified. The STOCKSTAY.MARKETMAKER executable was last modified on June 5, 2025, and the malicious HTA file was modified on June 10, 2025.

Similar examination of the STOCKSTAY archive shows the configuration file being modified on June 4, 2025, while the archive itself was last modified on the compromised server on June 5, 2025. This series of events shows that the complete STOCKSTAY ZIP archive was staged on the compromised infrastructure while modifications were being made to the initial phishing lures.

GTIG has been able to confirm via a trusted third party that the original compromise of the Ukrainian server used to host the STOCKSTAY archive occurred on or before May 13, 2025.

Filename	Description	SHA-256
`calculator.rar`	RAR archive containing STOCKSTAY components	`6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342`
`Калькулятор грошового забезпечення військовослужбовців 2025.hta`	HTA lure (translated filename: “Military personnel cash benefit calculator 2025.hta”)	`0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4`
`styles.dat.exe`	STOCKSTAY.MARKETMAKER downloader	`626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459`
`EditorToolsPdf.zip`	ZIP archive containing STOCKSTAY components	`447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4`
`ViewPdf.exe`	STOCKSTAY.STOCKMARKET orchestrator	`45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893`
`ClientMNGR.exe`	STOCKSTAY.STOCKBROKER tunneler	`80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661`
`ConverterDDSNet.exe`	STOCKSTAY.STOCKTRADER backdoor	`55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c`
`fonts`	STOCKSTAY configuration file	`e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ff`

Table 15: File indicators

Indicator	Description
`https://basecon.com.ua/calculator.rar`	RAR archive containing HTA lure and STOCKSTAY.MARKETMAKER downloader
`https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip`	Compromised WordPress infrastructure hosting STOCKSTAY ZIP archive
`wss://canal1zac1a.onrender.com/ws`	STOCKSTAY WebSocket C2

Table 16: Network indicators

July 23 – 28, 2025: Actor Uses GitHub to Host STOCKSTAY MSI Files

GTIG identified a GitHub account we suspect of being used by the threat actor to test or deploy STOCKSTAY. The GitHub account, Roberto1983-ai, was created on July 23, 2025 at 12:01:03.

On July 24, 2025, the account created a public repository named msi_installer_test2, into which a single file was uploaded: DiplomacyEduAI.msi. A second repository, this time named msi_installer_test3, was created by the same user on July 28, 2025, and subsequently populated with another version of DiplomacyEduAI.msi.

Both versions of DiplomacyEduAI.msi contained core STOCKSTAY components, alongside a configuration file containing the WebSocket C2 URL wss://canal1zac1a.onrender.com/ws. GTIG has been unable to identify any active operations using these specific MSI files.

Filename	Description	SHA-256
`DiplomacyEduAI.msi`	MSI containing STOCKSTAY components	`19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9`
`DiplomacyEduAI.msi`	MSI containing STOCKSTAY components	`6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e`
`ClientMNGR.exe`	STOCKSTAY.STOCKBROKER tunneler	`80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661`
`ViewPdf.exe`	STOCKSTAY.STOCKMARKET orchestrator	`45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893`
`ConverterDDSNet.exe`	STOCKSTAY.STOCKTRADER backdoor	`d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3`
`fonts`	STOCKSTAY configuration file	`4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320`

Table 17: File indicators

Indicator	Description
`wss://canal1zac1a.onrender.com/ws`	STOCKSTAY WebSocket C2

Table 18: Network indicators

August 14, 2025: Actor Uses GitHub to Host STOCKSTAY Server Code

GTIG identified a second GitHub account, which was observed hosting what we assess to be server-side code for handling STOCKSTAY C2 communications. The GitHub account, ChikenFresh, was created on August 14, 2025, then almost immediately created a public repository named google-ai-labs-it, into which the suspected C2 controller code was uploaded. Our analysis of the C2 controller is included in the malware analysis section earlier in this report.

The GitHub repository name corresponds with a STOCKSTAY C2 server identified running on the Render platform, however GTIG has not observed any active operations using this infrastructure. We assess that the threat actor linked this GitHub repository to their Render account in order to utilize their WebSocket hosting capabilities.

Filename	Description	SHA-256
`server.py`	Python STOCKSTAY C2 controller	`f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed`
`models.py`	Database table definitions and models for use by `server.py`	`7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78`
`wtools.py`	Utility functions for use by `server.py`	`b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636`

Table 19: File indicators

Indicator	Description
`wss://google-ai-labs-it.onrender.com/ws`	STOCKSTAY WebSocket C2

Table 20: Network indicators

November 2025: Ukraine — Drone-Related Lures and Deployment via CVE-2025-8088

On November 6, 2025, GTIG identified a batch of phishing emails being sent from a drone-themed UKR.NET email account, to approximately 20 Ukraine-based targets, each containing a unique ukr.net file sharing link. Each link led to a malicious RAR archive which exploits a path traversal vulnerability in WinRAR (CVE-2025-8088) to install the core STOCKSTAY components. Continuations of this phishing activity were observed on November 12 and 14, 2025. We identified that only around 30% of the recipients of these phishing emails opened the emails, however we are unable to confirm how many of these individuals downloaded or executed the malicious payloads. All affected Google accounts were marked for additional authentication checks as a precautionary measure against potential account compromise. Google also notified affected users via our Government Backed Attack Warning (GBAW) notifications.

GTIG identified two distinct types of Ukrainian-language decoy documents within the malicious RAR archives, both appearing to target Ukrainian military personnel. The first, “Донесення БпЛА 06.11.2025.docx” (“UAV report 06.11.2025.docx”), claimed to be “[A] Report on the availability/need for UAVs, their condition, the availability of crews for each UAV in the units, their training in the defense zone of the 1st Brigade as of 06.11.2025” (see Figure 10).

Figure 10: “Report” Decoy document from November 2025

The second decoy, observed as “Товари(докладніше).docx” (“Products (more details).docx”) and “Приклади товарів для листа (деталізовано).docx” (“Examples of products for the letter (detailed).docx”), predominantly comprised of an equipment list referencing: “Tactical medicine”; “Communication and surveillance equipment”; “Equipment and survival equipment”; and “Automotive property” (see Figure 11).

Figure 11: “Equipment List” Decoy document from November 2025

Each of the decoy documents contained an external image reference that causes a connection to be made from the victim’s machine to a site likely monitored by the threat actor, signaling that the document has been opened. GTIG believes the URLs referenced by the decoy documents may be hosted on compromised infrastructure.

GTIG identified that the instances of STOCKSTAY observed being deployed during this operation contained enhancements intended to increase resistance to detection, specifically by carving out functionality into external modules. These external modules were named to imitate legitimate Windows libraries, using the filenames shown in Table 20.

Component	Filename
STOCKSTAY.STOCKMARKET	`MSViewer.exe`
Shared STOCKSTAY core module	`ms-lib-math-core.dll`
STOCKSTAY.STOCKBROKER	`MSDriver.exe`
STOCKSTAY.STOCKBROKER core module	`ms-api-wmcpdt.dll`
STOCKSTAY.STOCKTRADER	`MSRender.exe`
STOCKSTAY.STOCKTRADER core module	`ms-api-win-render.dll`

Table 21: STOCKSTAY component filenames observed in November 2025

GTIG observed two distinct STOCKSTAY WebSocket C2 URLs being used during this phishing wave. The majority of instances used the URL wss://driverx86-adobe.onrender.com/ws; however, we were able to identify at least one instance of STOCKSTAY using wss://google-ai-labs-it.onrender.com/ws, corresponding to the previously described GitHub repository associated with the ChikenFresh user.

Alongside the core STOCKSTAY components, the malicious RAR archives contained LNK files, described as “Updater Shortcut”, corresponding to each core STOCKSTAY component. The extraction file path was configured to attempt to deploy into the startup programs directory.

GTIG was able to identify that the actor began creating the LNK files for this operation approximately six hours prior to the first phishing emails being sent, with the Ukrainian-language lure documents being created around four hours prior.

Filename	Description	SHA-256
`MSViewer.exe`	STOCKSTAY.STOCKMARKET orchestrator	`a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ce`
`MSViewer.exe`	STOCKSTAY.STOCKMARKET orchestrator	`e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8`
`MSDriver.exe`	STOCKSTAY.STOCKBROKER tunneler	`c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9`
`MSRender.exe`	STOCKSTAY.STOCKTRADER backdoor	`667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38`
`ms-lib-math-core.dll`	Module containing core crypt and obfuscation routines, historically found within core STOCKSTAY components	`b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89`
`ms-api-win-render.dll`	Module containing backdoor command handlers, historically found within STOCKSTAY.STOCKTRADER	`1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851`
`ms-api-wmcpdt.dll`	Module containing STOCKSTAY’s IPC logic, historically found within each STOCKSTAY component	`e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714`
`MSViewer.lnk`	LNK shortcut intended to execute STOCKSTAY.STOCKMARKET	`3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14`
`MSRender.lnk`	LNK shortcut intended to execute STOCKSTAY.STOCKTRADER	`77417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167`
`MSDriver.lnk`	LNK shortcut intended to execute STOCKSTAY.STOCKBROKER	`813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5`
`fonts`	STOCKSTAY configuration file	`e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3`
`fonts`	STOCKSTAY configuration file	`f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da`

Table 22: File indicators

Indicator	Description
`wss://driverx86-adobe.onrender.com/ws`	STOCKSTAY WebSocket C2
`wss://google-ai-labs-it.onrender.com/ws`	STOCKSTAY WebSocket C2

Table 23: Network indicators

Attribution

GTIG attributes the STOCKSTAY ecosystem and related activity to threat clusters assessed with high confidence links to Turla, based on the following:

STOCKSTAY uses Windows-1251 during command-processing - an encoding notably designed specifically to support Cyrillic script. This is indicative of a development or operational environment linked to Eastern Europe, the Balkans, or Central Asia.
STOCKSTAY has code overlaps with KAZUAR, a widely-attributed proprietary Turla toolkit, based on the recent introduction of K1MORPHER string obfuscation into both malware families within a similar time window.
GTIG observed STOCKSTAY being delivered from compromised infrastructure which was also identified as hosting part of Turla’s victim-facing KAZUAR C2 infrastructure.

Turla has a consistent focus on targeting Ukrainian Defense and Military organizations, and was identified within a Mandiant Incident Response deploying STOCKSTAY alongside a range of other proprietary Turla malware, such as WILDDAY, DIAMONDBACK, and KAZUAR.

Detections

Google Security Operations (SecOps)

SecOps customers will have access to the following pending-deployment rules. Once fully deployed, these rules will be available under the Mandiant Frontline Threats, Mandiant Hunting and Mandiant Intel Emerging Threats rule packs:

Archiver Extraction To Windows Startup
Registry Write Registry Run Keys
Registry Write to Run Registry Key
Potential RDP File Write From Phishing
RDP Connection Initiated from Staging Directory
Onrender Subdomain Suspicious DNS Query

YARA Rules

rule G_Backdoor_STOCKSTAY_ConfigurationFile_2 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects encrypted configuration files associated with STOCKSTAY."
        hash = "40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3"

    strings:
        $s1 = "\"SystemConfiguration\""
        $s2 = "An application for getting information about current events on trading platforms"
        $s3 = "To set the time for updating information, enter a value in minutes in the `Interval` field"
        $s4 = "The `SystemConfiguration` field stores the system settings of the application."
        $s5 = "In the `services` field, fill in the list of addresses of services that provide the `WebSocket protocol`."
        $s6 = "wss://"

    condition:
        uint16(0) == 0x227B  // {"
        and 4 of ($s*)
}

rule G_Backdoor_STOCKSTAY_ConfigurationFile_3 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects early configuration files associated with STOCKSTAY."
        hash = "1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f"

    strings:
        $key_required_1 = "\"List 1\""
        $key_required_2 = "\"List 2\""
        $key_required_3 = "\"List 3\""
        $key_dummy_1 = "\"BinanceApi\""
        $key_dummy_2 = "\"CoinbaseCloudApi\""
        $key_dummy_3 = "\"CoinbaseCloudApi Sandbox\""
        $key_dummy_4 = "\"ByBitApi Spot\""
        $key_dummy_5 = "\"ByBitApi Linear\""
        $key_dummy_6 = "\"Info level\""
        $key_dummy_7 = "\"Rate info\""
        $key_dummy_8 = "\"Info level\""

    condition:
        uint8(0) == 0x7B  // {
        and filesize > 500
        and all of ($key_required_*)
        and 3 of ($key_dummy*)
}

rule G_Backdoor_STOCKSTAY_ConfigurationFile_5 {
  meta:
    author = "Google Threat Intelligence Group"
    description = "Detects plaintext configuration files used by the STOCKSTAY malware family."
    hash = "6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b"

  strings:
    $internal_id_1 = "\"internal_id\""
    $internal_id_2 = "\"i_id\""
    $internal_key_1 = "\"internal_key\""
    $internal_key_2 = "\"i_k\""
    $interval_engine_1 = "\"interval_engine\""
    $interval_engine_2 = "\"ie\""
    $level_info_1 = "\"level_info\""
    $level_info_2 = "\"li\""
    $time_scale_1 = "\"time_scale\""
    $time_scale_2 = "\"ts\""
    $span_min_1 = "\"span_min\""
    $span_min_2 = "\"mx1\""
    $span_max_1 = "\"span_max\""
    $span_max_2 = "\"my1\""
    $rate_1 = "\"rate\""
    $rate_2 = "\"rt_x_y\""
    $rate_control_1 = "\"rate_control\""
    $service_1 = "\"service\""
    $service_2 = "\"srv\""
    $days_not_work_1 = "\"days_not_work\""
    $days_not_work_2 = "\"dnw\""
    $system_properties_1 = "\"system_properties\""
    $system_properties_2 = "\"sp\""

  condition:
    any of ($internal_id*)
    and any of ($internal_key*)
    and any of ($interval_engine*)
    and any of ($level_info*)
    and any of ($time_scale*)
    and any of ($span_min*)
    and any of ($span_max*)
    and any of ($rate*)
    and any of ($service*)
    and any of ($days_not_work*)
    and any of ($system_properties*)
}

rule G_Backdoor_STOCKSTAY_CryptoContainer_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects code for parsing crypto containers within STOCKSTAY components."
        hash = "82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb"

    strings:
        $s1 = "BuildCryptoContainer"
        $s2 = "ParseCryptoContainer"
        $s3 = "Windows-1251" wide
        $s4 = "AesCryptoServiceProvider"
        $s5 = "RSACryptoServiceProvider"

    condition:
        uint16(0) == 0x5a4d
        and all of them
}

rule G_Backdoor_STOCKSTAY_WindowNames_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects STOCKSTAY window names."
        hash = "dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22"


    strings:
        $import = "_CorExeMain"
        $s2 = "SMEditorPage" wide
        $s3 = "SMNetPage" wide
        $s4 = "StockMarketViewPage" wide
        $s5 = "window_system32_x128" wide
        $s6 = "window_system32_x64" wide
        $s7 = "window_system32_x32" wide

    condition:
        $import 
        and any of ($s*)
}

rule G_Downloader_STOCKSTAY_MARKETMAKER_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects STOCKSTAY.MARKETMAKER downloader based on method names and payload filenames."
        hash = "da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40"

    strings:
        $f1 = "CheckAutoRun"
        $f2 = "SetupAutoRun"
        $f3 = "DownloadAndExtractZip"
        $f4 = "GetSystemProxy"

