Kimwolf

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44 seconds. In comparison, a total of 13.2 million and 10.0 million L3 DDoS attacks were recorded in Q2 and Q1 2026, respectively. The increase has been linked to DDoS-for-hire booter or stresser services that are responsible for hundreds of thousands of attacks. "Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%," the Cloudforce One threat intelligence team said in its quarterly DDoS Threat Report shared with The Hacker News. An interesting trend is the decline of hyper-volumetric attacks exceeding 1 Tbps by 69% from the previous quarter – going from 805 attacks in Q2 to 251 in Q3 – likely as a result of law enforcement actions against AISURU, KimWolf, JackSkid, and Mossad earlier this March. Still, the threat remains far from completely neutralized, given the emergence of new variants like Dysphoria and Evooo1Bot, Cloudflare warned. Another notable shift is the decline in Connectionless Lightweight Directory Access Protocol (CLDAP) floods, while DNS amplification jumped 215% to account for 3.43% of all network-layer attacks. The most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers. The U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications, and marketing sectors.

International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. As part of this operation, supported by Europol and Eurojust, the U.S. Department of Justice (DOJ), FBI, and DCIS seized Sality-linked domains in the United States, while authorities in Bulgaria, Hungary, and Romania seized additional Sality-linked domains hosted in Europe. CrowdStrike's Counter Adversary Operations team, in collaboration with international law enforcement and private industry partners, also dismantled the botnet's control channels in a peer-to-peer sinkhole operation that isolated infected machines. The Sality botnet has been active for more than two decades and has infected over 15,000 devices with malware since at least 2003, when it first surfaced. CrowdStrike says Sality is controlled by a criminal group it tracks as SALTY SPIDER, which is likely operating out of the Republic of Bashkortostan in Russia. "The victim computers infected with Sality were part of a peer-to-peer (P2P) botnet, which is a network of computers (each a 'bot) infected with the Sality malware and controlled by the Sality operator," the DOJ said. According to CrowdStrike, the two separate Sality botnet networks that were still active when the takedown took place this week were mainly used to push EggJagger malware payloads in clipjacking attacks. "Throughout its history, Sality distributed a wide variety of distinct malware families spanning credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks," CrowdStrike said. "For the past eight years, the primary payload has been EggJagger, a clipjacking tool that monitors the clipboard for cryptocurrency wallet addresses and silently replaces them with addresses controlled by the operator." The P2P botnet was disrupted by sinkholing Sality's list of known super peers, which form its communication backbone, to block file packs (direct payload transfers) and URL packs (payload download instructions) from propagating and purging infected machines' peer lists. "After more than two decades of continuous operation, CrowdStrike, together with international law enforcement and industry partners, conducted a successful disruption operation against the Sality botnet, which is now no longer under the operator's control," the cybersecurity company added. Law enforcement agencies worldwide have dismantled multiple other cybercrime operations since the start of the year as part of international joint actions. In March, American and European authorities, along with private partners, disrupted the SocksEscort cybercrime proxy network and took down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets. More recently, Dutch authorities took a massive botnet of 17 million devices offline in May, and an FBI-led operation disrupted the QScan and QTRouter hacking platforms used by Chinese cyber-espionage groups. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

New Mirai variant adds stealth capabilities to notorious botnet code Malware that adds multiple capabilities to the infamous Mirai botnet code has been actively exploiting vulnerabilities in internet-facing hardware for at least a month, researchers said Thursday. Dubbed Evooo1Bot, the Linux-based malware targets routers and other hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, according to researchers at FortiGuard Labs. Unpatched bugs in those devices allow Evooo1Bot to spread and carry out potential malicious activity, the researchers said. Evooo1Bot appears to be previously undocumented, they said. The report does not specify how many devices have been compromised worldwide, but the company’s telemetry shows activity concentrated in North America, South America, Europe, India, China and Japan. Beyond Mirai’s usual distributed denial-of-service (DDoS) functions, Evooo1Bot’s features include encrypted communications with command-and-control servers; a scanner that looks for Secure Shell (SSH) code and skips devices clearly set up as honeypots for malicious traffic; and a “sniffer” that looks for default access credentials that haven’t been changed since a device was put into service. “These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware,” FortiGuard Labs said. The malware also abuses the widely used SOCKS protocol that allows devices to connect with servers through a proxy. That capability “is arguably the most operationally significant,” FortiGuard Labs said. “By transforming a compromised router, firewall, IP camera, or other edge device into a persistent proxy, the malware enables attackers to conceal their true origin, pivot into internal networks, and conduct follow-on operations through the victim's infrastructure.” The source code for Mirai was publicly released in 2016, and in the decade since, it has served as the basis for numerous variants that have drawn the attention of law enforcement agencies and cybersecurity specialists. Descendants such as Aisuru and KimWolf were targeted by agencies from the U.S., Canada and Germany in March. A Canadian man was charged in May with running KimWolf. Joe Warminsky has been the news editor for Recorded Future News since 2022. He has three decades of experience as an editor and writer in the Washington, D.C., area. He previously he helped lead CyberScoop for more than five years. Prior to that, he was a digital editor at WAMU 88.5, the NPR affiliate in Washington, and he spent more than a decade editing coverage of Congress for CQ Roll Call.

Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints," researchers Asher Davila, Chris Navarrete, and Doel Santos said. "This makes attack traffic more difficult to distinguish from legitimate browsing." The botnet also aims to make its command-and-control (C2) infrastructure more resistant to takedown efforts by using a tiered mechanism that employs Ethereum Name Service (ENS) to obtain the C2 address, a hard-coded Tor .onion hidden service, and a local proxy for routing between clearnet and Tor, while removing all scanning, exploitation, and brute-force functionality. The removal of the scanner and exploit modules is an indication that the threat actors behind the operation have split the propagation pipeline from the core payload, offloading the task to an external loader for initial access, while the Kimwolf binary handles DDoS attacks and proxy relay. Kimwolf is known to target Android TV boxes since August 2025, while its Linux counterpart, AISURU, primarily focuses on Linux IoT devices. The botnet has been active since at least mid-2024. The botnet typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks and install malware capable of conducting DDoS attacks and acting as a relay to ferry malicious traffic. Once launched, the malware attempts to mask itself as seemingly legitimate Android system processes (e.g., "netd_service") to fly under the radar. Some of the newly observed features in the new version are as follows - Carry out HTTP/2 flood attacks powered by the nghttp2 library and disguise the traffic by constructing Google Chrome browser fingerprints that mirror legitimate browser behavior at the protocol and header level Using legitimate public Ethereum RPC services to query ENS domain records and resolve C2 addresses A backup C2 mechanism that uses a Tor .onion hidden service ("edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion") that's hard-coded into the binary A local proxy architecture that routes all C2 traffic through 127.0.0[.]1:23075, irrespective of whether it's headed to clearnet or Tor A high-performance UDP flood function that specifically targets ARM processors found in Android TV boxes Consolidate all DDoS attack commands to 15 numbered methods, down from 43 text-named methods found in prior versions The Kimwolf operators have also been found to distribute Android APK packages that masquerade as a system service called SystemService, probe for root access, and execute a bundled ELF kernel payload inside. Eight such APK artifacts have been identified between October and December 2025. "The earliest dropped sample, targeting the x86 architecture with a Dirty COW exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model," Unit 42 said. "The transition from libn[redacted]kernel.so to the less conspicuous libdevice.so filename in November 2025, followed by a revert in December, indicates active operational security adjustments." The disclosure comes as a number of new botnet malware families have been detected in recent months - AryStinger, which enlists older, vulnerable home routers into a network for distributed reconnaissance and proxying RustDuck, which hijacks home routers, IP cameras, Android boxes, and poorly secured servers to rope them into a network for conducting DDoS attacks NadMesh, which combines scanning, exploitation, and credential/AI-service intelligence harvesting into a single autonomous platform that's designed to scan for Redis, Docker, MCP, Kubernetes, ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances, drop an SSH backdoor, and harvest credentials, environment variables, account tokens, and AWS and Docker configurations Tengu, a Mirai-derived IoT malware that employs Telnet brute-force to hijack IoT devices and run instructions that allow it to launch DoS attacks, gather network configuration information, set up persistence, exfiltrate system metadata, execute commands, download additional payloads, and turn the infected node into a proxy. "Kimwolf v7 is a focused evolution of an already large-scale botnet," Unit 42 said. "Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet."

Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year. Compared with the first quarter, when the company recorded just 130 attacks above 1 Tbps, the latest figure represents a more than fivefold increase. Cloudflare is a major web infrastructure and security firm that provides CDN, DNS, reverse-proxy, and DDoS protection services to customers worldwide, protecting roughly 20% of the web. The company's services sit between DDoS botnets and their intended targets, allowing it to observe and absorb attacks at enormous scale. Recently, the company mitigated a record-breaking attack that peaked at 31.4 Tbps and 200 million requests per second, launched by the Aisuru/Kimwolf botnet. In a new report shared with BleepingComputer and presented earlier today at the Black Hat security conference, Cloudflare says that in the first half of the year it mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests. The most significant increase refers to extremely large network-layer attacks exceeding 1 Tbps, which rose 519% quarter over quarter. However, the company observed an overall jump in less severe attacks, too. Those between 500 Gbps and 1 Tbps, increased by 143%, while those between 100 and 500 Gbps rose 105%. Despite the growth in very large attacks, most incidents remained comparatively small and brief, according to Cloudflare, with 96.62% of network-layer attacks remaining below 50 Mbps and 90.6% ending within 10 minutes. Some of them lasting for more than three hours increased slightly from 0.387% in Q1 to 0.828% in Q2 2026. DDoS attacks at the network-layer rose from 10.04 million to 13.17 million, a 31.2% increase, while malicious HTTP request volume grew from 12.75 trillion to 16.89 trillion, up by 32.4%. Cloudflare saw the overall DDoS activity peaking in April, with 6.46 trillion HTTP DDoS requests and 165 PB of network-layer attack traffic. This was followed by a notable decline after April, which the firm tentatively attributes to the international Operation PowerOFF crackdown on DDoS-for-hire services. The operation resulted in the arrest of four individuals, the takedown of 53 domains, and the distribution of warnings to 75,000 users of such services. Among the trends emerging in the last quarter, Cloudflare saw that attacks shifted toward DNS-related and reflection/amplification techniques. DNS floods accounted for 40% in Q2, up from 25.7% in Q1; together DNS floods and DNS amplification attacks represented 34.3% of H1 network-layer attacks; CLDAP floods increased 881.9% quarter-over-quarter; and UDP floods ranked second in Q2 at 14.06%. Finally, regarding the targets, Cloudflare reports that the Media, Production, and Publishing sector received the largest share of mitigated HTTP DDoS requests during H1 2026, at 14.2%. The government sector also saw a notable increase, which Cloudflare linked to geopolitical events, including the US-Israeli military operation against Iran, prompting heightened hacktivism. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial slur, but preserved some references to it in order to provide researchers with the ability to identify it and check IoCs as needed. We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes. Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing. The threat’s binary includes five hard-coded public Ethereum-based endpoints for resolving Ethereum Name Service (ENS) domains. ENS is a blockchain-based naming system used to obtain C2 addresses. Kimwolf also carries a hard-coded Tor .onion hidden service as a backup and a local proxy architecture for flexible routing between clearnet and Tor. The malware developers added this function to directly respond to C2 server takedown efforts in December 2025. We discovered this variant on Feb. 3, 2026, through threat hunting that followed public disclosures by XLab, Synthient, Infoblox, Cloudflare and others. Palo Alto Networks customers are better protected through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. The Kimwolf botnet (also tracked as AISURU) has been active since August 2024. It initially targeted Linux IoT devices under the AISURU name. The botnet transitioned to Android TV boxes around August 2025. This reflects two separate codebases under the same operators. AISURU covers the Linux IoT variants, and Kimwolf covers variants targeting Android. Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Some Android TV boxes ship with ADB enabled on port 5555. Once attackers tunnel through a proxy endpoint into the local network, they can install the malware without any authentication. The Kimwolf sample we analyzed as a baseline is a statically linked ARM Executable and Linkable Format (ELF) binary. The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. It statically links BoringSSL for Transport Layer Security (TLS) operations and nghttp2 for HTTP/2 functionality. The binary is stripped but retains some symbol information. It is not uncommon for malware authors to use racial slurs in their code. The Kimwolf malware family has historically included racial slurs. In our discussion of the v7 variant, we have partially redacted these slurs, but have left enough information present that defenders could identify the variant and check for IoCs. Previous Kimwolf builds used the internal version strings such as n[redacted]boxv4 and n[redacted]boxv5, establishing the naming pattern for the family. The version string n[redacted]boxv7, shown in Figure 1, identifies this sample as version 7. The binary creates a Unix domain socket @n[redacted]boxv7 to ensure only one instance runs at a time. On execution, the malware masks its process name as netd_service to blend in with legitimate Android system processes. We identified six ELF samples that we clustered together based on multiple indicators: They share an identical ELF section layout produced by a common Android NDK build environment, and the same hard-coded set of Ethereum remote procedure call (RPC) endpoints Overlapping C2 infrastructure within the same hosting provider Consistent process-name masquerading behavior One of the most notable new capabilities in Kimwolf v7 is an HTTP/2 flood powered by the nghttp2 library. The function that performs the attack_case17_http2_flood constructs complete browser fingerprints. This makes the flood traffic difficult to distinguish from legitimate browser requests. Figure 2 shows the header construction logic in the decompiled binary. Kimwolf v7 uses a layered C2 resolution system designed to survive the domain takedowns that disrupted the botnet twice in December 2025. This isn't the last time operation of this malware faced disruption. On March 19, 2026, the U.S. Justice Department and international partners announced a court-authorized operation that seized C2 infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets. The binary contains five hard-coded public Ethereum RPC endpoints stored in plaintext, shown in Figure 3: hxxps[:]//0xrpc[.]io/eth hxxps[:]//eth.llamarpc[.]com hxxps[:]//ethereum-rpc.publicnode[.]com hxxps[:]//eth-protect.rpc.blxrbdn[.]com hxxps[:]//eth.merkle[.]io These endpoints are legitimate public Ethereum RPC services. The malware misuses them to query ENS domain records and resolve C2 addresses. Organizations should monitor for unusual Ethereum RPC traffic from IoT and Android devices rather than blocking these endpoints outright. The malware shuffles these endpoints using a pseudo-random number generator (PRNG) before each resolution attempt. The five-way redundancy makes blocking ENS-based C2 resolution harder. While the five public RPC endpoints in the baseline binary are third-party services, our infrastructure investigation identified a sixth endpoint that we assess with moderate confidence to be under the operator's control: eth[.]rpcuniverse[.]com. Several properties distinguish it from the legitimate providers: The legitimate endpoints are established services with significant traffic and resolve to multiple anycast IP addresses across major cloud delivery network (CDN) and cloud providers They have apex domains registered between 2005 and 2022 The rpcuniverse[.]com domain has no global traffic ranking - It resolves to a single IP address on a low-cost virtual private server (VPS) that was registered on Dec. 12, 2023 - Its TLS certificate first appeared on the hosting IP address days later - Reverse passive DNS shows the IP address hosts only rpcuniverse[.]com subdomains with no other tenants Two Kimwolf samples hardcode eth[.]rpcuniverse[.]com as an additional RPC endpoint alongside the five legitimate providers - Both ELF and Android APK variants contact the hosting IP address directly - We did not observe this direct-to-IP address contact pattern with any of the legitimate RPC endpoints We cannot confirm domain ownership. However, the dedicated single-tenant hosting, the timing of its registration relative to Kimwolf activity and its exclusive presence in Kimwolf binaries suggest it is an operator-controlled facade rather than a public service. When ENS resolution fails, the v7 binary falls back to a hard-coded v3 Tor .onion address (edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion). Figure 4 shows the hard-coded address in the binary. A function (tor_proxy_state_machine) manages the protocol states. To do this, it performs the following activities: Sending the greeting (0x05 0x01 0x00) Building a CONNECT request with domain type 0x03 and the 62-byte .onion address Waiting for the response and performing a TLS handshake over the tunnel Figure 5 shows the greeting and TLS handshake states. Additionally, it uses a local proxy architecture. All C2 traffic routes through a local proxy at 127.0.0[.]1:23075 shown in Figure 6, regardless of whether it is destined for clearnet or Tor. This modular design allows the proxy component to be updated independently from the main bot binary. Analysis of Kimwolf v7 samples revealed C2 connections to several IP addresses, including: 212.193.31[.]119 and 212.193.31[.]122 on TCP port 13 212.193.31[.]92 and 212.193.31[.]158 on TCP port 443 None of these IP addresses had prior indicators of malicious activity or associations with public threat intelligence. During infrastructure analysis, we observed that these hosts presented the same SSH host key. Pivoting on that shared key revealed 22 total IP addresses within the same range, presenting the identical key between Dec. 18, 2025, and Feb. 3, 2026. No hosts outside this range shared the key. IP address 212.193.31[.]102 was the first host observed with this key on Dec. 18, 2025, and it was the seed from which the configuration propagated. The remaining 21 hosts appeared over the following six weeks, with the last addition on Jan. 31, 2026. All 22 hosts reside in AS202799, geolocated to Saint Petersburg, Russia. Kimwolf implements a dedicated high-performance UDP flood function that uses a Xorshift256 PRNG seeded from /dev/urandom. It (prng_seed_from_urandom) reads 32 bytes (four 64-bit state words) to initialize the full 256-bit state. A SplitMix64 fallback initializer activates if /dev/urandom is unavailable. The flood function accelerates IP/UDP checksum computation with ARM NEON single instruction, multiple data (SIMD) instructions. The vectorized checksum loop processes four 16-bit halfwords simultaneously using VLD1.16, VADDW.U16 and VADD.I32 instructions. This optimization is tailored for the ARM processors found in Android TV boxes. It reduces per-packet checksum overhead to maximize throughput. Figure 7 shows the NEON SIMD instructions in the disassembled binary. The dispatch table supports 15 DDoS methods across Layers 3–7 of the Open Systems Interconnection (OSI) model. Cases 8, 11 and 13 are absent from the switch statement, suggesting they are either reserved for future use or were removed during consolidation from the 43 text-named methods in prior versions. Table 1 lists all 15 attack methods. Table 1. Kimwolf v7 DDoS attack methods. In Kimwolf v7, malware authors consolidated the attack count to 15 numbered methods. They removed all scanning, exploitation and brute-force functionality. The new additions target: DDoS stealth through HTTP/2 with browser fingerprinting C2 resilience through ENS, Tor and the local proxy The removal of the scanner and exploit modules suggests the operators have separated the propagation pipeline from the DDoS bot. External loaders now handle initial access while the Kimwolf binary handles attacks and proxy relay. The earliest dropped sample, targeting the x86 architecture with a Dirty COW exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model. The transition from libn[redacted]kernel.so to the less conspicuous libdevice.so filename in November 2025, followed by a revert in December, indicates active operational security adjustments. Alongside the standalone ELF payloads, the Kimwolf operators distribute Android APK packages that bundle an ELF kernel payload inside a Java wrapper. We identified eight APK samples spanning October through December 2025, all sharing the component class systemservice0644.N[redacted]Kernel. These APKs masquerade as a system service called SystemService. On execution, they probe for root access and execute the embedded ELF kernel with commands shown below in Figure 8. The earliest build (October 2025) used the com. Android prefix and bundled three kernel variants in a single APK. By late October, the package name shifted to com.n2.systemservice0644, and the kernel was consolidated to a single binary. In November, the kernel filename changed from libn[redacted]kernel.so to libdevice.so, then reverted in the December builds. Three signing certificates appear across the cluster: The original Kimwolf APK certificate (C=CN, CN=a) used by the com.android.logcatd variants An Android Debug certificate used during development A self-signed certificate with subject C=XK, ST=lol, L=lol, O=lol, OU=lol, CN=lol (country code XK for Kosovo, all other fields set to lol) used by five of the eight N[redacted]Kernel APK files The APK wrapper drops one of three ELF kernel payloads, depending on the build. These are listed in Table 2. Table 2. Dropped ELF kernel payloads. The earliest sample (first seen Sept. 2, 2025) is notable for two reasons: It targets x86 architecture rather than ARM - This indicates that the botnet originally targeted x86 Linux systems before pivoting to ARM-based IoT and Android devices It drops a file named libcow.so, and renames its process to inetd to blend in with Unix network services - The name libcow.so is likely a reference to the Dirty COW privilege escalation vulnerability (CVE-2016-5195) The libdevice.so sample renames its process to TVHelper, which explicitly targets Android TV set-top boxes by mimicking a legitimate TV helper service. Neither the libn[redacted]kernel.so nor libdevice.so kernels embed the Ethereum RPC endpoints found in the standalone ELF builds. The C2 resolution layer resides in the outer APK wrapper or the standalone ELF binary, while the kernel handles lower-level bot operations. Kimwolf v7 is a focused evolution of an already large-scale botnet. The HTTP/2 flood with Chrome browser fingerprinting complicates application-layer DDoS mitigation, as attack traffic now mirrors legitimate browser behavior at the protocol and header level. The three-tier C2 system (Ethereum ENS, Tor .onion, local proxy) indicates that the operators are investing in infrastructure built to withstand takedown operations. Organizations should monitor for the following behavioral indicators of Kimwolf compromise on IoT and Android devices: Outbound HTTPS connections to public Ethereum RPC endpoints (e.g., 0xrpc[.]io) from devices that typically do not interact with blockchain services Tor circuit establishment or SOCKS5 proxy traffic from Android TV boxes or IoT devices Connections to port 23075 on localhost A process named netd_service running on consumer Android devices Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet. Palo Alto Networks customers are better protected through the following products and services: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research, Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Device Security is designed to proactively protect the entire device attack surface, from IT to IoT and OT, with a unified platform that helps deliver comprehensive visibility, actionable risk insights and adaptive security enforcement. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hash: 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff MD5 hash: d759364844d78a728505fb0485c3adbc File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload (baseline analyzed sample); version string n[recacted]boxv7 SHA256 hash: 345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49 MD5 hash: 036bcb62be72c4663b9564955f93b05f File size: 1,712,624 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload SHA256 hash: 2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5 MD5 hash: 33faca1e0090f6b12eff703daf4606e4 File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload; hard codes eth.rpcuniverse[.]com in the binary SHA256 hash: 951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36 File type: Android APK Package name: com.android.logcatd File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf Android variant; masquerades as system logcat daemon; includes TorService and BootReceiver persistence; contacts 23.94.221[.]104 SHA256 hash: f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4 File type: Android APK Package name: com.android.logcatd File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf Android variant; sibling of the above, same signing certificate and package; contacts 23.94.221[.]104 VHash: 76554ad09897ac723a850eaf8c525efa Description: Structural hash shared by the three Kimwolf v7 ELF samples (5 total matches across VirusTotal) APK signing certificate (SHA-1 thumbprint): 2a1d96f1b066877812587ac94f45f82dfff5f5f9 Subject: C=CN, CN=a Description: Self-signed certificate used to sign both Kimwolf Android samples TLS certificate (SHA256 hash): f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237 Issuer: Let's Encrypt Description: Certificate issued for eth.rpcuniverse[.]com, observed on 23.94.221[.]104 between Dec. 13, 2023, and March 12, 2024 Domain: rpcuniverse[.]com Description: Multi-chain RPC service; apex registered Dec. 9, 2023 (Namecheap); resolves to 23.94.221[.]104; hard-coded subdomain present in Kimwolf sample Domain: eth.rpcuniverse[.]com Description: RPC subdomain hard-coded in Kimwolf sample 2ec2e85b... Domain: avax.rpcuniverse[.]com Description: RPC subdomain resolving to 23.94.221[.]104 IP address: 23.94.221[.]104 Description: Operator host (AS36352 RackNerd, Dallas); hosts rpcuniverse[.]com; contacted by Kimwolf ELF and APK samplesng IP address:port: 212.193.31[.]158:443 Description: HTTPS C2 traffic (AS202799 SYSECT, Russia); offline after Jan. 31, 2026 IP address:port: 212.193.31[.]119:13 Description: C2 traffic IP address:port: 212.193.31[.]122:13 Description: C2 traffic IP address: 212.193.31[.]102 Description: C2 host (linked via shared SSH host key with .158 IP address:port: 212.193.31[.]92:443 Description: HTTPS C2 traffic (AS202799 SYSECT, Russia) Tor hidden service: edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion Description: v7 hidden-service C2 fallback Kimwolf Botnet Exposed – XLab AISURU Botnet Technical Analysis – XLab A Broken System Fueling Botnets – Synthient Kimwolf Howls from Inside the Enterprise – Infoblox The Kimwolf Botnet is Stalking Your Local Network – KrebsOnSecurity Kimwolf Botnet Lurking in Corporate, Govt Networks – KrebsOnSecurity KIMWOLF V7 IoT BOTNET EVOLUTION - Unit 42 Updated August 13 2026 at 2:00 p.m. PT to add information on the U.S. Justice Department and international partner operation seizing C2 domains used by KimWolf and related botnets.