        $s0 = "_CorExeMain"
        $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $s2 = "StockMarketView.exe" wide
        $s3 = "SMNet.exe" wide
        $s4 = "SMEditor.exe" wide

    condition:
        all of them
}

rule G_Controller_STOCKSTAY_STOCKMARKET_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects STOCKSTAY.STOCKMARKET controller based on method and field names, and SQL queries"
        hash = "2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0"

    strings:
        $f1 = "ProtocolMessageConnect"
        $f2 = "ProtocolMessageEnd"
        $f3 = "ProtocolMessagePing"
        $f4 = "ProtocolMessageRequestRecv"
        $f5 = "ProtocolMessageRequestSend"
        $f6 = "ProtocolMessageTask"
        $f7 = "ProtocolMessageTaskSysinfo"
        $f8 = "TMR_AppInit_Tick"
        $f9 = "TMR_Engine_Tick"
        $f10 = "TMR_KeepAlive_Tick"
        $f11 = "TMR_PingNet_Tick"
        $f12 = "TMR_PingSystem_Tick"
        $f13 = "GetDataTrade"
        $f14 = "GetDataNews"
        $f15 = "InsertDataTrade"
        $f16 = "InsertDataNews"
        $sql1 = "CREATE TABLE IF NOT EXISTS News (" wide
        $sql2 = "CREATE TABLE IF NOT EXISTS Trade (" wide
        $sql3 = "CREATE TABLE IF NOT EXISTS Market (" wide
        $sql4 = "INSERT INTO Market ( Guid, Version, Config, Status, Launch, Type ) VALUES (@Guid, @Version, @Config, @Status, @Launch, @Type)" wide
        $sql5 = "INSERT INTO News (Container) VALUES (@Container)" wide
        $sql6 = "INSERT INTO Trade (Container) VALUES (@Container)" wide

    condition:
        8 of ($f*)
        and any of ($sql*)
}

rule G_Tunneler_STOCKSTAY_STOCKBROKER_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects STOCKSTAY.STOCKBROKER tunneler based on known IPC message handler and variable names."
        hash = "dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22"

    strings:
        $s1 = "_CorExeMain"
        $s2 = "ProtocolMessageStatusConnection"
        $s3 = "ProtocolMessageResult"
        $s4 = "ProtocolMessageEnd"
        $s5 = "OnGetDataFromServer"
        $s6 = "webSocket"
        $s7 = "wmCopyData"
        $s8 = "tempStorage"

    condition:
        all of them
}

rule G_Backdoor_STOCKSTAY_STOCKTRADER_3 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects STOCKSTAY.STOCKTRADER backdoor based on known command handlers and FNV1a hashes."
        hash = "82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb"

    strings:
        $cmd_1 = "AppDel"
        $cmd_3 = "AppDeleteRegistryValue"
        $cmd_4 = "AppDir"
        $cmd_5 = "AppGet"
        $cmd_6 = "AppMkdir"
        $cmd_7 = "AppPut"
        $cmd_8 = "AppReadRegistryValue"
        $cmd_9 = "AppRegistryKeyExists"
        $cmd_10 = "AppRmdir"
        $cmd_11 = "AppRun"
        $cmd_12 = "AppWriteRegistryValue"
        $cmd_13 = "AppUnpackArchive"
        $cmd_14 = "ArchiveFiles"
        $cmd_15 = "GetFiles"
        $cmd_16 = "Sysinfo"
        
        $hash_1  = {ea8e5e34}
        $hash_2  = {3445694e}
        $hash_3  = {f73e97b6}
        $hash_4  = {9aa70c59}
        $hash_5  = {18b496c9}
        $hash_6  = {0f716ebc}
        $hash_7  = {8e2d79ce}
        $hash_8  = {3ae2a963}
        $hash_9  = {35d26840}
        $hash_10 = {6c41d6bc}
        $hash_11 = {1fdbbb2f}
        $hash_12 = {6ae6578d}
        $hash_13 = {66732be7}
        $hash_14 = {0b113b3d}

    condition:
        uint16(0) == 0x5a4d
        and (
            12 of ($cmd*)
            or 10 of ($hash*)
        )
}

rule G_Hunting_K1MORPHER_1 {
  meta:
    author = "Google Threat Intelligence Group"
    description = "Detects plaintext class and method names associated with the .NET class K1.Morpher"
    hash = "45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893"

  strings:
    $plain_api_1 = "Squirrel3"
    $plain_api_2 = "DecryptArraySimple"
    $plain_api_3 = "DecryptIntSimple"
    $plain_api_4 = "DecryptLongSimple"
    $plain_api_5 = "DecryptFloatSimple"
    $plain_api_6 = "DecryptStringSimple"
    $plain_api_7 = "DecryptDoubleSimple"
    $plain_api_8 = "_squ_ui1"
    $plain_api_9 = "_squ_ui2"
    $plain_api_10 = "_squ_ui3"
    $plain_api_11 = "InjectedSeedCipher"

  condition:
    dotnet.is_dotnet
    and 5 of ($plain_api*)
}

rule G_Hunting_K1MORPHER_2 {
  meta:
    author = "Google Threat Intelligence Group"
    description = "Detects the Squirrel3 RNG implemented within K1.Morpher"
    hash = "45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893"

  strings:
    $squirrel3_code_1 = {
      00 // nop
      03 // ldarg.1
      0A // stloc.0
      06 // ldloc.0
      7E ??????04 // ldsfld 
      5A // mul
      0A // stloc.0
      06 // ldloc.0
      02 // ldarg.0
      58 // add
      0A // stloc.0
      06 // ldloc.0
      06 // ldloc.0
      1E // ldc.i4.8
      64 // shr.un
      61 // xor
      0A // stloc.0
      06 // ldloc.0
      7E ??????04 // ldsfld 
      58 // add
      0A // stloc.0
      06 // ldloc.0
      06 // ldloc.0
      1E // ldc.i4.8
      62 // shl
      61 // xor
      0A // stloc.0
      06 // ldloc.9
      7E ??????04 // ldsfld 
      5A // mul
      0A // stloc.0
      06 // ldloc.0
      06 // ldloc.0
      1E // ldc.i4.8
      64 // shr.un
      61 // xor
      0A // stloc.0
      06 // ldloc.0
      0B // stloc.1
      2B 00 // br.s 40
      07 // ldloc.1
      2A // ret
    }

  condition:
    dotnet.is_dotnet
    and all of them
}

rule G_Hunting_K1MORPHER_3 {
  meta:
    author = "Google Threat Intelligence Group"
    description = "Detects the Squirrel3 RNG implemented within K1.Morpher"
    hash = "391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e"

  strings:
    $squirrel3_code_1 = {
      03 // ldarg.1
      7E??????04 // ldsfld 
      5A // mul
      02 // ldarg.0
      58 // add
      25 // dup
      1E // ldc.i4.8
      64 // shr.un
      61 // xor
      7E??????04 // ldsfld 
      58 // add
      25 // dup
      1E // ldc.i4.8
      62 // shl
      61 // xor
      7E??????04 // ldsfld 
      5A // mul
      25 // dup
      1E // ldc.i4.8
      64 // shr.un
      61 // xor
      2A // ret
    }

  condition:
    dotnet.is_dotnet
    and all of them
}

Acknowledgements

This analysis would not have been possible without the assistance of Gabby Roncone for technical review. We also appreciate GitHub for their collaboration against this threat.

Examining the Glassworm Takeover with Tillmann "Bot Slayer" Werner

Thu, 25 Jun 2026 13:18:42 +0200

Author: CrowdStrike - Bewertung: 0x - Views:4

He’s back, and he’s ready to talk botnet takeovers.

Tillmann Werner, VP of Intelligence Production at CrowdStrike, returns to the podcast to discuss CrowdStrike’s coordinated takeover of the Glassworm botnet. Glassworm was a global threat targeting software developers through the open-source supply chain. This infection vector stood out — open-source ecosystems are based on trust, and adversaries are learning they can reach a vast pool of victims by compromising the supply chain. Some open-source libraries get 100 million downloads per week.

Glassworm was described as an “unkillable” botnet. Resilience was built into its design, which relied on four different command-and-control channels. This made the takeover complicated because a botnet can’t be taken over until all command-and-control mechanisms are suppressed.

“Once it’s down, you gotta make sure it’s down,” said Adam, who calls Tillmann the “bot slayer.”

In this episode, they get into the details: what Glassworm was after, how its unknown operators strengthened its infrastructure, and the planning and execution behind the takeover. Tillmann and his team facilitated the process by conducting extensive technical analysis, understanding Glassworm’s evolution, and spotting the opportunity to disrupt it. They worked with partners across the private and public sectors, as well as internally at CrowdStrike, to do it safely and avoid disrupting critical systems.

Come for the behind-the-scenes details, and stay for the debate around baking the perfect pizza in this episode of the Adversary Universe podcast.

Learn more in our blog: https://cs.link/uqUHf

🔗 Links:

🎧 Spotify: https://cs.link/uissX
🎧 Apple Podcasts: https://cs.link/uissY
🎧 Our site: https://cs.link/uissZ

📣 Connect With Us:

► X:
https://twitter.com/CrowdStrike
► Instagram:
https://www.instagram.com/crowdstrike
► LinkedIn:
https://www.linkedin.com/company/crowdstrike

🔔 Subscribe to stay updated!

#CrowdStrike #AdversaryPodcast #Glassworm

ESET takes part in Operation Endgame to disrupt Amadey and Stealc

Thu, 25 Jun 2026 04:08:24 +0200

ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights This article has been indexed from WeLiveSecurity Read the original article: ESET takes part in Operation Endgame to…

The post ESET takes part in Operation Endgame to disrupt Amadey and Stealc appeared first on IT Security News.

ESET takes part in Operation Endgame to disrupt Amadey and Stealc

Thu, 25 Jun 2026 03:37:36 +0200

ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights

Was ist ein Keylogger?

Tue, 23 Jun 2026 06:05:05 +0200

Keylogger sind Malware der alten Schule. Lesen Sie, wie die Tools zur Tastaturüberwachung funktionieren und warum sie nicht nur etwas für Cyberkriminelle sind.

IM_photo | shutterstock.com

Auch wenn Keylogger schon etliche Jahre auf dem Buckel haben: Sie sind immer noch beliebt und werden häufig im Rahmen großangelegter Cyberangriffe eingesetzt.

Keylogger – Definition

Der Begriff Keylogger bezeichnet eine Art von Überwachungssoftware, die die Tastatureingaben eines Benutzers aufzeichnet. Die Schadsoftware sendet die Daten, die beim Keylogging erfasst werden, an einen Dritten.

Cyberkriminelle nutzen Keylogger, um an persönliche Daten oder sensible Finanzinformationen zu gelangen, die sie dann verkaufen oder anderweitig gewinnbringend nutzen können. Es gibt jedoch auch legitime Verwendungszwecke für Keylogger in Unternehmen – zum Beispiel beim Troubleshooting, dem Optimieren der Benutzerfreundlichkeit oder um Mitarbeiter legal zu überwachen (je nachdem, welchen Gesetzen sie dabei unterliegen). Darüber hinaus nutzen Strafverfolgungsbehörden und Geheimdienste Keylogging zu Überwachungszwecken. Mehr dazu lesen Sie im Absatz “Einsatzzwecke”.

Keylogger – Funktionsweise

“Keylogger sind Programme, die Algorithmen nutzen, um die Tastaturanschläge durch Mustererkennung und andere Techniken zu überwachen”, erklärt Tom Bain, Vice President Security Strategy bei Morphisec. Der Umfang der von der Keylogger-Software gesammelten Informationen kann dabei variieren: Einfache Formen erfassen nur die Informationen, die auf einer (einzigen) Website oder in einer Anwendung eingegeben werden. Hochentwickelte Keylogging-Programme zeichnen hingegen alles auf (einschließlich der Daten, die bei Copy-Paste-Aktionen anfallen), unabhängig von der Anwendung. Einige Keylogger-Varianten – insbesondere solche, die auf mobile Geräte abzielen – gehen noch weiter und erfassen auch Anrufe (sowohl Anrufverlauf als auch Audio), Informationen aus Messaging-Anwendungen, GPS-Standorte, Screenshots und sogar Mikrofon- und Kameraaufnahmen.

Keylogger können hardware- oder softwarebasiert aufgebaut sein:

Hardwarebasierte Keylogger werden einfach zwischen Tastatur und Computer geschaltet.
Bei softwarebasierten Keyloggern kann es sich um Applikationen oder Tools handeln, die legal oder illegal installiert werden, in letzterem Fall also das Gerät unwissentlich mit Malware infizieren.

Die beim Keylogging erfassten Daten werden von der Software per E-Mail oder durch den Upload von Protokolldaten in vordefinierte Websites, Datenbanken oder FTP-Server an den Angreifer zurückgesendet. Ist der Keylogger Instument in einem großen Cyberangriff, ist es sehr wahrscheinlich, dass die Kriminellen sich per Fernzugriff einloggen können, um die Tastaturanschlagsdaten herunterzuladen.

Keylogger – Einsatzzwecke

Die ersten Keylogger wurden bereits in den 1970er Jahren vom sowjetischen Geheimdienst eingesetzt (mehr dazu später). Auch diese frühen Keylogger zeichneten auf, was getippt wurde und schickten die Informationen über Funksignale an den KGB zurück.

Wie Cyberkriminelle Keylogger einsetzen

Heute gehören Keylogger zum gängigen Instrumentarium Cyberkrimineller, um finanzielle Informationen wie Bank- und Kreditkartendaten, persönliche Informationen wie E-Mail-Adressen, Passwörter oder sensible Geschäftsinformationen über Prozesse und geistiges Eigentum zu entwenden. Je nach Art der gesammelten Daten (und den Motiven der Angreifer) werden die Informationen auf Darknet-Marktplätzen feilgeboten oder im Rahmen eines größeren Angriffs wiederverwendet.

“Wenn ein Keylogger in der Lage ist, die Tastenanschläge eines Datenbankadministrators in einem großen Unternehmen aufzuzeichnen, eröffnet das dem Angreifer Zugang zu Endpunkten und Servern, die wiederum viele sensible Informationen preisgeben können, die sich zu Geld machen lassen“, erklärt Security-Spezialist Bain.

Keylogger am Arbeitsplatz

Es gibt auch einen großen Markt für legale Keylogging-Apps, wenngleich diese meist ethisch fragwürdig sind. Sie können etwa genutzt werden, um Familienmitglieder, Partner oder Arbeitnehmer auszuspionieren. Wenn der Benutzer eines Geräts davon weiß, dass Spyware auf seinem Gerät läuft, ist das in vielen Ländern legal. Anwendungen, die Informationen über das Arbeitsverhalten sammeln, sind allerdings nicht nur aus moralischen, sondern auch aus Sicherheitsgründen mit Vorsicht zu genießen. Der Spyware-Anbieter mSpy wurde beispielsweise überführt, in mehreren Fällen unabsichtlich Millionen Datensätze von Opfern einer Ausspähung veröffentlicht zu haben.

Überwachungssoftware dieser Art, die manchmal auch als “Corporate Keylogging” bezeichnet wird, kann indes für Testing, Debugging und die Verbesserung der User Experience nützlich sein. “In einer seriösen Umgebung werden Keylogger beispielsweise eingesetzt, um zu überprüfen, ob IT-Sicherheits- und Compliance-Vorschriften eingehalten werden”, weiß Simon Sharp, International Vice President beim Sicherheitsanbieter ObserveIT. “Ein Administrator kann dann sofort feststellen, wer ein bestimmtes Wort oder einen bestimmten Wert eingegeben hat, der mit einem Sicherheitsvorfall in Verbindung steht. So kann er verstehen, wer wann und warum gegen eine Richtlinie verstoßen hat.”

Die IT-Abteilung kann die Tastaturanschlagsdaten nutzen, um Benutzerprobleme zu identifizieren und zu beheben. Darüber hinaus können die Keylogging-Daten möglicherweise zusätzliche forensische Informationen nach einem Sicherheitsvorfall bereitstellen. Keylogger können auch dazu genutzt werden, potenzielle Innentäter zu erkennen, die Produktivität der Mitarbeiter zu überwachen oder um sicherzustellen, dass die IT-Ressourcen des Unternehmens nur für berufliche Zwecke genutzt werden. Sämtliche erfassten Keylogging-Daten sollten verschlüsselt werden.

Keylogger – Infektionswege

Es gibt verschiedene Wege, wie Keylogger auf einem Zielsystem platziert werden können. Hardwarebasierte Keylogger erfordern eine physische Handlung des Angreifers vor Ort. Das ist meist schwierig zu bewerkstelligen – aber nicht unmöglich. Auch drahtlose Tastaturen können übrigens aus der Ferne ausspioniert werden.

Software-basierte Keylogger sind weiter verbreitet und eröffnen mehrere Zugangswege:

Infizierte Domains sind eine gängige Angriffsmethode – im Oktober 2018 wurden die .com- und .eu-Domains der Online-Bürosoftware Zoho gesperrt, nachdem sie Keylogging-Malware an Nutzer ausgeliefert hatten. Auch Tausende von WordPress-Webseiten wurden bereits über gefälschte Google-Analytics-Skripte mit Keyloggern infiziert.
Mit Malware infizierte Apps sind ebenfalls ein Problem. Der Google Play Store hatte in der Vergangenheit bereits des öfteren mit Apps zu kämpfen, die Keylogger enthielten.
Wie viele andere Arten von Malware sind auch Keylogger oft in Phishing-E-Mails eingebettet. Eine Version des HawkEye-Keyloggers wurde beispielsweise über eine E-Mail-Kampagne mit infizierten Word-Dokumenten verbreitet.
Einige andere Keylogger-Varianten, wie etwa Fauxspersky, können sich über infizierte USB-Laufwerke verbreiten.

“Die größte Innovation bei Keyloggern sind integrierte Ausweichtechniken, die es ermöglichen, die Malware an Erkennungsmechanismen wie Antivirus-Software vorbeizuschleusen”, sagt Bain. Viele Keylogger würden inzwischen in Kombination mit Ransomware, Cryptominer Malware oder Botnet-Code geliefert, so der Experte.

6 Wege, um Keylogger zu erkennen und entfernen

Die folgenden Ratschläge stellen die nach allgemeiner Auffassung wirksamsten Schritte dar, um die Auswirkungen unerwünschter Keylogger zu minimieren:

1. Ressourcen, Prozesse und Daten überwachen

Um einen Keylogger zu finden, kann es hilfreich sein, einen Blick auf die Ressourcenzuweisung, die Hintergrundprozesse und die Daten zu werfen, die vom betreffenden Gerät übertragen werden. Um zu funktionieren, benötigen Keylogger in der Regel Root-Zugriff auf den Zielrechner – ebenfalls ein verräterisches Anzeichen für eine Keylogger-Infektion.

2. Schutz aktualisieren

Da Keylogger oft mit anderen Formen von Malware gebündelt werden, kann die Entdeckung von Keylogger-Malware ein Hinweis auf einen umfassenderen Angriff sein. Aktuelle Virenschutz- und Anti-Rootkit-Lösungen entfernen bekannte Keylogger-Malware. Dennoch empfehlen sich weitere Untersuchungen, um festzustellen, ob der Vorfall Teil eines größeren Angriffs war.

3. Anti-Keylogger-Software einsetzen

Spezielle Anti-Keylogger-Software verschlüsselt Tastaturanschläge, sucht nach bekannten Keyloggern und entfernt sie. Bei ungewöhnlichem Keylogger-ähnlichem Verhalten schlägt sie Alarm. Hilfreich ist es auch, den Root-Zugriff für nicht autorisierte Anwendungen zu sperren und bekannte Spyware in die IT-Blacklist aufzunehmen.

4. Virtuelle Tastaturen nutzen

Virtuelle Onscreen-Keyboards vermindern das Keylogger-Risiko, weil sie Informationen auf andere Weise weitergeben als physische Tastaturen. Das kann sich allerdings auf die Produktivität der Benutzer auswirken. Außerdem wirkt es nicht gegen alle Arten von Keylogger und beseitigt auch nicht die Ursache des Problems.

5. Selbstausführende Dateien deaktivieren

Indem selbstausführende Dateien auf extern angeschlossenen Geräten wie etwa USB-Devices deaktiviert werden und Dateien lediglich eingeschränkt auf und von externen Rechnern kopiert werden können, lässt sich das Risiko einer Keylogger-Infektion ebenfalls verringern.

6. Strikte Richtlinien durchsetzen

Der beste Weg für Unternehmen, sich vor Keylogger-Malware zu schützen, besteht in vielschichtigen Kennwortrichtlinien und einer Mehr-Faktor-Authentifizierung für alle Unternehmenskonten und -geräte. Auch im Fall von Keylogging reicht durchschnittliche Antivirus-Technologie nicht mehr aus.

Keylogger-Historie – berühmte Beispiele

Der älteste bekannte Keylogger entstammt dem Prä-Computerzeitalter: Der sowjetische Geheimdienst entwickelte in den 1970er Jahren ein Device, das in elektrischen IBM-Schreibmaschinen versteckt werden konnte und Informationen über Tastenanschläge per Funk übermittelte. Diese frühen Keylogger wurden in US-Botschaften in Moskau und Leningrad eingesetzt.
Der erste Computer-Keylogger wurde 1983 vom damaligen Doktoranden Perry Kivolowitz als Proof of Concept entwickelt.
Ein besonders bemerkenswertes Beispiel für einen Keylogger “in freier Wildbahn” wurde 2015 “im Bundle” mit einer Modifikation für das Videospiel Grand Theft Auto V verbreitet.
Im Jahr 2017 wurde bekannt, dass Hunderte von Laptop-Modellen aus dem Hause Hewlett-Packard mit einem Keylogger ausgeliefert wurden. Das Unternehmen bestand allerdings darauf, dass es sich um ein Tool zur Diagnose der Tastaturleistung handelte, das vor der Auslieferung hätte gelöscht werden müssen.

Dieser Artikel ist im Original bei unserer Schwesterpublikation CSOonline.com erschienen.

AryStinger Botnet Hijacks 4,300+ Routers to Build Global Attack Proxy Network

Mon, 22 Jun 2026 23:35:40 +0200

A newly discovered botnet called AryStinger has quietly hijacked more than 4,300 routers across the globe, turning them into a silent army of attack proxies. The threat actors behind this campaign are exploiting decade-old vulnerabilities to build a covert reconnaissance…

The post AryStinger Botnet Hijacks 4,300+ Routers to Build Global Attack Proxy Network appeared first on IT Security News.

AryStinger Botnet Hijacks 4,300+ Routers to Build Global Attack Proxy Network

Mon, 22 Jun 2026 21:53:21 +0200

The post AryStinger Botnet Hijacks 4,300+ Routers to Build Global Attack Proxy Network appeared first on Cyber Security News.

Thousands of D-Link routers under control of AryStinger botnet

Mon, 22 Jun 2026 18:08:19 +0200

Thousands of outdated D-Link routers have been absorbed into the AryStinger botnet, with no future security updates available to protect them. This article has been indexed from Malwarebytes Read the original article: Thousands of D-Link routers under control of AryStinger…

The post Thousands of D-Link routers under control of AryStinger botnet appeared first on IT Security News.

Thousands of D-Link routers under control of AryStinger botnet

Mon, 22 Jun 2026 17:39:00 +0200

Thousands of outdated D-Link routers have been absorbed into the AryStinger botnet, with no future security updates available to protect them.

AryStinger Malware Botnet Hijacks Over 4,000 Outdated Routers for Cyberattacks

Mon, 22 Jun 2026 17:25:02 +0200

AryStinger, a fresh malware botnet, has breached over four thousand aging routers across the globe. Devices caught in its grip now serve as launchpads for online attacks, quietly repurposed without user knowledge. Detected by analysts at Qianxin’s XLab division,…

The post AryStinger Malware Botnet Hijacks Over 4,000 Outdated Routers for Cyberattacks appeared first on IT Security News.

Kommerzielle Cyber-Contractor in China: Botnets, Datenhandel und Composite Responsibility

Mon, 22 Jun 2026 16:54:50 +0200

Peking / LONDON (IT BOLTWISE) – Chinesische Cyberoperationen funktionieren zunehmend als kommerzielles Ökosystem: Private Firmen liefern Malware, Botnet-Zugänge und gestohlene Daten an staatliche Auftraggeber. Neue Analysen sprechen dabei von „composite responsibility“, weil eine Kampagne nicht mehr sauber einer einzigen APT-Bezeichnung zugeordnet werden kann. Ein Leck aus einem Umfeld, das mit Sicherheitsbehörden verknüpft ist, zeigt zudem, […]

... den vollständigen Artikel »Kommerzielle Cyber-Contractor in China: Botnets, Datenhandel und Composite Responsibility« lesen

Dieser Beitrag Kommerzielle Cyber-Contractor in China: Botnets, Datenhandel und Composite Responsibility erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

Mon, 22 Jun 2026 14:38:54 +0200

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are used to push more

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

Mon, 22 Jun 2026 14:38:45 +0200

The post ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More appeared first on IT Security News.

Thousands of D-Link and QNAP NAS routers compromised by fast-moving AryStinger malware that turns unsecured devices into a malicious proxy botnet

Mon, 22 Jun 2026 14:18:45 +0200

More than 4,000 routers have been compromised so far, while the number of poisoned NAS devices remains unknown.

CSIS darf erstmals Botnet-Geräte in Kanada per Urteil neutralisieren

Mon, 22 Jun 2026 13:51:01 +0200

OTTAWA / LONDON (IT BOLTWISE) – Kanadas Geheimdienst CSIS hat per gerichtlicher Anordnung erstmals eine Botnet-Bereinigung durchgeführt, die auch Heimrouter, Server und IoT-Geräte direkt betrifft. Das Urteil erlaubt es dem Dienst, Botnet-Daten auf kompromittierten Systemen gezielt zu verändern, zu schwächen oder zu löschen und die Geräte aus den Netzen zu lösen. Entscheidend ist dabei: Das […]

... den vollständigen Artikel »CSIS darf erstmals Botnet-Geräte in Kanada per Urteil neutralisieren« lesen

Dieser Beitrag CSIS darf erstmals Botnet-Geräte in Kanada per Urteil neutralisieren erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

Mon, 22 Jun 2026 12:39:11 +0200

A newly analyzed botnet family, AryStinger, weaponizes long‑neglected routers and NAS appliances to build a stealthy reconnaissance and relay infrastructure that helps attackers obscure origin and extend lateral reach. AryStinger leverages decade‑old vulnerabilities in RTL819X‑based routers and a more feature‑rich…

The post AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity appeared first on IT Security News.

AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

Mon, 22 Jun 2026 12:23:42 +0200

The post AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AryStinger: Recon-Proxys aus alten Routern – 4.300 Legacy-Geräte betroffen

Mon, 22 Jun 2026 12:23:36 +0200

BERLIN / LONDON (IT BOLTWISE) – Eine neue Malware-Familie namens AryStinger macht alte Home-Router zu verteilten Recon- und Proxy-Knoten. Laut Sicherheitsforschung wurden bereits mindestens 4.300 Geräte infiziert, wobei die Zahl weiter steigen soll. Der Angriff setzt nicht auf den klassischen DDoS-Botnet-Ansatz, sondern auf die Vorbereitung von Einbrüchen: Fingerprinting, Subdomain-Enumeration, Traffic-Tunneling und Remote-Befehle laufen aus der […]

... den vollständigen Artikel »AryStinger: Recon-Proxys aus alten Routern – 4.300 Legacy-Geräte betroffen« lesen

Dieser Beitrag AryStinger: Recon-Proxys aus alten Routern – 4.300 Legacy-Geräte betroffen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Hackers Exploit 13-Year-Old Router Flaws to Deploy AryStinger Botnet

Mon, 22 Jun 2026 12:07:58 +0200

Threat actors are increasingly targeting outdated networking equipment to establish sophisticated reconnaissance networks. Security researchers recently uncovered an unusual attack campaign that exploits vulnerabilities disclosed over a decade ago to compromise older routers. Unlike typical botnets designed for distributed denial-of-service attacks or cryptocurrency mining, this newly discovered malware family focuses heavily on intrusion reconnaissance. Named […]

The post Hackers Exploit 13-Year-Old Router Flaws to Deploy AryStinger Botnet appeared first on Cyber Security News.

Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices

Mon, 22 Jun 2026 12:07:57 +0200

Canada’s spy service got a judge’s permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Federal Court released a public version of the ruling on June 15. It is…

The post Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices appeared first on IT Security News.

IT Security News Hourly Summary 2026-06-22 12h : 10 posts

Mon, 22 Jun 2026 12:07:52 +0200

10 posts were published in the last hour 10:4 : Gizmodo readers hit with ClickFix malware prompts after account compromise 10:4 : Fortinet Responds to FortiBleed Campaign 10:4 : Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices 9:34…

The post IT Security News Hourly Summary 2026-06-22 12h : 10 posts appeared first on IT Security News.

Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices

Mon, 22 Jun 2026 11:38:41 +0200

Canada's spy service got a judge's permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Federal Court released a public version of the ruling on June 15. It is the first time the Canadian Security Intelligence Service has used its threat reduction warrant powers this way. The warrant let CSIS alter,

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

Mon, 22 Jun 2026 09:54:09 +0200

A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising. The distinction matters. AryStinger exists for the stage of an attack that comes before the break-in. Infected

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

Mon, 22 Jun 2026 09:53:52 +0200

A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin’s XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says…

The post AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network appeared first on IT Security News.

Popa-Botnet: Millionen Smart-TVs als Proxy-Knoten gekapert - Börse Express

Mon, 22 Jun 2026 05:53:46 +0200

... Cyberangriffen zu schützen. Gratis-E-Book: IT-Sicherheit jetzt stärken. Das Popa-Botnet: Wohnzimmer als Datenautobahn. Forensiker von Qurium ...

Popa-Botnet: Millionen Smart-TVs als Proxy-Knoten gekapert - Börse Express

Mon, 22 Jun 2026 04:23:07 +0200

Aktuelle Berichte aus Mitte Juni 2026 zeigen einen deutlichen Trend: Hacker kapern zunehmend Unterhaltungselektronik und Netzwerkhardware, um ...

Stolen OAuth Tokens Hit Security Firms, AryStinger Router Botnet Emerges, AI Deepfake Cyberstalking

Mon, 22 Jun 2026 03:53:31 +0200

A breach at market intelligence platform Klue allowed attackers to steal OAuth tokens linking Clue to customers’ Salesforce environments, enabling quiet API-driven data extraction from firms including Huntress, Recorded Future, Tanium, and Jamf; Clue revoked tokens, removed the legacy integration…

The post Stolen OAuth Tokens Hit Security Firms, AryStinger Router Botnet Emerges, AI Deepfake Cyberstalking appeared first on IT Security News.

AryStinger botnet infected thousands of D-Link routers worldwide

Sun, 21 Jun 2026 16:39:15 +0200

A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic. [...]

Operation Endgame schaltet SocGholish Malware-Infrastruktur ab

Sun, 21 Jun 2026 00:02:35 +0200

Internationale Ermittler haben fast 15.000 infizierte WordPress-Blogs von der Malware "SocGholish" bereinigt und die zugrunde liegende Botnet-Infrastrukturen vom Netz genommen. Das kriminelle Netzwerk wurde von der in Russland angesiedelten Cyber-Kriminellengruppe "Evil Corp" betrieben. Die Information ist mir die Tage in … Weiterlesen →

Quelle

In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum

Fri, 19 Jun 2026 17:40:18 +0200

Other noteworthy stories that might have slipped under the radar: Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched GCP Config Connector flaw enables takeover.

The post In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum appeared first on SecurityWeek.

In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum

Fri, 19 Jun 2026 17:40:06 +0200

The post In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum appeared first on IT Security News.

15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown

Fri, 19 Jun 2026 09:22:47 +0200

Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame. The post 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown appeared first on SecurityWeek. This article has been indexed from SecurityWeek…

The post 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown appeared first on IT Security News.

Operation Endgame Hits SocGholish Malware Network, 14,971 Websites Cleaned

Fri, 19 Jun 2026 09:22:38 +0200

Operation Endgame Hits SocGholish Malware Network after international law enforcement agencies carried out a coordinated operation targeting one of the most significant malware distribution chains linked to cybercrime. Authorities announced the remediation of 14,971 websites infected with SocGholish Malware, a threat used by the cybercriminal group Evil Corp to gain unauthorized access to victim systems and facilitate further attacks. The operation involved law enforcement agencies from the Netherlands, Canada, the United States, and Germany, with support from Europol and Eurojust. Officials described the action as a major disruption of the infrastructure used to distribute malware through compromised WordPress websites.

Operation Endgame Hits SocGholish Malware Network Across Multiple Countries

During the coordinated action week, authorities took down 106 servers and domains associated with the criminal infrastructure supporting SocGholish operations. According to investigators, SocGholish Malware spreads primarily through compromised WordPress websites. Visitors to infected websites are presented with fake software update prompts, often disguised as browser updates. Once downloaded and installed, the malware establishes access to the victim's system, allowing attackers to deploy additional malicious software. Law enforcement agencies also disabled the SocGholish Botnet by seizing domains and taking servers offline. In addition to infrastructure takedowns, authorities cleaned infected WordPress sites and launched a large-scale victim notification campaign to warn affected website owners and encourage stronger security measures.