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the ‘jackskid’ and ‘fbot' malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism. Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm. The researchers first spotted Dysphoria on March 25 and identified multiple iterations that added meaningful updates, such as a C2 acquisition algorithm, multi-chain support, new domains, and functional separation between the relaying and DDoS variants. “Since the first quarter of 2026, XLAB has continuously tracked an emerging botnet family named Dysphoria, whose bot count exceeds 200,000,” reads XLab's report. “In just a few months, the family has undergone frequent variant updates and technical iterations, demonstrating extremely strong resilience.” The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle. Based on the researchers' analysis, infected clients send a fixed 78-byte login and heartbeat packet back to the C2 and receive from the operator DDoS attack commands that include duration, type, targets, and configurable flags. In late June, XLab observed a variant that focused only on transforming infected devices into network proxies, and completely discarded the DDoS functionality. The malware abuses UPnP (Universal Plug and Play) on the compromised device to create 155 port forwarding rules to expose internal services to inbound internet connections. XLab's report notes that the botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and various IoT devices. Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys). However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek). XLab monitored the botnet between July 14 and 20 and recorded a peak of 740,000 daily pings from infected hosts, 239,000 connections from overseas clients, and 1,800 from China. The researchers confidently estimate that the number of infected devices is around 200,000 at this time. Concerning the botnet’s firepower, its operators claim a maximum DDoS capacity of 4 Tbps on their clearnet site, which promotes the service as a legitimate stress-tester. Despite being significantly lower than the current record figure of 31.4 Tbps achieved by the Aisuru/Kimwolf botnet in December 2025, it is still enough to cause notable disruptions. Users can protect against botnet infections by keeping their devices’ firmware up to date, changing the default administrator password, disabling remote access if not necessary, and strengthening the security settings where available/possible. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese firm Qi'anxin, put its population above 200,000 bots. Their telemetry logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad. None of the counts has been independently reproduced. The researchers published no counting or de-duplication methodology, so the numbers should not be read as a precise device census. Defenders should patch exposed IoT gear, replace devices that can no longer be updated, eliminate default and weak credentials, and disable remote management and UPnP where they are not needed. The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone. Within days, Nokia Deepfield and Comcast's threat lab documented the operator falling back to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for command-and-control (C2). XLab's Dysphoria timeline opens with a JackSkid sample captured on March 25, six days after the disruption, that resolves C2 through the same domain. XLab found that the burrberry[.]eth record encodes distribution-node IPv4 addresses, while 24carnforth2merseyside[.]sol supplies other infrastructure records. The DDoS sample asks a distribution node over HTTP for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers. The design keeps those controllers one step removed from the addresses exposed to bots. The XLab analysis, published July 25, tracks a fast run of builds: custom RC4 string encryption and ENS resolution at the end of April, followed by Solana Name Service (SNS) resolution in early May. A relay-only variant appeared on June 25, with UPnP-based port mapping added days later to traverse NAT gateways. The relay-only build drops the DDoS modules and instead uses UPnP to map ports on the local gateway and Linux epoll to shuttle traffic between an outside connection and a remote C2 service. XLab documented the related Kimwolf botnet using ENS-based C2 late last year. Dysphoria couples the same resolution model with a relay mesh built from its own victims. The shift complicates a conventional server seizure, but it does not remove infrastructure from the chain: the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays. Japan's NICT independently documented the same JackSkid-to-ENS/SNS shift in May, and, like Nokia and Comcast, found code and strings shared with several other botnet families. That overlap points to shared tooling rather than proof of a single operator, and none of the researchers name one. XLab and CNCERT say Dysphoria spreads through Telnet and SSH weak-password guessing and a set of known IoT remote-code-execution flaws in routers, gateways, and cameras. One example present in both published lists is CVE-2025-9528, a Linksys E1700 command-injection flaw disclosed in August 2025 with a public exploit. The vendor did not respond to the original report. NVD's CVSS vector rates the flaw as requiring high privileges, and neither publication explains how it fits the botnet's propagation chain. A comparison by The Hacker News found that XLab's post and a mirrored CNCERT notice publish different vulnerability lists despite presenting the same joint research. Both agree that weak Telnet and SSH credentials remain the most consistent way in. XLab says Dysphoria attacks internet-service and gaming targets almost daily, but it names no victims or measured peaks. The storefront advertises attacks of up to about 4 Tbps for tens to hundreds of dollars, but that is an operator claim, not a measured attack. Cloudflare measured a 31.4 Tbps attack from the related AISURU/Kimwolf botnet before the March disruption. CNCERT, XLab, and the earlier JackSkid research name no operator. No independent source has measured a Dysphoria attack peak or confirmed the reported 200,000-device scale.