WordPress Websites at the Center of the Campaign

Authorities highlighted the widespread use of WordPress as a factor contributing to the scale of the threat. According to WordPress, more than 43% of websites worldwide are built on the platform. Investigators reported that login credentials for approximately 1.4 million websites have been leaked, increasing the risk of unauthorized access and malware infections. Cybercriminals behind SocGholish typically compromise websites by exploiting weak passwords, stolen credentials, or vulnerable website configurations. Once access is obtained, malicious code is inserted into websites, allowing attackers to distribute fake updates to visitors. The infected websites included platforms providing everyday services, such as restaurants and automotive repair businesses.

Authorities Urge Website Owners to Strengthen Security

The Dutch National High Tech Crime Unit stated that malware and backdoors have been removed from affected websites and that site owners have been notified. Website owners have been urged to:

Change login credentials
Enable Multi-Factor Authentication (MFA)
Remove unknown WordPress accounts
Keep WordPress installations updated

Authorities emphasized that these measures can significantly reduce the likelihood of future compromise.

Fake Updates Continue to Drive Infections

Also known as FakeUpdates, SocGholish has remained active since 2017 and continues to be used as an initial access tool for broader cybercriminal operations. The malware is distributed through fraudulent software update messages that appear while users browse compromised websites. Once installed, the malware creates a connection to attackers, enabling them to gain access to victim systems. Officials warned users not to trust browser pop-ups requesting immediate software updates and advised obtaining updates only through official application stores, system settings, or verified vendors. Additional recommendations include maintaining updated antivirus software and exercising caution when encountering urgent update notifications. Law enforcement agencies linked Evil Corp to the SocGholish malware operation. The group has previously been associated with Zeus and Dridex malware campaigns, as well as multiple ransomware and money laundering operations. Authorities noted that SocGholish has been used to deploy various ransomware strains that have impacted organizations and critical infrastructure targets worldwide.

Operation Endgame Expands Global Cybercrime Disruption Efforts

Launched in 2024, Operation Endgame is described by participating agencies as the largest international effort to combat ransomware and cybercrime. The initiative brings together law enforcement and judicial authorities from the Netherlands, Germany, Denmark, the United States, Australia, France, Belgium, the United Kingdom, and Canada, with support from Europol and Eurojust. Officials stated that cooperation between public agencies and private-sector cybersecurity organizations remains a critical component of the operation as efforts continue against SocGholish and other cybercriminal networks.

15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown

Fri, 19 Jun 2026 08:52:39 +0200

Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame.

The post 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown appeared first on SecurityWeek.

6/18/2026

Fri, 19 Jun 2026 04:37:34 +0200

Bulgaria Allowed Surveillance Tech Firm to Sell Products to Repressive Regimes How Hackers Found a Back Door Into the American Living RoomThe Midterms Are Going to Be a Data Security NightmareKrebs: ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm Israeli Cyber Startup Dream Raises $260 Million, Valued at $3 BillionAccenture Takes Majority Stake in Cyber Company … Continue reading

Authorities disrupt Evil Corp’s SocGholish botnet

Fri, 19 Jun 2026 00:38:14 +0200

Cybersecurity firms, researchers and officials took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.

The post Authorities disrupt Evil Corp’s SocGholish botnet appeared first on CyberScoop.

The botnet browser blues.

Thu, 18 Jun 2026 22:37:40 +0200

International law enforcement disrupts the SocGholish botnet. The UK’s cyber chief says cybersecurity is a contest, not a risk register. Ukraine joins the EU’s cyber reserve. The Gentlemen gang sharpens its ransomware toolkit. A WordPress supply chain attack spreads malware. Critical patches land from F5, Atlassian, and Splunk. Agentjacking targets AI coding assistants. And Kodak confirms a breach claimed by ShinyHunters. Our guest is Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies on the failure of FISA section 702 to reauthorize. Criminal coders face automation anxiety.

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

Thu, 18 Jun 2026 20:20:38 +0200

The post ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm appeared first on IT Security News.

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

Thu, 18 Jun 2026 19:53:46 +0200

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a "residential proxy" provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR].

Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp

Thu, 18 Jun 2026 15:38:01 +0200

International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish botnet and the Evil Corp Russian cybercrime group. [...]

Operation Endgame: Ermittler säubern tausende Blogs von SocGholish

Thu, 18 Jun 2026 15:32:50 +0200

Strafverfolger aus vier Ländern zerschlugen ein Botnet und Wordpress-Blogs, die Kriminelle als Verteilstationen für Schadsoftware mißbrauchten.

Operation Endgame: Ermittler säubern tausende Blogs von SocGholish

Thu, 18 Jun 2026 15:24:31 +0200

Strafverfolger aus vier Ländern zerschlugen ein Botnet und Wordpress-Blogs, die Kriminelle als Verteilstationen für Schadsoftware mißbrauchten.

SprySOCKS-Botnet-Backdoor: neue Windows-Varianten mit Kernel-Stealth

Tue, 16 Jun 2026 14:52:17 +0200

SLOWAKEI / LONDON (IT BOLTWISE) – Sicherheitsforscher melden zwei neue Windows-Varianten eines bislang vor allem als Linux-Backdoor bekannten Systems: WIN_DRV und WIN_PLUS. Auffällig ist die driverbasierte Tarnung im Betriebssystem sowie ein modulartes Vorgehen über Print-Spooler und DLL-Sideloading. Damit erweitert die Kampagne plattformübergreifend ihre Reichweite – und erhöht den Aufwand für Erkennung und Incident Response in […]

... den vollständigen Artikel »SprySOCKS-Botnet-Backdoor: neue Windows-Varianten mit Kernel-Stealth« lesen

Dieser Beitrag SprySOCKS-Botnet-Backdoor: neue Windows-Varianten mit Kernel-Stealth erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

The Intelligent Shield. OpenCTI

Tue, 16 Jun 2026 09:09:15 +0200

Beyond Ingestion Subtitle: Deploying AI-Driven Enrichment in OpenCTI

Transforming Threat Data into High-Confidence Intelligence

In an era of relentless and complex cyber attacks, traditional, manual threat intelligence cannot keep pace. Security teams are overwhelmed by data fragmentation and the critical lack of context. “The Intelligent Shield” introduces a new paradigm: beyond simply ingesting data, it’s about deploying advanced, automated machine learning pipelines for AI-driven enrichment.

This guide demonstrates how to integrate state-of-the-art Large Language Models (LLMs), such as Claude AI, into an OpenCTI ecosystem. By leveraging the OpenCTI STIX 2.1 Knowledge Graph and natural language processing, this architecture converts disparate, unstructured data feeds into high-fidelity, actionable intelligence. It automatically builds context, executes deep mapping to frameworks like the MITRE ATT&CK Matrix, and generates calculated, real-time Confidence Scores, enabling organizations to proactively strengthen their defenses with an intuitive, automated Intelligent Shield.

1. What is OpenCTI?

OpenCTI (Open Cyber Threat Intelligence) is an open-source platform developed by Filigran (formerly a project of ANSSI, the French national cybersecurity agency) for structuring, storing, organizing, visualizing, and sharing cyber threat intelligence (CTI).

It implements the STIX 2.1 (Structured Threat Information eXpression) standard as its native data model and exposes a GraphQL API for all read/write operations. Every object — threat actors, campaigns, malware, vulnerabilities, indicators, attack patterns — is stored as a STIX Domain Object (SDO) or STIX Relationship Object (SRO) backed by two databases:

ElasticSearch / OpenSearch — full-text search and analytics
Apache Cassandra (via JanusGraph) — graph relationship storage

Why OpenCTI?

2. Core Capabilities

2.1 Knowledge Graph

Entities: Threat Actors, Intrusion Sets, Campaigns, Malware, Tools, Vulnerabilities (CVE), Attack Patterns (MITRE ATT&CK), Courses of Action, Sectors, Countries, Organizations
Relationships modelled as first-class STIX SROs with confidence scores, date ranges, and TLP markings
Diamond Model and Kill Chain views built in

2.2 Indicator Management

IOC lifecycle: valid_from / valid_until with automatic expiry
Detection rule generation (Sigma, YARA, Snort)
Bulk import via STIX, CSV, OpenIOC, MISP formats
Scoring and confidence weighting per source

2.3 MITRE ATT&CK Navigator Integration

Full ATT&CK Enterprise / Mobile / ICS matrices
Heatmaps of technique usage per threat actor or campaign
Gap analysis against your current detection coverage

2.4 Threat Actor Profiling

Attributed aliases, motivations (financial, espionage, hacktivism)
Geo and sector targeting mapped on world map
Timeline of campaigns and malware usage

2.5 Automation & Playbooks

Built-in playbook engine (since v5.9): trigger enrichment, notifications, or SOAR actions on entity creation/modification(Enterprise Edition only)
Python SDK for custom automation
Webhook support for external integrations

2.6 Collaboration & Sharing

Role-based access control (RBAC) with groups and organizations
TLP (Traffic Light Protocol) enforcement at object level
TAXII 2.1 server — push feeds to SIEMs, firewalls, EDR platforms
Sharing with partner organizations via federated instances

2.7 Dashboard & Reporting

Customizable dashboards with widget library
PDF report generation
Timeline, matrix, and entity views
Attack path visualization

3. Architecture Overview

4. Threat Intelligence Feeds

4.1 Free / Open-Source Feeds

MITRE ATT&CK — Connector: opencti/connector-mitre — Data: Techniques, mitigations, groups, software — Setup: API key not needed.
CVE / NVD — Connector: opencti/connector-cve — Data: Vulnerabilities — Setup: NVD API key recommended/required depending on configuration.
AlienVault OTX — Connector: opencti/connector-alienvault — Data: IOCs, pulses, malware families — Setup: Free OTX account/API key.
Abuse.ch MalwareBazaar — Connector: opencti/connector-malwarebazaar — Data: Malware hashes, malware metadata, file observables — Setup: Free MalwareBazaar API key.
Abuse.ch URLhaus — Connector: opencti/connector-urlhaus — Data: Malicious URLs — Setup: Public feed; no API key for CSV feed.
Abuse.ch Feodo Tracker — Connector: use opencti/connector-misp-feed or ingest the Feodo CSV/blocklist feed manually — Data: Botnet C2 IPs — Setup: Free.
Shodan InternetDB — Connector: opencti/connector-shodan-internetdb — Data: IP enrichment, domains, CPEs, CVEs, tags — Setup: No API key required.
MISP Default / CIRCL OSINT Feeds — Connector: opencti/connector-misp-feed — Data: STIX/MISP bundles, indicators, observables — Setup: Free.
CyberCrime-Tracker feed via MISP default feeds — Connector: use opencti/connector-misp-feed rather than a dedicated current connector — Data: C2 panels / freetext indicators — Setup: Free.
OpenPhish — Connector: no verified current dedicated OpenCTI connector in the main repo; use generic feed ingestion where suitable — Data: Phishing URLs — Setup: Free/community feed options.
DigitalSide IT-ISAC MISP Feed — Connector: opencti/connector-misp-feed with custom MISP_FEED_URL — Data: IOCs / MISP-format feed — Setup: Free.

4.2 Commercial Feeds (require license/API key)

MISP — self-hosted — Connector: opencti/connector-misp — Strengths: community sharing, custom events, internal/private CTI exchange. The OpenCTI repo lists both misp and misp-feed; use misp for a live MISP instance with API access, and misp-feed for static MISP feed URLs.
VirusTotal / Google Threat Intelligence — Connector: opencti/connector-virustotal — Strengths: file, URL, domain, and IP enrichment. The connector is under internal-enrichment, not external-import.
Mandiant Threat Intelligence / Google Threat Intelligence — Connector: opencti/connector-mandiant — Strengths: APT intelligence, actor reporting, malware/campaign context.
Recorded Future — Connectors: opencti/connector-recordedfuture and opencti/connector-recordedfuture-enrichment — Strengths: risk lists, enrichment, vulnerability/contextual intelligence, dark web and external threat data. Recorded Future documentation describes the OpenCTI integration as two components: an enrichment connector and a Recorded Future connector.
CrowdStrike Falcon Intelligence — Connector: opencti/connector-crowdstrike — Strengths: actor tracking, indicators, adversary intelligence, Falcon ecosystem context.
Sekoia.io Intelligence — Connector: opencti/connector-sekoia — Strengths: European threat landscape, CTI feed ingestion, actor/campaign context. Sekoia’s own documentation points to the OpenCTI GitHub connector path.
ThreatConnect — Connector: no verified current dedicated connector in the main OpenCTI connector tree — Strengths: enterprise TI management, source aggregation, workflow and case management. I found an OpenCTI GitHub label/feature reference for “threat connect,” but not a confirmed current connector folder equivalent to external-import/threatconnect.
Intel 471 — Connectors: opencti/connector-intel471, opencti/connector-intel471-darknet, and opencti/connector-intel471_v2 — Strengths: underground forums, cybercrime actors, malware, infrastructure, dark web intelligence.

4.3 ISAC / Government Feeds

CISA Automated Indicator Sharing / AIS — Method: TAXII/STIX client, AIS 2.0 uses TAXII 2.1 — Access: free service for eligible participants; contact CISA to onboard.
FS-ISAC — Method: STIX/TAXII and MISP automated feeds — Access: financial-sector membership; automated-feed credentials/licensing must be explicitly requested.
Health-ISAC / H-ISAC — Method: HITS indicator-sharing feed; STIX/TAXII-compatible threat intelligence sharing — Access: healthcare-sector membership / Health-ISAC member access.
NATO MISP Community — Method: MISP community / MISP sync — Access: official government cyber-defense entities from NATO nations, sponsored by their national representative in the NATO Multinational MISP Steering Board.
ENISA Threat Landscape — Method: public reports and CTI publications; not a confirmed public TAXII/STIX feed. ENISA’s CTL methodology references STIX 2.1 as a common CTI representation format, but this is different from offering a public feed endpoint.

4.4 Feed Priority and TLP Assignment

# Recommended TLP assignment by source
feeds:
  - source: mitre_attack
    tlp: WHITE          # public, shareable
    confidence: 90
  - source: alienvault_otx
    tlp: GREEN          # community sharing
    confidence: 60
  - source: mandiant
    tlp: AMBER          # restricted to org
    confidence: 85
  - source: internal_soc
    tlp: RED            # internal only
    confidence: 95

5. AI Integration Layer

This is the “AI-driven” layer on top of standard OpenCTI — a custom connector and MCP server that adds:

5.1 AI Enrichment Connector (Claude API)

On every new Report, Malware, or Threat-Actor ingested → call Claude API
Extract structured STIX entities from unstructured text (PDFs, blog posts)
Summarize long reports into 3-sentence executive briefs
Score indicator relevance against your organization’s sector profile
Suggest ATT&CK technique mappings from narrative descriptions

5.2 AI Pipeline Architecture

New Report ingested
        │
        ▼
[AI Enrichment Connector]
        │
        ├─► Claude API: Extract entities → creates STIX SDOs
        ├─► Claude API: Map to ATT&CK techniques
        ├─► Claude API: Generate executive summary
        └─► Claude API: Score severity for your sector
                │
                ▼
        Update Report in OpenCTI
        (summary, related entities, confidence scores)

6. Prerequisites

6.1 Hardware (minimum production)

6.2 Software

# Install Docker Engine (Ubuntu 22.04)
sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg lsb-release
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
# Add user to docker group
sudo usermod -aG docker $USER
newgrp docker
# Verify
docker compose version

6.3 System Tuning (required for ElasticSearch)

# ElasticSearch requires high vm.max_map_count
sudo sysctl -w vm.max_map_count=1048575
echo "vm.max_map_count=1048575" | sudo tee -a /etc/sysctl.conf

# Increase file descriptor limits
echo "* soft nofile 65536" | sudo tee -a /etc/security/limits.conf
echo "* hard nofile 65536" | sudo tee -a /etc/security/limits.conf

7. Docker Compose Deployment

7.0 Deploy from GitHub (recommended)

The fastest deployment path is to clone the maintained project repository and create a local `.env` from the sanitized template:

cd /home/andrey
git clone https://github.com/anpa1200/opencti-intelligent-shield.git openCTI
cd /home/andrey/openCTI
# Create local secrets/config. This file is ignored by Git.
cp .env.example .env
nano .env
# Start the full stack after filling in .env
./scripts/start-all.sh

This gives you the Docker Compose files, OpenCTI patches, AI enrichment connector, helper scripts, and Docusaurus documentation in one checkout. Use the manual sections below if you want to recreate the files by hand or compare the generated content.

7.1 Directory Structure

/home/andrey/openCTI/
├── .env                          # secrets and config
├── docker-compose.yml            # core stack
├── docker-compose.connectors.yml # feed connectors
├── docker-compose.ai.yml         # AI enrichment connector
├── patches/
│   └── back.js                   # ILM race condition fix (ES 8.13 + OpenCTI 6.2.0)
└── connectors/
    └── ai-enrichment/            # custom AI connector source

7.2 Environment File

cat > /home/andrey/openCTI/.env << 'EOF'
# === Core ===
OPENCTI_ADMIN_EMAIL=admin@opencti.local
OPENCTI_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
OPENCTI_ADMIN_TOKEN=CHANGE_ME_UUID4_TOKEN
OPENCTI_BASE_URL=http://localhost:8080

# === Secrets ===
APP__ADMIN__TOKEN=CHANGE_ME_UUID4_TOKEN
APP__SECRET_KEY=CHANGE_ME_SECRET

# === ElasticSearch ===
# NOTE: key is ELASTIC_PASSWORD, not ELASTIC_AUTH
ELASTIC_PASSWORD=CHANGE_ME_ELASTIC_PASS

# === Redis ===
REDIS_PASSWORD=opencti

# === MinIO ===
MINIO_ROOT_USER=opencti
MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASS

# === RabbitMQ ===
RABBITMQ_DEFAULT_USER=opencti
RABBITMQ_DEFAULT_PASS=CHANGE_ME_RABBITMQ_PASS

# === Connector IDs (unique UUID4 per connector — NOT used for auth) ===
CONNECTOR_MITRE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_CVE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ALIENVAULT_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ABUSE_SSL_TOKEN=CHANGE_ME_UUID4
CONNECTOR_URLHAUS_TOKEN=CHANGE_ME_UUID4
CONNECTOR_AI_ENRICHMENT_TOKEN=CHANGE_ME_UUID4

# === External API keys ===
ALIENVAULT_API_KEY=your_otx_key_here
NVD_API_KEY=your_nvd_api_key_here     # UUID format from nvd.nist.gov/developers/request-an-api-key
ANTHROPIC_API_KEY=your_claude_api_key_here
EOF

# Generate unique UUIDs for connector IDs
python3 -c "import uuid; [print(uuid.uuid4()) for _ in range(8)]"# Generate proper tokens
python3 -c "import uuid; [print(f'Token: {uuid.uuid4()}') for _ in range(10)]"

7.3 Core Stack — docker-compose.yml

nano docker-compose.yml

version: "3"
services:
  redis:
    image: redis:7.2
    restart: always
    volumes:
      - redisdata:/data
    command: redis-server --requirepass ${REDIS_PASSWORD:-opencti}
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    volumes:
      - esdata:/usr/share/elasticsearch/data
    environment:
      - discovery.type=single-node
      - xpack.ml.enabled=false
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-CHANGE_ME}
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - cluster.routing.allocation.disk.threshold_enabled=false
    ulimits:
      memlock:
        soft: -1
        hard: -1
    restart: always
  minio:
    image: minio/minio:RELEASE.2024-01-16T16-07-38Z
    volumes:
      - miniodata:/data
    ports:
      - "9001:9001"   # console
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-opencti}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
    command: server /data --console-address ":9001"
    restart: always
  rabbitmq:
    image: rabbitmq:3.13-management
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      RABBITMQ_NODENAME: rabbit01@localhost
    volumes:
      - rabbitmqdata:/var/lib/rabbitmq
    restart: always
  opencti:
    image: opencti/platform:6.2.0
    environment:
      NODE_OPTIONS: --max-old-space-size=8096
      APP__PORT: 8080
      APP__BASE_URL: ${OPENCTI_BASE_URL:-http://localhost:8080}
      APP__ADMIN__EMAIL: ${OPENCTI_ADMIN_EMAIL}
      APP__ADMIN__PASSWORD: ${OPENCTI_ADMIN_PASSWORD}
      APP__ADMIN__TOKEN: ${OPENCTI_ADMIN_TOKEN}
      APP__APP_LOGS__LOGS_LEVEL: error
      REDIS__HOSTNAME: redis
      REDIS__PORT: 6379
      REDIS__USE_SSL: "false"
      REDIS__PASSWORD: ${REDIS_PASSWORD:-opencti}
      ELASTICSEARCH__URL: http://elasticsearch:9200
      ELASTICSEARCH__USERNAME: elastic
      ELASTICSEARCH__PASSWORD: ${ELASTIC_PASSWORD:-CHANGE_ME}
      MINIO__ENDPOINT: minio
      MINIO__PORT: 9000
      MINIO__USE_SSL: "false"
      MINIO__ACCESS_KEY: ${MINIO_ROOT_USER:-opencti}
      MINIO__SECRET_KEY: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
      RABBITMQ__HOSTNAME: rabbitmq
      RABBITMQ__PORT: 5672
      RABBITMQ__USERNAME: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ__PASSWORD: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      SMTP__HOSTNAME: localhost
      PROVIDERS__LOCAL__STRATEGY: LocalStrategy
    volumes:
      - ./patches/back.js:/opt/opencti/build/back.js:ro
    ports:
      - "8080:8080"
    depends_on:
      - redis
      - elasticsearch
      - minio
      - rabbitmq
    restart: always
  worker:
    image: opencti/worker:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      WORKER_LOG_LEVEL: error
    depends_on:
      - opencti
    deploy:
      mode: replicated
      replicas: 3
    restart: always
volumes:
  esdata:
  redisdata:
  miniodata:
  rabbitmqdata:
networks:
  default:
    name: opencti_network
    external: true

7.4 Connectors — docker-compose.connectors.yml

nano docker-compose.connectors.yml

version: "3"
services:
  # MITRE ATT&CK (no API key needed)
  connector-mitre:
    image: opencti/connector-mitre:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MITRE_TOKEN}
      CONNECTOR_NAME: "MITRE ATT&CK"
      CONNECTOR_SCOPE: "marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,vulnerability,x-mitre-matrix,x-mitre-tactic,x-mitre-collection"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CONNECTOR_LOG_LEVEL: error
      MITRE_REMOVE_STATEMENT_MARKING: "true"
      MITRE_INTERVAL: 7  # days between full refresh
    restart: always
  # CVE / NVD Vulnerabilities
  connector-cve:
    image: opencti/connector-cve:6.2.0
    volumes:
      - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
      - ./patches/cve/vulnerability.py:/opt/opencti-connector-cve/services/client/vulnerability.py:ro
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_CVE_TOKEN}
      CONNECTOR_NAME: "Common Vulnerabilities and Exposures"
      CONNECTOR_SCOPE: "identity,vulnerability"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: info
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CVE_BASE_URL: "https://services.nvd.nist.gov/rest/json/cves"
      CVE_API_KEY: ${NVD_API_KEY}
      CVE_MAX_DATE_RANGE: 120
      CVE_MAINTAIN_DATA: "true"
      CVE_INTERVAL: 2
    restart: always
  # AlienVault OTX
  connector-alienvault:
    image: opencti/connector-alienvault:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_ALIENVAULT_TOKEN}
      CONNECTOR_NAME: "AlienVault OTX"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      ALIENVAULT_BASE_URL: "https://otx.alienvault.com"
      ALIENVAULT_API_KEY: ${ALIENVAULT_API_KEY}
      ALIENVAULT_TLP: "White"
      ALIENVAULT_CREATE_OBSERVABLES: "true"
      ALIENVAULT_CREATE_INDICATORS: "true"
      ALIENVAULT_PULSE_START_TIMESTAMP: "2020-01-01T00:00:00"
      ALIENVAULT_REPORT_STATUS: "New"
      ALIENVAULT_REPORT_TYPE: "threat-report"
      ALIENVAULT_GUESS_MALWARE: "false"
      ALIENVAULT_GUESS_CVE: "false"
      ALIENVAULT_INTERVAL: 30   # minutes
    restart: always
  # Abuse.ch SSL Blacklist
  connector-abuse-ssl:
    image: opencti/connector-abuse-ssl:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MALWAREBAZAAR_TOKEN}
      CONNECTOR_NAME: "Abuse.ch SSL Blacklist"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 50
      CONNECTOR_LOG_LEVEL: error
      ABUSE_SSL_URL: "https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
      ABUSE_SSL_INTERVAL: 30  # minutes
    restart: always
  # Abuse.ch URLhaus
  connector-urlhaus:
    image: opencti/connector-urlhaus:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_URLHAUS_TOKEN}
      CONNECTOR_NAME: "Abuse.ch URLhaus"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      URLHAUS_CSV_URL: "https://urlhaus.abuse.ch/downloads/csv_recent/"
      URLHAUS_IMPORT_OFFLINE: "true"
      URLHAUS_INTERVAL: 2  # hours
    restart: always
  connector-threatfox:
    image: opencti/connector-threatfox:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_THREATFOX_TOKEN}
      CONNECTOR_NAME: "ThreatFox"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      THREATFOX_API_URL: "https://threatfox-api.abuse.ch/api/v1/"
      THREATFOX_CREATE_INDICATORS: "true"
      THREATFOX_CREATE_OBSERVABLES: "true"
      THREATFOX_INTERVAL: 3
    restart: always
  connector-import-document:
    image: opencti/connector-import-document:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_IMPORT_DOCUMENT_TOKEN}
      CONNECTOR_NAME: "ImportDocument"
      CONNECTOR_SCOPE: "application/pdf,text/plain,text/html"
      CONNECTOR_AUTO: "true"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: error
    restart: always
networks:
  default:
    name: opencti_network
    external: true

7.5 AI Enrichment Connector — docker-compose.ai.yml

nano docker-compose.ai.yml

version: "3"

services:
  connector-ai-enrichment:
    build:
      context: ./connectors/ai-enrichment
      dockerfile: Dockerfile
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_AI_ENRICHMENT_TOKEN}
      CONNECTOR_NAME: "AI Enrichment (Claude)"
      CONNECTOR_LOG_LEVEL: info
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      AI_MODEL: claude-opus-4-7
      AI_ENRICHMENT_REPORTS: "true"
      AI_ENRICHMENT_MALWARE: "true"
      AI_ENRICHMENT_THREAT_ACTORS: "true"
    restart: always

networks:
  default:
    name: opencti_network
    external: true

8. Connector Configuration

Fast Start / Stop Scripts

The repository includes two helper scripts for daily operations:

# Start core OpenCTI, wait for the UI/API, then start connectors and AI enrichment
./scripts/start-all.sh
# Stop AI enrichment, connectors, and core OpenCTI while preserving Docker volumes
./scripts/stop-all.sh

Use these scripts for normal start/stop operations after .env is configured. Use the manual commands below when debugging a specific service startup problem.

nano start-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

WAIT_TIMEOUT="${WAIT_TIMEOUT:-300}"

wait_for_opencti() {
  local deadline=$((SECONDS + WAIT_TIMEOUT))

  echo "[start] Waiting for OpenCTI API on http://localhost:8080..."
  until curl -fsS http://localhost:8080 >/dev/null 2>&1; do
    if (( SECONDS >= deadline )); then
      echo "[start] OpenCTI did not become reachable within ${WAIT_TIMEOUT}s." >&2
      echo "[start] Check logs with: docker compose logs -f opencti" >&2
      return 1
    fi
    sleep 5
  done
}

echo "[start] Starting OpenCTI core stack..."
docker compose -f docker-compose.yml up -d

wait_for_opencti

echo "[start] Starting external connectors..."
docker compose -f docker-compose.connectors.yml up -d

echo "[start] Building and starting AI enrichment connector..."
docker compose -f docker-compose.ai.yml up -d --build

echo "[start] Done."
docker compose -f docker-compose.yml ps

nano stop-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

echo "[stop] Stopping OpenCTI core, connectors, and AI enrichment..."
docker compose \
  -f docker-compose.yml \
  -f docker-compose.connectors.yml \
  -f docker-compose.ai.yml \
  down --remove-orphans

echo "[stop] Done. Volumes are preserved."

8.1 Start the Core Stack

cd /home/andrey/openCTI

# Pre-flight: ElasticSearch refuses allocation above 90% disk usage
df -h /var/lib/docker
# If > 90% full, run: docker system prune -a   (frees ~47 GB of unused images)

# Create the shared Docker network (idempotent — safe to re-run)
docker network create opencti_network 2>/dev/null || true

# Start core services
docker compose -f docker-compose.yml up -d

# Wait for ElasticSearch to be healthy before OpenCTI finishes initializing
until curl -s -u "elastic:${ELASTIC_PASSWORD}" \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  echo "Waiting for ES..."; sleep 5
done

# Watch logs — first-run index creation takes 5-10 minutes
# Look for "Listening on port 8080"
docker compose -f docker-compose.yml logs -f opencti | grep -E "Listening|ERROR|indices"

8.2 Start Connectors

# Start feed connectors (after OpenCTI is healthy)
docker compose -f docker-compose.connectors.yml up -d
# Verify connectors registered (wait ~60s for startup)
docker compose -f docker-compose.connectors.yml ps

8.3 Verify in UI

http://localhost:8080
Login: admin@opencti.local / Navigation:
  Data → Connectors → check all show status "connected"
  Knowledge → Malwares → should start populating within minutes
  Activities → Logs → watch ingest events

9. AI-Driven Enrichment Pipeline

Overview

The AI enrichment pipeline adds a Claude-powered layer on top of the standard OpenCTI ingestion flow. Every time a connector (AlienVault, MITRE, URLhaus, etc.) writes a new object into OpenCTI, an event is published to RabbitMQ. The AI connector subscribes to that event stream, calls the Claude API with the object’s content, and writes the extracted structured intelligence back into the graph as STIX relationships, notes, and entity updates — all automatically.

Without AI enrichment:

AlienVault pulse → Report object in OpenCTI
                   (raw text, no relationships, no ATT&CK mapping)

With AI enrichment:

AlienVault pulse → Report object in OpenCTI
                       ↓ AI connector picks it up from event stream
                   Claude API: extract entities, map techniques, score severity
                       ↓
                   Report now has:
                   ├── Note: executive summary (2-3 sentences)
                   ├── Relationship → ThreatActor (if found in graph)
                   ├── Relationship → Malware (if found in graph)
                   ├── Relationship → AttackPattern T1059.001 (created if missing)
                   └── x_opencti_score updated based on AI confidence

9.1 How the Event Stream Works

OpenCTI uses RabbitMQ as its internal message bus. Every write operation (create, update, delete) on any STIX object publishes a message to a topic exchange. Connectors subscribe to this exchange via pycti's OpenCTIConnectorHelper.listen() method.

OpenCTI platform
      │
      │ write event (STIX bundle)
      ▼
  RabbitMQ
  exchange: amq.topic
      │
      ├──► worker-1 (standard workers — write to ES/graph)
      ├──► worker-2
      ├──► worker-3
      └──► connector-ai-enrichment  ← our connector subscribes here
                  │
                  │ reads event payload:
                  │ {
                  │   "type": "create",
                  │   "data": { "id": "report--uuid", "type": "report", ... }
                  │ }
                  ▼
            calls Claude API
                  ▼
            writes enrichment back via GraphQL API

Each message contains the full STIX object that was just created. The connector processes it and acknowledges the message — if it crashes mid-processing, RabbitMQ redelivers it.

Connector type INTERNAL_ENRICHMENT means:

It does not import data on a schedule
It reacts to existing objects as they are created or updated
It appears in Settings → Connectors → Enrichment in the UI

9.2 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

RuleEffectattribution_attributionIf APT-X is attributed to Country-A, and APT-Y is a sub-group of APT-X → APT-Y also attributed to Country-Asighting_incidentIf an indicator is sighted, automatically raise an Incidentindicate_sightedIf indicator is sighted → infer the targeted entity from the indicator's relationshipreport_ref_indicator_based_onIf a Report references Observable X, and X has an Indicator → auto-link the Indicator to the Reportobservable_relatedIf two objects share a common Observable → infer a related-to relationshipparent_technique_useIf a sub-technique (T1059.001) is used → auto-link parent technique (T1059) as used

For custom event-driven automation in CE, use a pycti script or the AI connector (section 9.1). The pycti library supports streaming the live event feed via helper.listen() — the AI connector in 9.1 uses exactly this pattern.10. Post-Deployment Hardening

9.2 What Claude Extracts and How It Maps to STIX

The connector sends the report’s description text to Claude with a structured prompt. Claude returns JSON. The connector then maps each field to STIX operations:

Claude output fieldSTIX actionsummaryCreates a Note object attached to the report (object_refs)threat_actors[]Looks up ThreatActor by name in graph → creates related-to relationship to reportmalware_families[]Looks up Malware by name → creates related-to relationship to reportattack_techniques[]Looks up AttackPattern by external_id (T1059.001) → creates uses relationship to reporttargeted_sectors[]Looks up Identity (sector) → creates targets relationshiptargeted_countries[]Looks up Location by ISO code → creates targets relationshipconfidenceSets x_opencti_score on the report (0–100)

Why look up instead of creating? MITRE ATT&CK and identity data is already loaded by the MITRE connector. Looking up prevents duplicates. Only AttackPattern objects are created if missing (since Claude may identify techniques not yet in the graph).