Google, the FBI, and other organizations coordinated in a joint effort to dismantle NetNut, a massive residential proxy network. Also known as Popa, NetNut is believed to consist of more than 2 million Android devices such as smart TVs and streaming boxes, that have been infected through trojanized applications and malware such as Badbox 2.0. The network’s operator, linked to the publicly-traded Israeli firm Alarum Technologies Ltd, rented the residential proxies to various threat actors, including cybercriminal and espionage groups. In a single week in June, Google observed 316 distinct threat clusters using NetNut to hide their locations in password-spray attacks and to access victim environments. “We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions,” Google said. As part of the operation, the internet giant disabled Google accounts and associated services used for command-and-control (C&C), dismantling the botnet’s backend infrastructure. Additionally, it disabled the infected applications via Google Play Protect and automatically warned victims of the threat. Google also shared threat intelligence with industry partners and law enforcement. According to Google, NetNut is not only selling access to the residential proxy network under its own brand, but also operates a reseller program, allowing other popular brands to whitelabel the NetNut botnet. The NetNut takedown follows the January disruption of IPIDEA, and is expected to have a ripple effect across the ecosystem. “What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers,” Google says. Related: Google Sues Operators of 10-Million-Device Badbox 2.0 Botnet Related: 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown Related: Dutch Police Dismantle Massive 17-Million-Device Botnet Related: GlassWorm Botnet Disrupted Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims. On June 19, three different security firms issued similar findings: That NetNut is a residential proxy network which populates a botnet called Popa, and distributes software for devices commonly found in homes, such as smart TVs and streaming boxes. NetNut’s software turns those systems into always-on residential proxy nodes that are rented to others, who predominantly use them to relay abusive and intrusive Internet traffic, such as mass content scraping, advertising fraud, and account takeover activity. Earlier today, NetNut’s homepage was replaced with a seizure notice from the FBI and the Internal Revenue Service Criminal Investigation division. The seizure notice thanked Google, Lumen, Shadowserver and other industry partners for their help in dismantling hundreds of domains tied to the Popa botnet, which experts say has long been synonymous with NetNut’s residential proxy infrastructure. In a blog post published today, the Google Threat Intelligence Group (GTIG) said NetNut’s proxy network is widely resold and white-labeled by a number of third-party proxy providers, and that its services are heavily sought out by cybercriminals seeking to obfuscate the source of their malicious traffic. The GTIG said that in a single week during June 2026, they observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, including cybercriminal and espionage groups. “These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks,” Google’s GTIG wrote. “Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats.” Google said it disabled Google accounts and services used by NetNut for malware command and control, and that it shared technical intelligence on NetNut’s software development kits (SDKs) and backend infrastructure with platform providers, law enforcement and research firms. The company also disabled apps known to bundle NetNut’s various SDKs. Omer Weiss, legal counsel for NetNut parent Alarum Technologies, said the company was aware of the FBI seizure and cooperating with investigators. “Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account,” Weiss said in a written statement. Benjamin Brundage is founder of the proxy tracking service Synthient, one of the companies that published evidence last month linking the Popa botnet to NetNut and Alarum Technologies. Brundage said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it. Brundage said NetNut’s apparent demise is likely to be a great disadvantage for the cybercrime community, which was already reeling from legal actions by Google earlier this year that seized infrastructure for NetNut’s biggest competitor — IPIDEA. “I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown,” he said. “Also NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it.” The NetNut and Popa botnet takedown may have another added benefit, Brundage said: Lessening the impact of large distributed denial-of-service botnets that have been built on the backs of poorly configured residential proxy services. In January, Synthient revealed how cybercriminals had built the world’s largest DDoS botnet (Kimwolf) by tunneling through IPIDEA proxy connections into the local networks of TV box owners, and infecting other Android-based devices behind the victim’s firewall. While many of the bigger proxy providers took steps to block this activity, resellers of the major proxy networks have been far slower to respond to the threat, Brundage said. “In terms of all these TV box devices getting compromised from the proxy network, it will have an impact on the DDoS botnets out there,” he said. For its part, Google reckons today’s actions have caused “significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” But the company warns that proxy networks can rebuild themselves by effectively reselling other proxy services, as IPIDEA has done over the past few months. “Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,” the GTIG report concludes. “While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers.” As KrebsOnSecurity has warned repeatedly, most of the no-name TV streaming boxes for sale on the major e-commerce websites either come pre-installed with residential proxy software, or require the installation of proxy SDKs in order to use the device for its stated purpose (streaming pirated movies, sporting events and TV shows). Google’s advice here is sound: When it comes to TV boxes, stick to name brands from reputable manufacturers, and then be sparing and judicious with any apps you choose to install. The sketchy TV boxes that are being commandeered by the Popa botnet and other threats all come with or require the user to install unofficial Android operating systems that do not operate within the confines of Google’s Official Play Protect store. Google says consumers can confirm whether or not a device is built with the official Android TV OS and Play Protect certification by following these instructions. Even people without TV streaming boxes can find their smart TVs enrolled in residential proxy networks, just by installing one of thousands of apps available for download on Samsung and LG smart TVs. In a report released last month, the proxy tracking company Spur found 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one’s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components, Spur found. Update, 4:24 p.m. ET: Included a statement shared post-publication from an attorney representing NetNut parent Alarum Technologies. Update, July 8, 2:34 p.m. ET: The website for Alarum Technologies — alarum[.]io — now also features a seizure notice from the FBI. The company’s stock has taken a beating since the FBI action, and is currently trading at $2.62 a share, a roughly 67 percent decline over the past week.

Law enforcement agencies and tech companies disrupted over 1.4 million accounts and underlying infrastructure used by scam networks across Southeast Asia. The joint effort, named Disruption Week, involved the US Department of Justice’s Scam Center Strike Force, the Royal Thai Police, global law enforcement, and companies such as Apple, Coinbase, Google, Meta, Microsoft, Silent Push, SpaceX, TRM Labs, and Zenlayer. As part of the operation, more than 1.4 million social media accounts, pages, and groups on Facebook and Instagram, as well as Microsoft accounts and Starlink kits, were disrupted, and 63 individuals involved in scam activities were arrested. The effort also resulted in the disruption of malicious IP address traffic and network connections used by the scammers, and in the decommissioning of associated servers and hosting infrastructure. Disruption Week targeted numerous fraud schemes operated out of industrial-scale compounds in Cambodia, Laos, and Burma. The scammers lured workers to Thailand under the promise of high-paying technical jobs, then seized their IDs and trafficked them to the compounds, forcing them to engage in fraud operations against entities in the US and abroad. The takedown operation also resulted in criminal complaints being filed against individuals involved in cryptocurrency investment fraud in Burma, and in over $3.8 million in cryptocurrency assets linked to the criminal networks being frozen. “Disruption Week shows what is possible when governments and private industry focus their efforts in tandem: millions of scam accounts interrupted, and criminal networks pushed of the US internet platforms on which they rely. This week’s results show our commitment to disrupting these schemes and protecting the American public,” US Attorney Jeanine Ferris Pirro said. Related: Dutch Police Dismantle Massive 17-Million-Device Botnet Related: GlassWorm Botnet Disrupted Related: Resurrected ‘Crimenetwork’ Marketplace Taken Down, Administrator Arrested Related: Canadian Man Arrested for Operating Kimwolf Botnet

Dutch police say they have disrupted a massive botnet consisting of 17 million infected computers, smartphones, and tablets. According to the authorities, the botnet was discovered after a security researcher reported it to the Netherlands’ National Cyber Security Centre (NCSC-NL). During their investigation into the botnet, the authorities identified 200 servers used to control infected devices and launch cyberattacks. As part of the takedown efforts, several servers associated with the botnet were seized from a hosting provider in the Netherlands, and the provider took down the entire network for being used for illicit activities, the police say. “Criminals can remotely control the devices, often without the owner noticing. Botnets are used for cyberattacks, sending spam and phishing emails, online fraud, and disrupting websites by sending large amounts of internet traffic simultaneously,” the Dutch police said. The Dutch authorities did not name the hosting provider, nor the botnet, but local media reports that the takedown operation targeted Asocks, a company that provides residential proxy services. The botnet consisted of consumer devices reportedly infected with malware, allowing cybercriminals to control them remotely and use them to route malicious traffic as part of large-scale cyberattacks. Users are advised to keep their devices updated, keep track of edge devices connected to their networks, use unique, strong passwords and multi-factor authentication (MFA), install apps only from trusted sources, secure their Wi-Fi networks, and use anti-malware solutions on their devices. The disruption follows the takedown of Aisuru, Kimwolf, and other botnets used to launch distributed denial-of-service (DDoS) attacks. Kimwolf, believed to have infected over 2 million devices, was also propagating through residential proxy networks. Related: GlassWorm Botnet Disrupted Related: Canadian Man Arrested for Operating Kimwolf Botnet Related: Mirai Botnet Targets Flaw in Discontinued D-Link Routers