9.3 Connector Code

mkdir -p /home/andrey/openCTI/connectors/ai-enrichment

connectors/ai-enrichment/connector.py

import os
import json
import time
import anthropic
from pycti import OpenCTIConnectorHelper

SYSTEM_PROMPT = """You are a senior cyber threat intelligence analyst.
Analyze threat intelligence content and return structured JSON only.
No prose, no markdown fences, no explanation — raw JSON."""

REPORT_PROMPT = """Analyze this threat intelligence report. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief, plain text)
- threat_actors: list of strings (actor names, aliases, groups mentioned)
- malware_families: list of strings (malware/tool names)
- attack_techniques: list of strings (MITRE ATT&CK IDs only, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (e.g. ["Finance", "Healthcare", "Government"])
- targeted_countries: list of strings (ISO 3166-1 alpha-2, e.g. ["US", "UA", "DE"])
- confidence: integer 0-100

Report:
{content}"""

INTRUSION_SET_PROMPT = """Analyze this threat actor / intrusion set profile. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief)
- aliases: list of strings (other known names)
- malware_families: list of strings (malware/tools this actor uses)
- attack_techniques: list of strings (MITRE ATT&CK IDs, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (sectors this actor targets)
- targeted_countries: list of strings (ISO 3166-1 alpha-2 codes)
- motivation: string (one of: "espionage", "financial", "hacktivism", "destruction", "unknown")
- sophistication: string (one of: "minimal", "intermediate", "advanced", "expert", "unknown")
- confidence: integer 0-100

Profile:
{content}"""


class AIEnrichmentConnector:
    def __init__(self):
        config = {
            "opencti": {
                "url": os.environ.get("OPENCTI_URL", "http://opencti:8080"),
                "token": os.environ["OPENCTI_TOKEN"],
            },
            "connector": {
                "id": os.environ["CONNECTOR_ID"],
                "type": "INTERNAL_ENRICHMENT",
                "name": os.environ.get("CONNECTOR_NAME", "AI Enrichment (Claude)"),
                "scope": "Report,Intrusion-Set,Threat-Actor-Group,Malware",
                "log_level": os.environ.get("CONNECTOR_LOG_LEVEL", "info"),
                "auto": False,
            },
        }
        self.helper = OpenCTIConnectorHelper(config)
        self.client = anthropic.Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])
        self.model = os.environ.get("AI_MODEL", "claude-opus-4-7")

    # -------------------------------------------------------------------------
    # Claude call with retry on rate limit
    # -------------------------------------------------------------------------

    def _call_claude(self, prompt_template: str, content: str) -> dict | None:
        for attempt in range(3):
            try:
                msg = self.client.messages.create(
                    model=self.model,
                    max_tokens=2048,
                    system=SYSTEM_PROMPT,
                    messages=[{"role": "user", "content": prompt_template.format(content=content[:8000])}],
                )
                return json.loads(msg.content[0].text)
            except anthropic.RateLimitError:
                wait = 60 * (attempt + 1)
                self.helper.log_warning(f"Rate limited — waiting {wait}s")
                time.sleep(wait)
            except (json.JSONDecodeError, anthropic.APIError) as e:
                self.helper.log_error(f"Claude call failed: {e}")
                return None
        return None

    # -------------------------------------------------------------------------
    # STIX write-back helpers
    # -------------------------------------------------------------------------

    def _add_note(self, entity_id: str, summary: str, confidence: int) -> None:
        self.helper.api.note.create(
            abstract="AI Summary",
            content=summary,
            confidence=confidence,
            object_ids=[entity_id],
        )

    def _link_threat_actors(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            actor = self.helper.api.threat_actor_group.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if actor:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=actor["id"],
                    relationship_type="related-to",
                    confidence=confidence,
                )

    def _link_malware(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            malware = self.helper.api.malware.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if malware:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=malware["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _link_attack_patterns(self, entity_id: str, technique_ids: list, confidence: int) -> None:
        for tid in technique_ids:
            pattern = self.helper.api.attack_pattern.read(
                filters={"mode": "and", "filters": [{"key": "x_mitre_id", "values": [tid]}], "filterGroups": []}
            )
            if not pattern:
                pattern = self.helper.api.attack_pattern.create(
                    name=tid,
                    x_mitre_id=tid,
                    confidence=50,
                )
            if pattern:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=pattern["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _update_score(self, entity_id: str, confidence: int) -> None:
        self.helper.api.stix_domain_object.update_field(
            id=entity_id,
            input={"key": "x_opencti_score", "value": str(confidence)},
        )

    # -------------------------------------------------------------------------
    # Enrichment handlers per entity type
    # -------------------------------------------------------------------------

    def _enrich_report(self, report: dict) -> str:
        content = report.get("description") or ""
        if len(content) < 50:
            content = report.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching report: {report['name']}")
        result = self._call_claude(REPORT_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = report["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("threat_actors"):
            self._link_threat_actors(entity_id, result["threat_actors"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self._update_score(entity_id, confidence)
        self.helper.log_info(f"Enriched report '{report['name']}'")
        return "Enriched"

    def _enrich_intrusion_set(self, entity: dict) -> str:
        content = entity.get("description") or entity.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching intrusion set: {entity['name']}")
        result = self._call_claude(INTRUSION_SET_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = entity["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self.helper.log_info(f"Enriched intrusion set '{entity['name']}'")
        return "Enriched"

    # -------------------------------------------------------------------------
    # Event handler
    # -------------------------------------------------------------------------

    def process_message(self, data: dict) -> str:
        entity_type = data.get("entity_type", "").lower()
        entity_id = data.get("entity_id")
        enrichment_entity = data.get("enrichment_entity", {})

        self.helper.log_info(f"Received entity_type='{entity_type}' id='{entity_id}'")

        if not entity_id:
            return "Skipped"

        entity = enrichment_entity or {}

        if entity_type == "report":
            if not entity:
                entity = self.helper.api.report.read(id=entity_id) or {}
            if entity.get("confidence", 0) < 40:
                return "Skipped: low confidence"
            return self._enrich_report(entity)

        if entity_type in ("intrusion-set", "threat-actor-group"):
            if not entity:
                entity = self.helper.api.intrusion_set.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            return self._enrich_intrusion_set(entity)

        if entity_type == "malware":
            if not entity:
                entity = self.helper.api.malware.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            content = entity.get("description") or entity.get("name", "")
            if not content or len(content) < 10:
                return "Skipped: content too short"
            self.helper.log_info(f"Enriching malware: {entity['name']}")
            result = self._call_claude(REPORT_PROMPT, content)
            if not result:
                return "Skipped: Claude error"
            confidence = result.get("confidence", 50)
            if result.get("summary"):
                self._add_note(entity["id"], result["summary"], confidence)
            if result.get("attack_techniques"):
                self._link_attack_patterns(entity["id"], result["attack_techniques"], confidence)
            self._update_score(entity["id"], confidence)
            return "Enriched"

        return "Skipped"

    def start(self):
        self.helper.log_info("AI Enrichment connector starting...")
        self.helper.listen(self.process_message)


if __name__ == "__main__":
    AIEnrichmentConnector().start()

connectors/ai-enrichment/Dockerfile

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY connector.py .
CMD ["python", "connector.py"]

connectors/ai-enrichment/requirements.txt

pycti>=6.2.0
anthropic>=0.40.0

9.4 Deploy the AI Connector

Prerequisites: Set ANTHROPIC_API_KEY in .env first.

cd /home/andrey/openCTI
# Build the image
docker compose -f docker-compose.ai.yml build
# Start it
docker compose -f docker-compose.ai.yml up -d
# Verify it registered with OpenCTI (look for "AI Enrichment" in connector list)
docker logs opencti-connector-ai-enrichment-1 --tail=20

In the OpenCTI UI: Settings → Connectors → Enrichment — the connector should appear with status connected after ~10 seconds.

9.5 Testing the Pipeline

Trigger a manual enrichment by importing a real threat report:

# Import a STIX report via the API to trigger the connector
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $(grep OPENCTI_ADMIN_TOKEN .env | cut -d= -f2)" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation { reportAdd(input: { name: \"Test: APT29 spearphishing campaign\", description: \"APT29, also known as Cozy Bear, conducted a spearphishing campaign targeting NATO members using a malicious PDF dropper that installed Cobalt Strike beacon via PowerShell (T1059.001). The campaign targeted defense contractors in Poland and Germany. The malware communicated with C2 over HTTPS using domain fronting (T1090.004).\", published: \"2024-01-15T00:00:00Z\", report_types: [\"threat-report\"] }) { id name } }"
  }'

Then check what the AI connector wrote back:

# Watch connector logs for the enrichment
docker logs -f opencti-connector-ai-enrichment-1 2>&1 | grep -E "Enriching|Enriched|Error"
# Expected output:
# Enriching report: Test: APT29 spearphishing campaign
# Enriched: 1 actors, 1 malware, 2 techniques

In the UI, open the report — it should now have a Note with the summary, relationships to APT29 and Cobalt Strike, and links to T1059.001 and T1090.004.

9.6 Cost and Rate Limiting

Estimated Claude API cost per report:

~500–2000 tokens input (report text, truncated at 8000 chars)
~300 tokens output (JSON response)
At claude-opus-4-7 pricing: ~$0.01–0.05 per report

Rate limiting: The Anthropic API has per-minute token limits. If AlienVault imports hundreds of reports in a burst, the connector will hit rate limits. Add a simple backoff:

import time
def _call_claude(self, content: str) -> dict | None:
    for attempt in range(3):
        try:
            msg = self.client.messages.create(...)
            return json.loads(msg.content[0].text)
        except anthropic.RateLimitError:
            time.sleep(60 * (attempt + 1))
        except (json.JSONDecodeError, anthropic.APIError) as e:
            self.helper.log_error(f"Claude call failed: {e}")
            return None
    return None

To limit scope (only enrich reports above a confidence threshold, skip low-quality feeds):

def process_message(self, data: dict) -> str:
    report = self.helper.api.report.read(id=entity_id)
    # Skip reports with low confidence (e.g. AlienVault auto-generated)
    if report.get("confidence", 0) < 40:
        return "Skipped: low confidence"
    return self._enrich_report(report)

9.7 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

10. Post-Deployment Hardening

10.1 Reverse Proxy with TLS (nginx)

# /etc/nginx/sites-available/opencti
server {
    listen 443 ssl http2;
    server_name opencti.yourdomain.com;
ssl_certificate     /etc/letsencrypt/live/opencti.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/opencti.yourdomain.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        client_max_body_size 100m;
    }
}
server {
    listen 80;
    server_name opencti.yourdomain.com;
    return 301 https://$host$request_uri;
}

10.2 Backup Strategy

#!/bin/bash
# /home/andrey/openCTI/scripts/backup.sh
set -euo pipefail
BACKUP_DIR="/mnt/backup/opencti/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
# Snapshot ElasticSearch
curl -s -u elastic:${ELASTIC_PASSWORD} \
  -X PUT "http://localhost:9200/_snapshot/backup/snapshot_$(date +%Y%m%d)" \
  -H 'Content-Type: application/json' \
  -d '{"indices": "*", "ignore_unavailable": true}'
# Dump MinIO (reports, files)
docker run --rm \
  --network opencti_network \
  -v "$BACKUP_DIR:/backup" \
  minio/mc:latest \
  mirror myminio/opencti /backup/minio/
echo "Backup completed: $BACKUP_DIR"

10.3 Security Checklist

Change all default passwords in .env
Generate unique UUID4 tokens for every connector
Enable TLS via nginx reverse proxy
Restrict port 8080 to localhost only (127.0.0.1:8080:8080)
Enable ElasticSearch authentication (already configured above)
Set up fail2ban on the nginx access log
Rotate OPENCTI_ADMIN_TOKEN every 90 days
Review TLP markings — ensure nothing RED leaks via TAXII
Enable audit logging: APP__APP_LOGS__LOGS_LEVEL: info

11. Operational Runbook

Day 1 — Initial Data Load

# MITRE ATT&CK loads first (foundational framework)
# Wait ~10 minutes for it to complete, then verify:
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)

curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ attackPatterns { edges { node { name } } } }"}' | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print('Techniques loaded:', len(d['data']['attackPatterns']['edges']))"
# Should return 500+ techniques

Common Operations

# Check all connector health
docker compose -f docker-compose.connectors.yml ps
# View connector logs
docker compose -f docker-compose.connectors.yml logs --tail=50 connector-alienvault
# Restart a stuck connector
docker compose -f docker-compose.connectors.yml restart connector-malwarebazaar
# Scale workers for high ingest load
docker compose -f docker-compose.yml up -d --scale worker=5
# Check ElasticSearch cluster health
curl -s -u elastic:${ELASTIC_PASSWORD} http://localhost:9200/_cluster/health?pretty
# Check RabbitMQ queue depth (should stay near 0 at rest)
docker exec $(docker ps -qf name=rabbitmq) rabbitmqctl list_queues name messages

Monitoring Metrics to Watch

Quick Reference

# Start everything
cd /home/andrey/openCTI
docker network create opencti_network 2>/dev/null || true
docker compose -f docker-compose.yml up -d
docker compose -f docker-compose.connectors.yml up -d
docker compose -f docker-compose.ai.yml up -d
# Stop everything
docker compose -f docker-compose.ai.yml down
docker compose -f docker-compose.connectors.yml down
docker compose -f docker-compose.yml down
# Access
# UI:      http://localhost:8080
# API:     http://localhost:8080/graphql
# MinIO:   http://localhost:9001
# RabbitMQ: http://localhost:15672

12. Troubleshooting

Known Issues — OpenCTI 6.2.0 + ElasticSearch 8.13

ILM Race Condition (resource_already_exists_exception)

ES 8.13’s ILM daemon auto-bootstraps rollover indices the moment an index template with lifecycle.rollover_alias is created. OpenCTI's elCreateIndex does a check-then-create which loses the race. This kills initialization and loops with restart: always.

Fix already applied: patches/back.js is mounted over the compiled bundle and makes elCreateIndex idempotent — it catches resource_already_exists_exception and returns null.

Re-initialization procedure (if ES volume is dropped):

# 1. Delete any leftover index templates from a failed run
curl -s -u elastic:${ELASTIC_PASSWORD} -X DELETE \
  "http://localhost:9200/_index_template/opencti*"

# 2. Flush Redis state
docker exec opencti-redis-1 redis-cli -a opencti FLUSHALL

# 3. Start ES first, wait for green/yellow
docker compose up -d elasticsearch
until curl -s -u elastic:${ELASTIC_PASSWORD} \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  sleep 5; done

# 4. Start the rest — OpenCTI will create 13 indices and load base STIX data (~5-10 min)
docker compose up -d

ElasticSearch Disk Watermark (cluster RED, no shard allocation)

ES 8.x refuses all shard allocation when disk exceeds 90% high watermark. cluster.routing.allocation.disk.threshold_enabled=false is set in docker-compose.yml.

To reclaim disk space:

docker system prune -a   # frees ~47 GB of unused images/containers

Connectors Can’t Reach opencti Hostname

Both compose files must share the same Docker network. docker-compose.yml defines:

networks:
  default:
    name: opencti_network
    external: true

If the main stack was started without this, run:

docker network connect --alias opencti opencti_network opencti-opencti-1

Then add the networks: block to docker-compose.yml and run docker compose up -d to make it permanent.

OPENCTI_TOKEN vs CONNECTOR_ID

Connectors authenticate to OpenCTI using OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}. The per-connector UUID variables (CONNECTOR_MITRE_TOKEN, etc.) are only used as CONNECTOR_ID — they identify the connector instance in the UI, not for authentication.

CVE Connector — Zero Vulnerabilities Imported (NVD API Key Bug)

connector-cve:6.2.0 has a bug: it sends the NVD API key as Bearer: in the HTTP header, but NVD 2.0 API requires apiKey: . The connector silently gets a non-200 response and imports nothing. Additionally, CVE_MAX_DATE_RANGE is required but missing from the image's default config — omitting it causes a TypeError: '>' not supported between instances of 'NoneType' and 'int' crash every 60 seconds.

Fix: Mount a patched api.py that uses the correct header, and add the missing vars:

connector-cve:
  image: opencti/connector-cve:6.2.0
  volumes:
    - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
  environment:
    CVE_MAX_DATE_RANGE: 120
    CVE_MAINTAIN_DATA: "true"
    # ... other vars

patches/cve/api.py — change header from "Bearer": api_key to "apiKey": api_key:

headers = {"User-Agent": header}
if api_key:
    headers["apiKey"] = api_key

13. Usage Examples

13.1 Standard OpenCTI Workflows

Example 1 — Investigate an IP address

You received an alert from your SIEM about suspicious outbound traffic to 103.113.70.102.

In OpenCTI UI:

Search → type 103.113.70.102

If AlienVault or URLhaus has seen it, you’ll find:

Which threat actor uses this IP as C2
What malware family communicates with it
When it was first/last observed
TLP marking and confidence score
All reports that mention it

Via API:

TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ stixCyberObservables(filters: {mode: and, filters: [{key: \"value\", values: [\"https://103.113.70.102/bin/support.client.exe\"]}], filterGroups: []}) { edges { node { id entity_type ... on Url { value } } } } }"}' | python3 -m json.tool

Example 2 — Build an APT profile

You want to understand everything known about Lazarus Group before a threat briefing.


Threats → Intrusion Sets → search "Lazarus"

The profile shows:

Attributed to: North Korea
Motivations: Financial gain, Espionage
Targets: Finance, Cryptocurrency, Defense
Malware used: WannaCry, Hermes, BLINDINGCAN (all auto-linked by MITRE connector)
Techniques: 80+ ATT&CK techniques with usage relationships
Campaigns: Operation AppleJeus, Dream Job, etc.
Timeline: chronological view of all activity

Click “ATT&CK Patterns” tab → heatmap showing which techniques Lazarus uses most.

Example 3 — Import a threat report (PDF / blog post)

You found a Mandiant or CrowdStrike blog post about a new campaign.

Data → Import → drag and drop the PDF or paste the URL
Select format: "Auto detect" or "Report"

OpenCTI parses it and creates a Report object. The AI enrichment connector then picks it up automatically and extracts:

Threat actors mentioned
Malware families
ATT&CK technique IDs
Targeted sectors and countries

All as STIX relationships, visible immediately in the UI.

Example 4 — Track a CVE across your environment

CVE-2024–21762 (Fortinet FortiOS RCE) was just published. Check what you know about it.

Arsenal → Vulnerabilities → search "CVE-2024-21762"

After the CVE connector syncs, you’ll see:

CVSS score and vector
Affected software versions
Which threat actors exploit it (once AlienVault/MITRE data arrives)
Which campaigns used it
Related indicators (IPs, domains used in exploitation)

Example 5 — Create an incident from a sighting

Your EDR detected Cobalt Strike beacon on a workstation.

Activities → Incidents → Create
  Name: "CS beacon on WS-042"
  Type: "Intrusion"
  Confidence: 90
  Add object: link to Cobalt Strike (malware)
  Add object: link to T1071.001 (C2 over HTTP)
  Add observable: add the C2 IP

With sighting_incident rule enabled, future detections of the same C2 IP automatically raise new incidents without manual work.

Example 6 — Export IOCs to your firewall / SIEM

You want a live blocklist of all HIGH confidence IPv4 indicators.

Data → Indicators
Filter: Score > 70, Type = IPv4-Addr, Valid until > today
Export → CSV or STIX

Or use the built-in TAXII 2.1 server to push directly to your SIEM:

Settings → Taxii Server → Create collection "High confidence IOCs"
Configure your SIEM to poll: http://localhost:8080/taxii2/

Example 7 — Map your detection coverage against ATT&CK

You want to know which techniques you detect vs which you’re blind to.

Technics → Attack Patterns
Filter by: used by (Lazarus Group)

Cross-reference the list with your SIEM detection rules. Techniques with no detection rule = gap in coverage.

Export the filtered list as CSV and import into ATT&CK Navigator for a visual heatmap of covered vs uncovered techniques.

Example 8 — Pivot from malware to infrastructure

You found a Ryuk ransomware sample (SHA256 hash).

Search → paste the SHA256

From the malware object, pivot to:

Related indicators → domains and IPs used for C2
Used by → Wizard Spider (threat actor)
Campaigns → which ransomware campaigns used this variant
Techniques → T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery)

Each pivot is one click in the graph view.

Example 9 — Share intelligence with a partner org

You want to share a report with a partner but strip out RED-marked internal data.

Open the report → Actions → Share
Select TLP level: TLP:AMBER (only partner can see it)

Or use Workspaces → Sharing groups to create a federated share with another OpenCTI instance. All objects above RED are automatically excluded from the export.

Example 10 — Build a custom dashboard for your sector

Your org is in Finance. You want a live dashboard showing threats to your sector.

Home → Dashboards → Create dashboard "Finance Threat Landscape"
Add widgets:
  - "Threat actors targeting Finance" (bar chart)
  - "Most used techniques against Finance" (ATT&CK heatmap)
  - "New IOCs last 7 days" (timeline)
  - "Active campaigns" (list)
  - "CVEs affecting banking software" (table)

Each widget auto-updates as new data arrives from connectors.

If you like this research, buy me a coffee (PayPal) — Keep the lab running

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

Portfolio / Knowledge Base: https://1200km.com/
Medium: https://medium.com/@1200km
GitHub: https://github.com/anpa1200
LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

The Intelligent Shield. OpenCTI was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Dutch Authorities Dismantle Massive Botnet Network Linked to 17 Million Compromised Devices

Mon, 15 Jun 2026 08:23:44 +0200

Dutch authorities have shut down what is believed to be one of the largest botnet operations ever uncovered, disrupting a cybercrime network that compromised more than 17 million internet-connected devices globally. The affected devices reportedly included computers, smartphones, tablets,…

The post Dutch Authorities Dismantle Massive Botnet Network Linked to 17 Million Compromised Devices appeared first on IT Security News.

GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations

Fri, 12 Jun 2026 15:19:50 +0200

A notable operational pivot by the GRU-linked intrusion set APT28 (aka Fancy Bear, Sofacy, Forest Blizzard, Pawn Storm) that combines the MooBot botnet and compromised EdgeRouters to enable resilient cyber operations. This shift amplifies APT28’s long-standing focus on NATO, Ukrainian…

The post GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations appeared first on IT Security News.

GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations

Fri, 12 Jun 2026 14:41:31 +0200

The post GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

JDY-Botnet wächst auf über 1.500 IoT- und SOHO-Geräte für KI-ähnliche Zielaufklärung

Thu, 11 Jun 2026 18:20:43 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher warnen vor einer erneuten Ausbreitung des JDY-Botnetzes: Es nutzt inzwischen über 1.500 SOHO- und IoT-Geräte, um offen einsehbare Dienste automatisiert zu entdecken und systematisch zu fingerprinten. Der Ansatz liefert strukturierte Aufklärungsdaten als Vorstufe für spätere Zieldefinition und Ausnutzung. Besonders kritisch: Das Botnet passt seine Scan-Methodik an Privilegien und verfügbare Protokolle […]

... den vollständigen Artikel »JDY-Botnet wächst auf über 1.500 IoT- und SOHO-Geräte für KI-ähnliche Zielaufklärung« lesen

Dieser Beitrag JDY-Botnet wächst auf über 1.500 IoT- und SOHO-Geräte für KI-ähnliche Zielaufklärung erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Security experts sound alarm over 'expanded' China-linked botnet used to target US critical infrastructure and military assets

Thu, 11 Jun 2026 17:53:52 +0200

The China-linked botnet highlights risk of leaving routers and IoT devices unpatched

JDY-Botnet wächst auf 1.500+ Geräte: Zentrale KI-gestützte Reconnaissance für Edge-Schwachstellen

Thu, 11 Jun 2026 15:38:05 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher warnen vor einer deutlichen Ausweitung des JDY-Botnets auf über 1.500 SOHO- und IoT-Geräte. Das Netzwerk fungiert als zentral gesteuerter Scanner, der Dienste identifiziert, systematisch profiliert und verwertbare Reconnaissance-Daten liefert. Besonders relevant ist die Umgehung klassischer IP-basierter Schutzmechanismen, da die Erkennung über viele Adressen und Standorte verteilt wird. Damit wird JDY […]

... den vollständigen Artikel »JDY-Botnet wächst auf 1.500+ Geräte: Zentrale KI-gestützte Reconnaissance für Edge-Schwachstellen« lesen

Dieser Beitrag JDY-Botnet wächst auf 1.500+ Geräte: Zentrale KI-gestützte Reconnaissance für Edge-Schwachstellen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

China-linked recon botnet outpaces enterprise defenses

Thu, 11 Jun 2026 12:08:39 +0200

A botnet made up of compromised small office and Internet of Things devices has grown into a larger reconnaissance network capable of rapidly identifying vulnerable internet-facing systems after public vulnerability disclosures, researchers said.

The botnet, tracked by Lumen’s Black Lotus Labs as JDY, now comprises more than 1,500 compromised small office and home office, or SOHO, and IoT devices, and is being used to “discover, fingerprint and continuously map exposed services at scale.”

Lumen said the activity is linked to Chinese nation-state-backed actors, including Volt Typhoon. The findings point to a growing challenge for enterprise security teams. Many enterprise edge systems remain outside traditional endpoint monitoring, giving adversaries room to move quickly from vulnerability disclosure to targeted reconnaissance.

Lumen added that JDY’s distributed infrastructure can also help operators evade geofencing and other IP-based defenses because the activity may appear to come from legitimate residential or small-business internet traffic.

JDY undermines several defensive assumptions that many enterprises still rely on, according to Sakshi Grover, senior research manager for IDC Asia Pacific Cybersecurity Services.

Geofencing and IP reputation controls have limited value when used in isolation, Grover said, while static blocklists are structurally weak against botnets that continuously rotate compromised infrastructure. JDY also exposes a broader visibility gap around edge devices, which are often difficult for enterprises to monitor with the same rigor as endpoints and cloud workloads.

Reconnaissance moves closer to attack

Analysts said that CISOs should not dismiss JDY as just another botnet.

“The reported JDY activity shows a clear focus on discovering, fingerprinting, and continuously mapping exposed services at scale, including shortly after public vulnerability disclosures,” Grover said. “That points to a more industrialized model of pre-exploitation reconnaissance, where compromised edge devices are used not merely for disruption or commodity abuse, but to generate timely targeting intelligence for follow-on operations.”

That means the compromised SOHO and IoT devices may not be the final target. Instead, they provide the scanning layer used to identify exposed enterprise infrastructure, including routers, firewalls, VPNs, cameras, and other internet-facing systems.

Devashri Datta, a cybersecurity researcher, said CISOs should treat JDY as evidence of a shift in how reconnaissance is being operationalized.

“If JDY is sitting in your risk register under ‘routine botnet management’, your defensive playbook will fail before it starts,” Datta said. “JDY isn’t designed to DDoS anyone, steal credentials, or mine cryptocurrency. It is a centrally controlled, high-performance scanning engine.”

Patch timelines come under pressure

The scanning activity also raises questions about whether conventional vulnerability management timelines are still workable for perimeter systems exposed to the internet.

“Traditional SLA-driven patching is no longer defensible for perimeter devices,” Datta said.

The size of the botnet matters less than the speed of its targeting cycle, according to Sanchit Vir Gogia, chief analyst at Greyhound Research. “Fifteen hundred devices that find the right vulnerable systems within hours are worth more than a hundred thousand generating noise,” Gogia said. “Exploitation no longer begins when malicious code arrives. It begins when exposure is discovered.”

The concern is that JDY may already have collected much of the information attackers need before a new vulnerability is disclosed. Datta said the botnet’s reconnaissance can include IP addresses, port configurations, protocol information, service banners, TLS versions, certificate metadata, and associated domains.

That gives operators a head start when a critical flaw becomes public. Lumen said Black Lotus Labs observed a selective increase in scans of Fortinet equipment shortly after the disclosure of CVE-2026-35616, indicating the ability and intent to identify vulnerable devices before patches are widely applied.

For CISOs, Datta said, the response requires pre-approved playbooks for perimeter devices, including accelerated patching, access control list changes, temporary disabling of exposed features, and lockdown of management interfaces.

Hackers Use Residential Proxies Networks to Evade Detection

Thu, 11 Jun 2026 12:08:26 +0200

The impact of residential proxies across our customer base by compiling billions of DNS resolutions and the associated network telemetry. The Kimwolf Botnet inside our enterprise customer networks. Follow‑up analysis of billions of DNS resolutions across Infoblox Threat Defense Cloud customers reveals a…

The post Hackers Use Residential Proxies Networks to Evade Detection appeared first on IT Security News.

China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation

Thu, 11 Jun 2026 11:37:54 +0200

A China-linked network of compromised routers and smart devices has grown into one of the most capable reconnaissance tools tied to a nation-state threat group. Researchers have identified a major resurgence of a botnet known as JDY, which now controls more than 1,500 small office and home office (SOHO) and Internet of Things (IoT) devices […]

The post China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation appeared first on Cyber Security News.

China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation

Thu, 11 Jun 2026 11:37:49 +0200

The post China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation appeared first on IT Security News.

Hackers Use Residential Proxies Networks to Evade Detection

Thu, 11 Jun 2026 11:37:45 +0200

The post Hackers Use Residential Proxies Networks to Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

JDY Botnet Evolves After KV Takedown, Targets Military Networks

Thu, 11 Jun 2026 10:38:54 +0200

JDY botnet scans SOHO/IoT devices globally to map services and targets, especially US military networks. Lumen’s Black Lotus Labs reported the resurgence of the JDY botnet, a covert reconnaissance network tied to Chinese state-sponsored hacking groups including Volt Typhoon. The…

The post JDY Botnet Evolves After KV Takedown, Targets Military Networks appeared first on IT Security News.

JDY Botnet Evolves After KV Takedown, Targets Military Networks

Thu, 11 Jun 2026 10:23:39 +0200

IT Security News Hourly Summary 2026-06-11 09h : 4 posts

Thu, 11 Jun 2026 09:09:28 +0200

4 posts were published in the last hour 6:34 : China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits 6:34 : GitLab Patches Multiple Vulnerabilities Allowing Account Takeover 6:34 : Hackers Exploit AWS CloudTrail and Google Cloud Logging to…

The post IT Security News Hourly Summary 2026-06-11 09h : 4 posts appeared first on IT Security News.

China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits

Thu, 11 Jun 2026 08:37:38 +0200

The post China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits appeared first on IT Security News.

China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits

Thu, 11 Jun 2026 08:12:16 +0200

A significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat activity. Once a component of the larger KV-botnet ecosystem, JDY has expanded to more than 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices and now functions as a high-performance, centrally controlled scanner that accelerates vulnerability discovery […]

The post China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

JDY Botnet Expands With 1,500 Compromised Devices Targeting Fresh Vulnerabilities

Thu, 11 Jun 2026 08:12:09 +0200

A significant resurgence of the JDY botnet, a covert reconnaissance network linked to China-nexus threat groups such as Volt Typhoon. Originally part of the larger KV-botnet ecosystem that was heavily disrupted by U.S. government takedowns in early 2024, the JDY cluster managed to survive. Today, it operates as a highly efficient operational relay box (ORB) […]

The post JDY Botnet Expands With 1,500 Compromised Devices Targeting Fresh Vulnerabilities appeared first on Cyber Security News.

6/10/2026

Thu, 11 Jun 2026 01:38:28 +0200

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance …China-Linked JDY Botnet Expands Targeting of U.S. Military NetworksUK Weakens Proposed Telecoms Defenses Against Chinese Hackers After Industry PushbackNorth Koreans Behind Nearly Half of U.S. Tech Industry Hacks, Says CrowdStrikeCISA Tells U.S. Agencies to Fix Security Bugs in as Little as 3 Days Thanks to … Continue reading

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Wed, 10 Jun 2026 19:10:38 +0200

Cybersecurity researchers have warned of a “resurgence and expansion” of JDY, a covert network associated with China-nexus state-sponsored threat actors. “The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devices and operates as a centrally…

The post China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance appeared first on IT Security News.

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Wed, 10 Jun 2026 18:39:36 +0200

Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state-sponsored threat actors. "The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devices and operates as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale," Lumen's

China-linked JDY botnet expands targeting of U.S. military networks

Wed, 10 Jun 2026 17:29:36 +0200

The JDY botnet, a malware network previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded its targeting scope and reconnaissance efforts. [...]

Silent Ransom Group Uses Fast Flux Botnet to Hide Law Firm Leak Sites

Mon, 08 Jun 2026 16:09:14 +0200

Cybersecurity firm Resecurity reports Silent Ransom Group is using a fast flux botnet to hide data leak sites while targeting law firms with theft and vishing. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and…

The post Silent Ransom Group Uses Fast Flux Botnet to Hide Law Firm Leak Sites appeared first on IT Security News.

Silent Ransom Group Uses Fast Flux Botnet to Hide Law Firm Leak Sites

Mon, 08 Jun 2026 15:52:45 +0200

Cybersecurity firm Resecurity reports Silent Ransom Group is using a fast flux botnet to hide data leak sites while targeting law firms with theft and vishing.

IoT Botnet C0XMO Adds Competitor-Killing Capability

Mon, 08 Jun 2026 09:43:41 +0200

C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoS attacks. In March 2026, FortiGuard Labs discovered a new variant of the Gafgyt botnet, dubbed C0XMO, which is noticeably…

The post IoT Botnet C0XMO Adds Competitor-Killing Capability appeared first on IT Security News.

IoT Botnet C0XMO Adds Competitor-Killing Capability

Mon, 08 Jun 2026 09:31:53 +0200

C0XMO botnet spreads via DD-WRT router flaw, kills rival malware

Sun, 07 Jun 2026 16:35:22 +0200

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. [...]

Chinesische Hacker-Gruppe TA4922 steigert Angriffstempo auf Deutschland

Sat, 06 Jun 2026 13:19:58 +0200

Die chinesischsprachige Hacker-Gruppe TA4922 weitet ihre Angriffe massiv auf Europa aus und nutzt dafür KI-generierte Phishing-Kampagnen.

Tags: #Cyber Crime | #Künstliche Intelligenz

Top 5 Best Tools for Simulated DDoS Attacks in 2026

Sat, 06 Jun 2026 10:34:44 +0200

Last year, a botnet hurled 31.4 Tbps of junk traffic at a single target—enough data to stream every Netflix movie at once. The record-shattering flood forced boards, regulators, and cloud teams to ask one question: are we sure our defenses…

The post Top 5 Best Tools for Simulated DDoS Attacks in 2026 appeared first on IT Security News.

Top 5 Best Tools for Simulated DDoS Attacks in 2026

Sat, 06 Jun 2026 08:52:33 +0200

The post Top 5 Best Tools for Simulated DDoS Attacks in 2026 appeared first on Cyber Security News.

New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation

Fri, 05 Jun 2026 23:38:04 +0200

A newly discovered variant of the Gafgyt botnet malware, named C0XMO, has been quietly spreading across Linux-based devices by targeting a known vulnerability in DD-WRT router firmware. The malware exploits a stack buffer overflow flaw in the UPnP service of…

The post New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation appeared first on IT Security News.

New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation

Fri, 05 Jun 2026 21:52:52 +0200

The post New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation appeared first on Cyber Security News.

Weiteres Botnet zerschlagen mit 17 Millionen Geräten und Servern - B2B Cyber Security

Fri, 05 Jun 2026 18:35:24 +0200

Jetzt Newsletter abonnieren. Einmal im Monat die besten News von B2B CYBER SECURITY lesen. E-Mail.

New Gafgyt Variant Targets Linux Systems With Modular Spread Tactics

Fri, 05 Jun 2026 12:34:46 +0200

A new Gafgyt-family botnet, tracked as C0XMO, marks a notable technical shift in IoT malware design: the separation of scanning and propagation into distinct components and multi-architecture payloads that maximize reach across heterogeneous Linux devices. The operator delivered C0XMO by…

The post New Gafgyt Variant Targets Linux Systems With Modular Spread Tactics appeared first on IT Security News.

Gafgyt Malware Variant Expands Attacks Across Linux Architectures

Fri, 05 Jun 2026 12:22:30 +0200

A new variant of the Gafgyt botnet, tracked as C0XMO, is rapidly expanding its reach across multiple Linux architectures. Discovered earlier this year, this malware initially breaches systems by exploiting CVE-2021-27137, a stack buffer overflow vulnerability found in the UPnP service of specific DD-WRT routers. By sending specially crafted M-SEARCH requests over UDP port 1900, […]

The post Gafgyt Malware Variant Expands Attacks Across Linux Architectures appeared first on Cyber Security News.

New Gafgyt Variant Targets Linux Systems With Modular Spread Tactics

Fri, 05 Jun 2026 12:08:10 +0200

The post New Gafgyt Variant Targets Linux Systems With Modular Spread Tactics appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security Researchers Are Threat Actors - PSW #929

Thu, 04 Jun 2026 23:18:00 +0200

Author: Security Weekly - A CRA Resource - Bewertung: 1x - Views:4

This week in the security news:

- Security Researchers Are Threat Actors according to Microsoft
- Hands-free malicious firmware
- If you've ever typed "ls" in Windows, this is for you
- Cisco makes more patches, wants you to pay
- Ambiguous Secure Boot bypass
- Threat actors love network edge devices, and I have the chat logs and leaks to prove it
- The downside of chip sanctions
- Your VoIP phone is hacked
- Vulnerability disclosure and incentives
- Claude reccovers Bitcoin wallet
- an Instagram "Exploit"
- Turn the plane around
- The worms will continue
- PAN-OS global protect vulnerability
- The 1-Click Github token stealer
- Data-nuking prompt injection
- Turning Buses into spies
- SymJack
- NIST NVD mistakes, and how CNAs need to up their game

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-929

Chapters

00:00 Security News Roundup
02:51 SALTCON Insights and Reflections
10:58 NIST Vulnerability Database Issues
22:13 The Value of CVEs and Patching Strategies
27:08 The Challenge of Open Source Vulnerabilities
28:46 The Role of AI in Vulnerability Research
30:20 The Patch Dilemma: Finding and Applying Fixes
32:36 Vendor Incentives and Security Practices
36:22 SaaS Solutions and Security Responsibilities
38:34 The Future of AI in Software Security
41:05 Vulnerabilities in Consumer Devices
45:28 AI and Social Engineering Vulnerabilities
50:34 Microsoft's Stance on Vulnerability Disclosure
53:42 The BitLocker Bypass Controversy
56:39 Vulnerability Disclosure and Microsoft's Response
59:22 The Shadow Brokers and Historical Context
01:01:07 Dutch Police and the IOT Botnet Shutdown
01:04:40 Reflections on the Evolution of Hacking
01:06:21 The First Documented Computer Hack for Profit
01:14:43 Air Travel and Bluetooth Mishaps
01:20:37 Bluetooth Vulnerabilities and Security Risks
01:29:01 Accidental Discoveries in Tech
01:32:28 Exploring Arduino and Tamper Protection
01:33:30 Nightmare Eclipse and Secure Boot Vulnerabilities
01:35:05 Impact of US Sanctions on China's Tech Innovation
01:38:01 Challenges in Domestic Chip Manufacturing
01:40:46 Nuclear Energy and Its Role in Future Power Needs
01:43:41 Data Center Power Demands and Cooling Solutions
01:48:05 Phishing Attacks and Cybersecurity Awareness
01:49:46 Legislative Concerns Over Location Data Privacy

Dutch police, NCSC take down major botnet

Thu, 04 Jun 2026 09:36:16 +0200

A collaboration between the Dutch National Police and the National Cyber Security Centre (NCSC), has seen a large botnet being shut down. In this operation, 200 servers were identified and addressed as well. These servers controlled millions of infected devices,…

The post Dutch police, NCSC take down major botnet appeared first on IT Security News.

Dutch police, NCSC take down major botnet

Thu, 04 Jun 2026 09:07:23 +0200

'You can no longer do things at human scale': Cisco releases AI agent botnet that works on behalf of your business

Wed, 03 Jun 2026 18:17:48 +0200

Cyberspace has become an AI battlefield, and Cisco wants in on the action.

Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO

Wed, 03 Jun 2026 15:38:22 +0200

FortiGuard Labs analyzes C0XMO, a new Gafgyt variant leveraging DD-WRT exploitation and multi-architecture propagation to expand IoT botnet infections. This article has been indexed from FortiGuard Labs Threat Research Read the original article: Inside the Cross-Platform Propagation of a…

The post Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO appeared first on IT Security News.

Niederländische Behörden stoppen Botnetz mit 17 Millionen Geräten und Proxy-Infrastruktur

Tue, 02 Jun 2026 15:20:42 +0200

AMSTERDAM / LONDON (IT BOLTWISE) – Die niederländischen Strafverfolger haben ein Botnetz zerschlagen, das Berichten zufolge mindestens 17 Millionen kompromittierte Geräte für Angriffe missbrauchte. Laut den Behörden spielten dabei über 200 Server in den Niederlanden die Rolle einer zentralen Backend-Infrastruktur. In der Analyse rückt zudem die Proxy-Schiene in den Fokus, bei der kompromittierte Endgeräte als […]

... den vollständigen Artikel »Niederländische Behörden stoppen Botnetz mit 17 Millionen Geräten und Proxy-Infrastruktur« lesen

Dieser Beitrag Niederländische Behörden stoppen Botnetz mit 17 Millionen Geräten und Proxy-Infrastruktur erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Niederländische Behörden stoppen Botnet mit bis zu 17 Mio. infizierten Geräten

Tue, 02 Jun 2026 14:22:58 +0200

AMSTERDAM / LONDON (IT BOLTWISE) – Niederländische Behörden haben ein Botnet zerschlagen, das Berichten zufolge rund 17 Millionen Geräte in einer zentral gesteuerten Infrastruktur missbrauchte. Über mehr als 200 Server in den Niederlanden lief die Backend-Plattform, bevor ein Teil davon sichergestellt und später offline genommen wurde. Besonders brisant: Die Kampagne stand im Zusammenhang mit Proxy-Diensten, […]

... den vollständigen Artikel »Niederländische Behörden stoppen Botnet mit bis zu 17 Mio. infizierten Geräten« lesen

Dieser Beitrag Niederländische Behörden stoppen Botnet mit bis zu 17 Mio. infizierten Geräten erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Meta AI hands over Instagram access, Dutch police dismantle botnet, RedHat packages backdoored

Tue, 02 Jun 2026 09:35:45 +0200

Meta AI hands over Instagram account access Dutch police dismantle huge botnet RedHat packages get backdoored Get the show notes here: https://cisoseries.com/meta-ai-hands-over-instagram-access-dutch-police-dismantle-botnet-redhat-packages-backdoored/ Huge thanks to our episode sponsor, Vanta Your team just added its 67th AI tool. And unfortunately, also…

The post Meta AI hands over Instagram access, Dutch police dismantle botnet, RedHat packages backdoored appeared first on IT Security News.

Zero trust physical security needs trust decisions at the edge

Tue, 02 Jun 2026 07:38:06 +0200

In this interview with Help Net Security, Chuck Davis, VP, Global Information Security at Hikvision, explains how zero trust applies to physical security systems like cameras and door controllers. He breaks down how to make trust decisions at the edge without recreating old perimeter assumptions, why these devices should be treated as IT assets, and what the Mirai botnet taught the industry. Davis also covers posture assessment for devices that cannot run standard agents, and … More →

The post Zero trust physical security needs trust decisions at the edge appeared first on Help Net Security.

Dutch Police Dismantle Massive 17-Million-Device Botnet

Mon, 01 Jun 2026 20:07:59 +0200

The post Dutch Police Dismantle Massive 17-Million-Device Botnet appeared first on SecurityWeek.

Dutch Police Dismantle Massive 17-Million-Device Botnet

Mon, 01 Jun 2026 20:07:54 +0200

Dutch authorities seized command-and-control servers tied to a botnet of infected computers, smartphones, and tablets that was allegedly used to power a residential proxy network and facilitate cybercrime. The post Dutch Police Dismantle Massive 17-Million-Device Botnet appeared first on SecurityWeek.…

The post Dutch Police Dismantle Massive 17-Million-Device Botnet appeared first on IT Security News.

Botnet of More Than 17 Million Devices Dismantled

Mon, 01 Jun 2026 17:08:20 +0200

An anonymous reader quotes a report from Ars Technica: Authorities in the Netherlands said they dismantled a botnet that comprised more than 17 million devices and were managed by 200 servers in a joint operation by the police and the National Cyber Security Center. The action, announced Thursday, came about after a security researcher reported the sprawling network to authorities. The host infrastructure was located in the Netherlands. "The police then seized several botnet servers from a hosting provider for investigation," the NCSC said. "The botnet was taken offline by the provider because it was used for criminal purposes." According to a report Thursday by the NL Times, the botnet was linked to ASOCKS, a Russia-based company that provides residential proxy services. These services cater to people and organizations who want to obscure their locations or identities by proxying their Internet traffic through third-party devices. Proxy services are often used for illicit or unethical purposes such as performing DDoS attacks, running botnet command-and-control servers, operating phishing operations, and scraping website content. [...] It's unclear how the 17 million devices controlled by the botnet taken down by the Dutch police came to be that way.

Read more of this story at Slashdot.

17 million strong botnet of compromised devices dismantled by Dutch authorities

Mon, 01 Jun 2026 15:17:17 +0200

The botnet is theorized to be related to Asocks, with the possibility the proxy network has bitten the dust.

17 Millionen Zombies: Niederländische Polizei stoppt riesiges Botnetz

Mon, 01 Jun 2026 13:38:54 +0200

Den niederländischen Sicherheitsbehörden ist ein bedeutender Schlag gegen die Cyberkriminalität gelungen: Die Polizei und das Nationale Zentrum für Cybersicherheit (NCSC) konnten gemeinsam ein riesiges Botnetz außer Betrieb setzen. (Weiter lesen)

Niederländische Strafverfolger legen Botnet mit 17 Millionen Drohnen lahm | heise online

Mon, 01 Jun 2026 12:37:58 +0200

Ende vergangener Woche ist der niederländischen Polizei zusammen mit dem Nationalen Zentrum für Cybersicherheit (NCSC) des Landes ein Schlag gegen ein ...

Niederländische Strafverfolger legen Botnet mit 17 Millionen Drohnen lahm

Mon, 01 Jun 2026 10:17:34 +0200

Das niederländische NCSC und die Polizei haben ein Botnet mit 200 Servern und 17 Millionen infizierten Geräten ausgeknipst.

Niederländische Strafverfolger legen Botnet mit 17 Millionen Drohnen lahm

Mon, 01 Jun 2026 10:04:53 +0200

Das niederländische NCSC und die Polizei haben ein Botnet mit 200 Servern und 17 Millionen infizierten Geräten ausgeknipst.

CrowdStrike, Google, and Shadowserver Foundation disrupt Glassworm botnet

Mon, 01 Jun 2026 10:04:45 +0200

CrowdStrike has shared details of a coordinated operation used to disable the Glassworm botnet, which targets software developers and leverages open-source ecosystems to deploy malware. The CrowdStrike Counter Adversary Operations team, in partnership with Google and the Shadowserver Foundation, took…

The post CrowdStrike, Google, and Shadowserver Foundation disrupt Glassworm botnet appeared first on IT Security News.

CrowdStrike, Google, and Shadowserver Foundation disrupt Glassworm botnet

Mon, 01 Jun 2026 09:51:45 +0200

Botnetz zerschlagen: 17 Millionen Geräte heimlich als Proxy missbraucht

Mon, 01 Jun 2026 09:02:08 +0200

Gesteuert wurde das Botnetz über etwa 200 in den Niederlanden gehostete Server. Zu den infizierten Geräten zählen PCs, Smartphones und Router. (Botnet, Virus)

Cyberangriffe: 17-Millionen-Botnet zerschlagen, neue Lücken aktiv - BornCity

Sun, 31 May 2026 20:30:56 +0200

Besonders brisant: Eine als CVE-2026-46204 registrierte Sicherheitslücke im SMBv3-Treiber von Windows 10, Windows 11 und Windows Server 2022. Mit ...