Authorities in the Netherlands have arrested the owners of two Dutch companies that allegedly provided bulletproof hosting services to Russian threat actors and evaded sanctions imposed by the European Union. According to an announcement by the Dutch Fiscal Information and Investigation Service (FIOD), the suspects, a 57-year-old from Amsterdam and a 39-year-old from The Hague, were arrested on May 18. The investigators conducted searches at three locations in Enschede and Almere, and at two data centers in Dronten and Schiphol-Rijk, and seized laptops, phones, and over 800 servers. FIOD says the 57-year-old man is the owner and director of a Dutch company that acted as a front for a sanctioned web hosting provider. The sanctioned entity had been created two weeks before the Russian invasion of Ukraine and facilitated disinformation, interference, and disruptive cyberattacks against members of the EU. After the company was sanctioned in May 2025, most of its technical infrastructure was transferred to the arrested suspect’s Dutch company. The 39-year-old man, FIOD says, is the director and owner of a firm that ensured the servers of the front company would remain functional and online. FIOD’s scant announcement does not name the two or their companies, but an eight-month investigation by de Volkskrant revealed that two suspects, Youssef Z. and Andrey N., provided services to Stark Industries, a web hosting provider founded by Moldovan nationals Iurie and Ivan Neculiti. “They have been acting as enablers of various Russian state-sponsored and affiliated actors to conduct destabilizing activities including information manipulation, interference, and cyber-attacks against the Union and third countries,” the EU said last year, when Stark Industries was placed on the sanctioned entities list. Per de Volkskrant’s investigation, Andrey N. owns Mirhosting, which had physical servers deployed at various data centers. Those servers were rented to Stark Industries, which helped Russian hackers such as NoName057(16) launch distributed denial-of-service (DDoS) and other types of attacks against EU targets. The EU’s May 2025 sanctions prohibited European citizens and entities from aiding Stark, and the two Moldovan brothers restructured their company and moved part of the activities to Youssef Z.’s firm. Called WorkTitans and based in Enschede, the company rents server space and resells it, essentially obscuring the real customer and making abuse detection difficult. Related: Canadian Man Arrested for Operating Kimwolf Botnet Related: ‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested Related: 201 Arrested in Crackdown on Cybercrime in Middle East, North Africa Related: Resurrected ‘Crimenetwork’ Marketplace Taken Down, Administrator Arrested

Canadian man arrested, charged for running KimWolf DDos botnet A Canadian man was arrested this week on charges of operating a large botnet taken down by law enforcement agencies earlier this year. Jacob Butler was arrested in Ottawa on Wednesday after the U.S. Justice Department filed an extradition warrant tied to his operation of the KimWolf botnet, one of the largest and most damaging distributed denial-of-service (DDoS) platforms in the world. DDoS platforms flood targeted websites and servers with junk traffic, making them unreachable. Butler, 23, was initially identified by cybersecurity journalist Brian Krebs in February and denied being behind the online persona known as “Dort” that ran KimWolf. In court documents unsealed on Thursday, the Justice Department said Butler ran KimWolf as a DDoS-for-hire service that infected over a million devices worldwide. The complaint was filed on April 10 and was sealed pending his arrest. Butler was charged with one count of aiding and abetting computer intrusion. He is facing up to 10 years in prison if convicted. KimWolf was taken down in March as part of a larger international law enforcement operation involving officials in the U.S., Canada, Germany as well as several cybersecurity companies. Law enforcement seized infrastructure used by KimWolf and several other botnets including Aisuru, JackSkid and Mossad. The KimWolf botnet was made up of devices that were typically behind firewalls, including digital photo frames and web cameras. The operators then sold access to the devices to cybercriminals, who used them for a variety of purposes including launching DDoS attacks on businesses. In at least one instance, a DDoS attack targeted IP addresses owned by the Department of Defense. “KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,” prosecutors said. “These attacks resulted in financial losses which, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have issued over 25,000 attack commands.” The DOJ previously said victims of the DDoS attacks lost hundreds of thousands of dollars through remediation expenses or ransom demands from hackers who would only stop overloading websites for a price. Court documents said Butler was linked to the administration of the KimWolf botnet through his IP address, account information, transactions, online messages and more. The Justice Department said it also unsealed seizure warrants targeting other services that supported another 45 DDoS-for-hire platforms, including at least one that worked with KimWolf. DDoS mitigation firms like Cloudflare warned for years about KimWolf, writing in recent months that the botnet had thousands of devices at its disposal and could launch DDoS attacks that could “cripple critical infrastructure, crash most legacy cloud-based DDoS protection solutions, and even disrupt the connectivity of entire nations.” In a blog post, Amazon vice president Tom Scholl said the company helped the FBI and Defense Department identify the botnet's command-and-control infrastructure and reverse engineered the malware to understand its operations. Scholl said Kimwolf was a novel botnet because it targeted residential proxy networks, infiltrating home networks through compromised devices — including streaming TV boxes and other IoT devices. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

The US Justice Department announced on Thursday that a Canadian man has been arrested for operating the recently disrupted Kimwolf DDoS botnet. The suspect, 23-year-old Jacob Butler of Ottawa, known online as ‘Dort’, is accused of administering the botnet and has been charged in the US on one count of aiding and abetting computer intrusion. Butler has been arrested in Canada and the US is seeking his extradition. If found guilty, he faces up to 10 years in prison. “Law enforcement allegedly connected Butler to the administration of the KimWolf botnet through IP address, online account information, transaction records, and online messaging application records obtained through the issuance of legal process,” the DoJ said. In March, the Justice Department announced the disruption of several IoT botnets used to carry out DDoS attacks. One of them was Kimwolf, described as the Android-focused successor of a botnet named Aisuru, which was also targeted by authorities. Kimwolf made headlines for abusing residential proxy networks to expand and for ensnaring approximately 2 million devices. Aisuru and Kimwolf were both linked to a record-breaking DDoS attack that peaked at 31.4 Tbps. When it announced the disruption of the botnets in March, the DoJ said law enforcement agencies in Canada and Germany also targeted botnet administrators and infrastructure, but did not say whether anyone had been arrested. Butler may have been one of the individuals targeted in Canada at the time. “In addition to Butler’s arrest, the Central District of California unsealed seizure warrants which targeted online services supporting 45 DDoS-for-hire platforms. These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler’s KimWolf botnet,” the DoJ said on Thursday. Related: ‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested Related: Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

Suspected KimWolf botnet admin arrested over DDoS-for-hire operation U.S. and Canadian authorities arrested and charged a Canadian man accused of operating the KimWolf DDoS botnet, a service linked to attacks that infected more than one million devices worldwide. Jacob Butler, 23, of Ottawa, Canada, also known online as “Dort,” was arrested in Canada under an extradition warrant after U.S. prosecutors charged him with offenses related to the alleged development and operation of the KimWolf botnet. According to court documents, KimWolf targeted internet-connected devices that were typically protected from direct exposure to the wider internet, including digital photo frames and web cameras. Once compromised, the devices became part of a botnet that operators rented out through a cybercrime-as-a-service model, giving customers access to infected systems used in DDoS attacks against targets worldwide, including Department of Defense Information Network (DoDIN) IP addresses. “KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume. These attacks resulted in financial losses which, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have issued over 25,000 attack commands,” the Justice Department said. Authorities linked Butler to the operation of the KimWolf botnet through IP address data, online account information, transaction records and records from messaging platforms obtained through legal process. Independent security journalist Brian Krebs was the first to publicly identify Jacob Butler as the alleged KimWolf botmaster. In a related action, the Central District of California unsealed seizure warrants targeting online services that supported 45 DDoS-for-hire platforms. “These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler’s KimWolf botnet,” prosecutors noted. Butler’s arrest follows an international law enforcement operation in March 2026 that disrupted infrastructure linked to the Aisuru, KimWolf, JackSkid and Mossad botnets. The four botnets targeted in the operation infected millions of devices worldwide, primarily IoT systems such as digital video recorders, web cameras and WiFi routers. Butler faces one count of aiding and abetting computer intrusion and could receive up to 10 years in prison if convicted.

Authorities in North America and Europe have participated in a law enforcement operation to disrupt First VPN, a popular cybercrime service used for ransomware and other attacks. According to the FBI, First VPN has been active since 2014, providing 32 exit nodes across 27 countries at the time of its disruption. The service, advertised on Russian-language dark web cybercrime forums, has been used by at least 25 ransomware groups for network reconnaissance and intrusions. IP addresses associated with First VPN have been involved in scanning, botnets, DoS attacks, and hacking. The FBI has published an alert with technical details, IoCs, MITRE ATT&CK mappings, and recommendations. According to Europol, law enforcement and partners dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal activity. The takedown targeted the 1vpns.com, 1vpns.net, 1vpns.org, and onion domains. The alleged administrator of the cybercrime service has been arrested in Ukraine. “Users of the criminal service have been notified of the shutdown and informed that they have been identified,” Europol said, noting that information on 506 users was shared internationally. Bitdefender, which was involved in the takedown, pointed out that the 506 users are a subset of First VPN’s customer base, and investigators will determine which of them can be linked to criminal operations. “Some will be traced to known ransomware groups. Others will reveal fraud operations, data theft campaigns, or cybercrime-as-a-service infrastructure we didn’t know existed,” Bitdefender said. “New anonymization services will appear. The economic demand hasn’t changed. But each takedown shortens the operational window of the next service and raises the barrier for actors who relied on turnkey solutions,” the cybersecurity firm added. “First VPN advertised itself as a service criminals could trust to keep them beyond law enforcement’s reach. The operation proved that claim wrong, and every actor evaluating the next anonymization service now knows the same risk exists.” Related: Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation

U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide. 23-year-old Jacob Butler (also known online as "Dort") was arrested by Canadian authorities in Ottawa on Wednesday pursuant to an extradition warrant. According to a criminal complaint unsealed on Thursday in the District of Alaska, Butler was taken into custody based on IP address and online account information, transaction records, and online messaging records that exposed his links to the KimWolf botnet. Butler now awaits extradition to the U.S. and is facing one count of aiding and abetting computer intrusions, which carries a maximum sentence of 10 years in prison. As detailed in court documents, KimWolf operated as a DDoS-for-hire service and was used by cybercriminals to launch attacks reaching nearly 30 terabits per second, the largest DDoS attack publicly disclosed at the time. Using a cybercrime-as-a-service model, Butler sold access to a massive network of compromised enslaved systems (ranging from digital photo frames and web cameras to Android-based TV boxes and streaming devices). The botnet was used in more than 25,000 attacks targeting computers and servers worldwide (including Department of Defense Information Network IP addresses) and caused financial losses exceeding $1 million for some victims. Researchers at cybersecurity firm Synthient, who have been tracking KimWolf's rapid expansion, noted in January that KimWolf grew to almost 2 million after compromising Android devices in attacks exploiting vulnerabilities in residential proxy networks, and that it generated approximately 12 million unique IP addresses each week. Separately, the Central District of California unsealed seizure warrants targeting 45 DDoS-for-hire platforms, which disrupted multiple DDoS platforms, including at least one that collaborated with the KimWolf botnet. "These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler's KimWolf botnet," the Justice Department said yesterday. "U.S. authorities also seized domain records associated with many of these services, redirecting them to an authorized 'splash page,' which displays a warning to potential visitors that DDoS services are illegal." Butler's arrest follows a March 2026 international operation in which U.S., German, and Canadian authorities seized command-and-control infrastructure used by KimWolf and three related botnets (Aisuru, JackSkid, and Mossad), which collectively infected over 3 million IoT devices. As the U.S. Justice Department said at the time, the four botnets collectively infected more than 3 million IoT devices, including web cameras, digital video recorders, and Wi-Fi routers, many of them in the United States. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The U.S. Department of Justice (DoJ) on Thursday announced the arrest of a Canadian man in connection with allegedly operating a distributed denial-of-service (DDoS) botnet known as Kimwolf. In tandem, Jacob Butler (aka Dort), 23, Ottawa, Canada, has been charged with offenses related to the development and operation of the botnet. Kimwolf is assessed to be a variant of AISURU that specifically infected Android devices with an exposed Android Debug Bridge (ADB) service. "Kimwolf targeted infected devices which were traditionally 'firewalled' from the rest of the internet, such as digital photo frames and web cameras," the DoJ said. "The infected devices were enslaved by the botnet operators." "The operators then used a 'cybercrime-as-a-service' model to sell access to the infected devices to other cybercriminals. The operators and their customers forced the victim devices to participate in DDoS attacks, targeting computers and servers located throughout the world, including Department of Defense Information Network (DoDIN) IP addresses." Court documents show that Butler was linked to the administration of the Kimwolf botnet through IP address, online account information, and Discord message records posted by an account called resi[.]to. That Butler was behind the Kimwolf botnet was first exposed by independent security journalist Brian Krebs earlier this February. At that time, the defendant claimed that he had not used the "Dort" persona since 2021 and that some other party was impersonating him after compromising his old account. The charges come exactly two months after U.S. authorities, in partnership with Canada and Germany, disrupted the command-and-control (C2) infrastructure associated with Kimwolf, AISURU, JackSkid, and Mossad as part of a court-authorized law enforcement operation. Per the DoJ, Kimwolf is estimated to have issued over 25,000 attack commands. Prior to their takedown, the AISURU/Kimwolf botnets were attributed to some of the record-setting DDoS attacks to date, flooding targets with junk traffic that peaked at 31.4 Terabits per second (Tbps). Besides Butler's arrest, seizure warrants have been unsealed targeting online services supporting 45 DDoS-for-hire platforms, allowing law enforcement to dismantle them. One of the platforms is said to have collaborated with Kimwolf. Butler has been charged with one count of aiding and abetting computer intrusion. If convicted, he faces up to 10 years in prison.

Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States. A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a. “Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet. A statement from the Department of Justice says the complaint against Butler was unsealed following the defendant’s arrest in Canada by the Ontario Provincial Police pursuant to a U.S. extradition warrant. Butler is currently in Canadian custody awaiting an initial court hearing scheduled for early next week. The government said Kimwolf targeted infected devices which were traditionally “firewalled” from the rest of the internet, such as digital photo frames and web cameras. The infected systems were then rented to other cybercriminals, or forced to participate in record-smashing DDoS attacks, as well as assaults that affected Internet address ranges for the Department of Defense. Consequently, the DoD’s Defense Criminal Investigative Service is investigating the case, with assistance from the FBI field office in Anchorage. “KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,” the Justice Department statement reads. “These attacks resulted in financial losses which, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have issued over 25,000 attack commands.” On March 19, U.S. authorities joined international law enforcement partners in seizing the technical infrastructure for Kimwolf and three other large DDoS botnets — named Aisuru, JackSkid and Mossad — that were all competing for the same pool of vulnerable devices. On February 28, KrebsOnSecurity identified Butler as the Kimwolf botmaster after digging through his various email addresses, registrations on the cybercrime forums, and posts to public Telegram and Discord servers. However, Dort continued to threaten and harass researchers who helped track down his real-life identity and dramatically slow the spread of his botnet. Dort claimed responsibility for at least two swatting attacks targeting the founder of Synthient, a security startup that helped to secure a widespread critical security weakness that Kimwolf was using to spread faster and more effectively than any other IoT botnet out there. Synthient was among many technology companies thanked by the Justice Department today, and Synthient’s founder Ben Brundage told KrebsOnSecurity he’s relieved Butler is in custody. “Hopefully this will end the harassment,” Brundage said. The government says investigators connected Butler to the administration of the KimWolf botnet through IP address, online account information, transaction records, and online messaging application records obtained through the issuance of legal process. The criminal complaint against Butler (PDF) shows he did little to separate his real-life and cybercriminal identities (something we demonstrated in our February unmasking of Dort). In April, the Justice Department joined authorities across Europe in seizing domain names tied to nearly four-dozen DDoS-for-hire services, although because of a bureaucratic mix-up the list of seized domains has remain sealed until today. The DOJ said at least one of those services collaborated with Butler’s Kimwolf botnet. A statement from the Ontario Provincial Police said a search warrant was executed on March 19 at Butler’s address in Ottawa, where they seized multiple devices. As a result of that investigation, Butler was arrested and charged this week with unauthorized user of computer; possession of device to obtain unauthorized use of computer system or to commit mischief; and mischief in relation to computer data. He is scheduled to remain in custody until a hearing on May 26. In the United States, Butler is facing one count of aiding and abetting computer intrusion. If extradited, tried and convicted in a U.S. court, Butler could face up to 10 years in prison, although that maximum sentence would likely be heavily tempered by considerations in the U.S. Sentencing Guidelines, which make allowances for mitigating factors such as youth, lack of criminal history and level of cooperation with investigators.

Netflix, Apple TV+, Disney+, Hulu, Amazon Prime, YouTube Premium… The average law-abiding family today pays for five to 10 subscriptions just to watch their shows of choice, with the monthly bill easily crossing the hundred-dollar mark. It’s no surprise, then, that social media and online marketplaces are seeing a surge in demand for the “magic boxes” that popped up at the end of 2025: Android-powered TV boxes that promise to unlock thousands of channels and every streaming service subscription-free for a one-time purchase. Ads for these devices are flooding TikTok and Instagram: smiling influencers unbox the SuperBoxes, plug them into a TV, and browse endlessly through channels. It looks like the ultimate life hack against subscription fatigue, right? In reality, it’s one of the easiest ways to invite a botnet into your home network. What’s wrong with these cheap TV boxes? Stories about malicious TV boxes have surfaced before, but right now, their marketing has reached a truly alarming scale. At the end of 2025, analysts examined several models of the popular SuperBox device available from major retail stores and online marketplaces. The findings were deeply concerning: immediately upon powering up, the devices began pinging the servers of the Chinese messaging app Tencent QQ, as well as the Grass proxy service — effectively renting out the owner’s internet bandwidth to third parties. Inside the firmware, researchers discovered applications completely uncharacteristic of a media player: a network scanner, a traffic analyzer, and tools for DNS hijacking. Consequently, the device not only streams pirated content but also scans the local network for other targets (including industrial SCADA interfaces), and stands ready to participate in DDoS attacks. The SuperBoxes were also found to contain folders with the telltale name “secondstage”, a textbook indication of multi-stage malware. More recently, in April 2026, the Darknet Diaries podcast featured an interview with a security researcher known by the alias D3ada55, who shared plenty of intriguing details about these boxes — including the fact that they were still openly sold on major platforms like Amazon, Walmart, and Best Buy. The infection chronicles: BADBOX to Keenadu The SuperBox case is far from the only instance where Android devices have been turned into botnet nodes — or sold infected right out of the box. Here’s a look at the most recent cases: BADBOX 2.0. In July 2025, Google filed a lawsuit against the operators of a botnet that compromised over 10 million Android devices — mostly cheap TV boxes, tablets, and projectors lacking Google Play Protect certification. As we reported earlier, BADBOX 2.0 specifically targets TV boxes, operating simultaneously as a proxy network and an ad fraud engine. Kimwolf. In December 2025, the QiAnXin XLab team uncovered a DDoS botnet that had hijacked around 1.8 million Android devices. The infected hardware included generic models from off-brand manufacturers sporting high-profile names like TV BOX, SuperBox, XBOX, SmartTV, and others. The infection footprint was massive, with compromised devices shipped worldwide. Among the hardest-hit countries were Brazil, India, the U.S., Argentina, South Africa, the Philippines, and Mexico. Keenadu. Our experts discovered this malware lurking in the firmware of brand-new devices back November 2025, though it didn’t gain widespread attention until after we published a study about it in February 2026. Keenadu masquerades as legitimate system components, embedding itself even into facial-recognition unlock apps, potentially granting attackers access to biometrics, banking data, and personal messages. All of these stories share the same origin: the Triada Trojan, first documented by our researchers back in 2016 and dubbed at the time “one of the most advanced mobile Trojans”. Over the past decade it has evolved from a standard piece of malware into a modular backdoor baked directly into firmware during manufacturing. How the infection scheme works Manufacturers of cheap TV boxes cut corners on absolutely everything: Google Play Protect certification, firmware audits, and security updates. Many of these devices run on the Android Open Source Project without any security guarantees whatsoever. Somewhere along the supply chain — whether at the factory, through a middleman, or at a distributor — a backdoor gets injected into the firmware image. Our experts suspect that the manufacturer itself might not even be aware of the compromise. The sheer scale of the infection turns millions of identical boxes into the perfect foundation for a botnet: every compromised device represents a unique IP address that can be rented out to anyone. Botnet operators like Kimwolf monetize this not only through distributed DDoS attacks but also by reselling the bandwidth of infected smart TVs and streaming boxes. What this means for you An infected TV box sits right in your living room, connected to your home Wi-Fi. That means it can see smartphones running banking apps, network-attached storage (NAS) units holding family archives, IP cameras, smart locks, work laptops, and any other the devices connected to your Wi-Fi network. With this kind of beachhead inside your home network, an attacker can intercept unencrypted traffic, spoof DNS requests, scan ports, and hunt for vulnerabilities on neighboring devices. On top of that, they can use your IP address for fraudulent activity. As a result, in the best-case scenario, your IP will end up blacklisted, and legitimate services will start blocking you for suspicious activity; in the worst-case scenario, law enforcement could come knocking on your door. How to spot a potentially dangerous gadget You should be on alert if a device: Is sold under a no-name brand like T95, X96Q, MX10, TV BOX, SuperBox, or some such Promises free lifetime access to paid premium services for a one-time fee Requires you to disable Google Play Protect, or install third-party APK files during the initial setup Lacks Play Protect certification entirely Is promoted through aggressive spam campaigns on social media How to avoid hosting a botnet node Buy certified TV boxes that feature Google Play Protect, or purchase devices directly from reputable telecom operators and internet service providers. Isolate all smart home devices. Set up a separate Wi-Fi network on your home router for TV boxes, cameras, smart speakers, robot vacuums, and similar gear, while keeping smartphones, NAS units, and computers on the main network. This prevents malware from spreading to your critical gadgets. Regularly update the firmware on all your devices, and don’t forget about your router — it’s another vulnerable link in the chain. Remove any applications from your Android TV box that you didn’t install yourself, especially alternative app stores, Wi-Fi “boosters”, and “system cleaners”. Monitor your traffic. Modern routers and Kaspersky Premium can display which devices are connecting to where. Frequent connections from a media player to servers in China are a major security red flag. Install Kaspersky Premiumon all your devices — it protects against Trojans, and blocks the phishing pages often used to distribute infected APK files. Don’t disable Google Play Protect, and avoid installing APKs from shady sources — this is the primary infection vector that bypasses the official app store. If in doubt, return the TV box. A cheap streaming device isn’t worth risking your biometrics, banking data, or the reputation of your IP address. Want to know how else to protect your smart home devices? Read more in our related posts:

IT threat evolution in Q1 2026. Mobile statistics IT threat evolution in Q1 2026. Non-mobile statistics In the third quarter of 2025, we updated the methodology for calculating statistical indicators based on the Kaspersky Security Network. These changes affected all sections of the report except for the statistics on installation packages, which remained unchanged. To illustrate the differences between the reporting periods, we have also recalculated data for the previous quarters. Consequently, these figures may significantly differ from the previously published ones. However, subsequent reports will employ this new methodology, enabling precise comparisons with the data presented in this post. The Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat information, voluntarily shared by users of Kaspersky solutions. The statistics in this report are based on KSN data unless explicitly stated otherwise. The quarter in numbers According to Kaspersky Security Network, in Q1 2026: More than 2.67 million attacks utilizing malware, adware, or unwanted mobile software were prevented. The Trojan-Banker category was the prevalent mobile malware threat with a 52.96% share of total detected applications. More than 306,000 malicious installation packages were discovered, including: - 162,275 packages related to mobile banking Trojans; - 439 packages related to mobile ransomware Trojans. Quarterly highlights The number of malware, adware, or unwanted software attacks on mobile devices decreased to 2,676,328 in Q1, down from 3,239,244 in the previous quarter. Attacks on users of Kaspersky mobile solutions, Q3 2024 — Q1 2026 (download) The overall drop in attack volume stems primarily from a reduction in adware and RiskTool detections. Nonetheless, this trend does not equate to a lower risk for mobile users. As shown later in this report, the number of unique users targeted by these threats remained relatively stable. In Q1, Synthient researchers identified a link between the notorious Kimwolf botnet and the IPIDEA proxy network. This network was later taken down in cooperation with GTIG. In early 2026, we discovered several apps on Google Play and the App Store that contained a new version of the SparkCat crypto stealer. The Trojan code, meticulously concealed, was embedded into the infected Android apps. The obfuscated malicious Rust library was decrypted using a Dalvik-like virtual machine custom-built by the attackers. The iOS version of the malware also underwent several changes; specifically, the attackers began leveraging Apple’s proprietary Vision framework for optical character recognition (OCR). Mobile threat statistics The number of Android malware samples saw a slight increase compared to Q4 2025, reaching a total of 306,070. Detected malicious and potentially unwanted installation packages, Q1 2025 — Q1 2026 (download) The detected installation packages were distributed by type as follows: Detected mobile apps by type, Q4 2025* — Q1 2026 (download) Data for the previous quarter may differ slightly from previously published figures due to certain verdicts being retrospectively revised. Threat actors once again ramped up the production of new banking Trojans; as a result, this category overtook all others in volume, accounting for more than half of all installation packages. Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q4 2025 — Q1 2026 (download) The total percentage may exceed 100% if the same users encountered multiple attack types. Following the surge in banking Trojan installation packages, the number of associated attacks also rose, causing Trojan-Banker apps to climb one spot in terms of their share of targeted users. Mamont variants emerged as the most prevalent banking Trojans, accounting for 73.5% of detections, with the rest of the users encountering Faketoken, Rewardsteal, Creduz, and other families. Yet banking Trojans were still outpaced by adware and RiskTool-type unwanted apps when measured by the total number of affected users. Despite a decrease in their share of installation packages, these two app types retained their positions as the top two threats by attack volume. The most common adware detections involved HiddenAd (44.9%) and MobiDash (38.1%), while most frequently seen RiskTool apps were Revpn (67%) and SpyLoan (20.5%). TOP 20 most frequently detected types of mobile malware Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware. Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions. The pre-installed Triada.ag backdoor rose to the top spot; it is similar to the older Triada.z version we documented previously. Because the same variant was pre-installed across a wide range of devices, the total number of affected users is aggregated. Consequently, Triada outpaced even Mamont, as users encountered a variety of Mamont variants, causing the share of that banking Trojan to spread across multiple rows. Other pre-installed Triada variants (Triada.z, Triada.ae, Triada.ab, and Triada.ad) also made the rankings. Furthermore, we observed increasing activity from the Keenadu.a backdoor, while diverse variants of the embedded Triada Trojan remained in the rankings. Mobile banking Trojans Q1 2026 saw a characteristic rise in mobile banking Trojan activity, with the number of packages totaling 162,275, a 50% increase compared to the prior quarter. Number of installation packages for mobile banking Trojans detected by Kaspersky, Q1 2025 — Q1 2026 (download) We saw a similar growth in the previous quarter, with banking Trojan volumes rising by 50% during that period as well. Various Mamont variants accounted for the absolute majority of packages and represented nearly every entry in the rankings of most frequent banking Trojans by affected user count. TOP 10 mobile bankers Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.

A Mirai botnet is targeting discontinued D-Link routers impacted by a command injection vulnerability disclosed a year ago, Akamai reports. Tracked as CVE-2025-29635, the security defect exists because an attacker-controllable function value is copied without validation, and can be exploited through crafted POST requests. “The router extracts the value that ends up in the command buffer from the request body without checking which form field it came from,” Akamai notes. The observed exploitation attempts, it says, target the same code and trigger the same system call as a proof-of-concept (PoC) exploit published last year on GitHub, which has since been removed. As part of the observed execution path, a shell script is loaded to download and run a payload that has numerous Mirai characteristics, including XOR encoding, a hardcoded console execution string, and a hardcoded downloader IP. The exploited issue exists in D-Link DIR-823X series router firmware versions 240126 and 24082. The affected devices were discontinued last year and no longer receive software updates from the vendor. “D-Link strongly recommends that this product be retired and cautions that any further use of this product may be a risk to devices connected to it,” the company warned in September. The hackers have been observed targeting TP-Link and ZTE router vulnerabilities as well, Akamai says. The threat actor behind the recently observed attacks appears not to have used vibe coding to build their payload. “Mirai malware campaigns continue to plague the industry, with much of the original source code continuing to be reused by various threat actors, both skilled and unskilled. The low barrier of entry and potential financial benefits are some of the incentives that may entice individuals to enter the botnet space and become a cyberthreat actor,” Akamai notes. Related: Evasive Masjesu DDoS Botnet Targets IoT Devices Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: 174 Vulnerabilities Targeted by RondoDox Botnet Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience

Law enforcement agencies in 21 countries this week participated in a coordinated operation targeting distributed denial-of-service (DDoS) attack services and their users, Europol announced. DDoS-for-hire, or booter services, allow miscreants of all types, ranging from people with minimal technological background to proficient threat actors, to disrupt web and telecommunications services for financial gain, ideological purposes, or other motivations. Part of Operation PowerOff, the new law enforcement operation led to the takedown of 53 domains associated with DDoS-for-hire services and the arrest of four individuals. Additionally, 75 000 warning emails and letters were sent to the identified users of these services, and 25 search warrants were executed. The action, Europol explains, was the result of several operational sprints that gathered experts from national authorities to disrupt the illegal booter services and their infrastructure. “Booter services allow users to launch DDoS attacks against targeted websites, servers, or networks. Their infrastructure is made up of servers, databases, and other technical components that make DDoS-for-hire activities possible,” Europol notes. The sprints resulted in the seizure of infrastructure to prevent further damage. They also led to the exposure of over 3 million criminal user accounts. According to Europol, authorities in Australia, Austria, Belgium, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Sweden, Thailand, the UK, and the US participated in the operation. Following the takedown, Operation PowerOff will transition to a prevention phase, involving the removal of 100 URLs promoting booter services from search engines, the placement of ads targeting individuals searching for DDoS-for-hire services, and the placement of warnings on blockchains used by cybercriminals. Operation PowerOff has been ongoing for nearly a decade and has resulted in the disruption of dozens of DDoS-for-hire services, including prominent ones such as Webstresser, DigitalStress, Stresser.tech, and many others. Related: Evasive Masjesu DDoS Botnet Targets IoT Devices Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet

Trellix has dived into the inner workings of Masjesu, a botnet built for distributed denial-of-service (DDoS) attacks that has infected a variety of IoT devices. Masjesu has been active since at least 2023, with its operator mainly advertising it on Telegram as capable of launching DDoS attacks of hundreds of gigabytes in magnitude. The operator’s posts target both Chinese and English-speaking users, “suggesting that their services continue to target both Chinese and US customers,” Trellix says. Currently, the operator’s Telegram channel has over 400 subscribers, but the botnet’s userbase appears larger, as an initial channel promoting the botnet was closed by the platform for policy violations. Most of the devices ensnared by Masjesu are in Vietnam, an analysis of attack source countries shows. However, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine. “The data strongly suggests a distributed attack originating from multiple ASNs. This indicates the involvement of various networks, rather than the botnet being exclusively hosted on a single Virtual Private Server (VPS) provider,” Trellix notes. Recently analyzed Masjesu samples show it can target multiple architectures, including i386, MIPS, ARM, SPARC, PPC, 68K (Motorola 68000), and AMD64. The botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices. On the infected devices, the malware binds a socket with a hardcoded TCP port to provide operators with remote access and hardens itself for persistence. The malware stores sensitive strings – including command-and-control (C&C) domains, ports, folder names, and process names – encrypted in a lookup table and decrypts them at runtime. To achieve persistence, Masjesu starts by forking a new process and renaming its original executable path to mimic the path and function of a legitimate Linux dynamic linker. It then creates a cron job to run the renamed executable every 15 minutes, converts the process into a background daemon, and renames it to appear as a legitimate system component. The malware also terminates commonly used processes, such as wget and curl, and locks down shared temporary folders, likely to prevent infections from other botnets. To spread, it scans random IP addresses on the internet to find vulnerable devices it can infect. Masjesu uses multiple C&C domains and fallback IPs, configures a 60-second receive timeout on the socket connection to the C&C, and decrypts received data client-side. Based on the data received from the server, the botnet can launch various types of DDoS attacks, including UDP, TCP, VSE, GRE, RDP, OSPF, ICMP, IGMP, TCP_SYN, TCP-ACK, TCP-ACKPSH, and HTTP floods. Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: 174 Vulnerabilities Targeted by RondoDox Botnet Related: Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience

The US Justice Department and the FBI announced on Tuesday that they have disrupted a network of hacked SOHO routers that Russia used in an espionage operation. According to US authorities, the attacks have been tied to the threat actor known as APT28, Forest Blizzard, and Fancy Bear, which is widely believed to be backed by Russia’s General Staff Main Intelligence Directorate (GRU). The hackers targeted vulnerable TP-Link and MikroTik routers, changing their DHCP and DNS settings so that traffic from devices connected to these routers would go through the attackers’ infrastructure. By conducting this adversary-in-the-middle (AitM) attack, the cyberspies captured traffic the victim would assume was encrypted, harvesting passwords, authentication tokens, emails, and web browsing data. However, the AitM attack only worked if users ignored invalid TLS certificate warnings triggered by the use of the attacker-controlled infrastructure. According to the FBI, the hackers exploited a known vulnerability tracked as CVE-2023-50224 to take control of TP-Link routers. “The GRU has indiscriminately compromised a wide pool of U.S. and global victims and then filtered down impacted users, especially targeting information related to military, government, and critical infrastructure,” the agency said. Microsoft attributed the attack to Forest Blizzard and a subgroup it tracks as Storm-2754. The tech giant reported identifying more than 200 organizations and 5,000 consumer devices impacted by the attack. Microsoft has shared some technical details on how the attack was carried out: “Forest Blizzard gained access to SOHO devices then altered their default network configurations to use actor-controlled DNS resolvers. This malicious re-configuration resulted in thousands of devices sending their DNS requests to actor-controlled servers. […] Forest Blizzard is almost certainly using the dnsmasq utility to perform DNS resolution and provide responses while listening on port 53 for DNS queries. The dnsmasq utility is a legitimate tool that provides lightweight network services widely used in home routers or smaller networks. Among its services are DNS forwarding and caching and a DHCP server, which collectively enable upstream DNS query forwarding and IP address assignment on a local network. […] In most cases, the DNS requests appear to have been transparently proxied by the actor’s infrastructure, resulting in connections to the legitimate service endpoints without interruption. However, in a limited number of compromises, the threat actor spoofed DNS responses for specifically targeted domains to force impacted endpoints to connect to infrastructure controlled by the threat actor.” Microsoft noted that, in addition to harvesting information, such AitM attacks can be used for malware deployment or DoS attacks. Lumen Technologies, whose Black Lotus Labs has been tracking the campaign as FrostArmada, said the router attacks appear to have started in August 2025, shortly after the UK announced sanctions against Russian hackers and described a campaign named Authentic Antics, in which hackers targeted Microsoft cloud accounts. “At the peak of activity in December 2025, Lumen detected over 18,000 unique IPs from at least 120 countries communicating with Forest Blizzard’s infrastructure. These operations primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers,” Lumen said. The company assisted Microsoft and the US authorities in disrupting the infrastructure used in this campaign. The UK’s National Cyber Security Centre (NCSC) has published its own advisory, providing a long list of indicators of compromise (IoCs), including VPS banners, targeted router models, domains, IP addresses associated with attacker infrastructure, and MITRE ATT&CK mapping. The NCSC has also shared recommendations for defending against such attacks. In early 2024, the FBI announced it had disrupted a SOHO router botnet used by the same Russian threat group. Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement Related: Tycoon 2FA Fully Operational Despite Law Enforcement Takedown

Cybercriminals move deeper into networks, hiding in edge infrastructure Attack activity is moving toward infrastructure outside endpoint visibility. Proxy networks support a wide range of operations, edge devices serve as initial access points, and GenAI speeds up how attackers assemble and rebuild their tooling. Lumen’s 2026 Threatscape Report describes this pattern in criminal and nation-state activity. “Threat intelligence is needed to find the adversary as early as possible and as close to the point of origination as possible,” said Chris Kissel, IDC VP, Security & Trust. Early pressure built at the edge The movement had been building for several years. In 2022, over 80% of breaches against web applications and internet-exposed services involved brute force or stolen credentials. Microsoft then reported a global peak of 11,000 password-based attacks per second in April 2023. By 2025, endpoint tools were widely deployed, with 91% of organizations running EDR and those tools covering 72% of in-scope devices on average. That left routers, VPN gateways, firewalls, and other exposed systems as attractive entry points. “By lurking in devices outside of the reach of standard security controls and reaching back out days, weeks, or even months after the initial access, attackers can better evade detection and prevent defenders from connecting the dots,” researchers said. Some of the strongest signs appeared in infrastructure that rarely gets the same scrutiny as laptops or servers. J-magic began in mid-2023 and stayed active into at least mid-2024. Telemetry from March through September 2024 identified 36 unique IP addresses that matched its signature conditions, a level below 0.01% of analyzed NetFlow. 50% of targeted devices appeared to function as VPN gateways. Secret Blizzard followed a different path. Beginning in December 2022 and running into November 2024, that campaign infiltrated 33 separate Storm-0156 C2 nodes. Investigators later documented 37 Secret Blizzard and Storm-0156 C2 nodes tied to the operation. Botnets grew into working infrastructure Proxy and botnet operations also moved into a larger role. Aisuru recorded 2,948,616 IPs, the highest total among threat families in 2025. Vo1d followed with 2,519,125, and AWM reached 2,356,202. By average daily bot count, Aisuru Proxies ranked first at 129,487, followed by Mysterium at 45,097 and Aisuru at 31,549. NSOCKS appeared in both rankings. Rhadamanthys, which emerged in late 2022, passed 12,000 victims globally by October 2025. It ran a daily average of 300 active servers and hit a peak of 535 servers that month. More than 60% of its C2 servers were hosted in the US, Germany, the UK and the Netherlands. More than 60% of its C2s showed zero detection on VirusTotal at the time of original reporting. Black Lotus Labs said the wider industry tracked about 20% of the roughly 200 daily Rhadamanthys C2 servers it followed. SystemBC surfaced in September 2025 with 80+ C2 servers and a daily average of 1,500 victims. Each victim showed an average of 20 unpatched CVEs and at least one critical CVE. One observed server had 160+ unpatched vulnerabilities. Investigators also saw a single proxy IP generate 16+ GB of proxy traffic in a 24-hour period. Nearly 100% of bots eventually landed on block list sites. DanaBot, first seen in 2018, stayed highly active until May 2025. “Following Operation Endgame II, DanaBot resurfaced in November 2025 with “Version 669”—leveraging complex multi-stage attacks to target financial institutions,cryptocurrency wallets, and individual victims,” researchers noted. During its 2025 run, it maintained nearly 150 active C2 servers per day and 1,000 daily victims in 40+ countries. Only 25% of its C2 infrastructure had a VirusTotal detection score greater than zero. Half of victims contacted a DanaBot C2 for a single day, and 75% of infections lasted less than three days. Late 2025 brought faster turnover The sharpest acceleration came near the end of the year. Aisuru’s bot count tripled in one week in September 2025. Investigators later found that its 1.8 million bots were generated through exploitation of proxy services. Kimwolf emerged from that shift in mid-October 2025 and launched attacks approaching 30 Tbps. “Following disruption pressure on Aisuru, Kimwolf’s operators quickly rebuilt their control plane. New C2 domains appeared, malware was retooled, and traffic patterns shifted rapidly. Within weeks, the botnet scaled to hundreds of thousands of bots, sustaining massive DDoS capacity while actively evading suppression,” they said. Raptor Train shows the longer arc behind that late-year surge. The botnet was more than four years in the making at takedown. It peaked in June 2023 with over 60,000 actively compromised devices, and more than 200,000 devices were pulled into the botnet over its run. Its C2 estate moved from approximately 1 to 5 nodes from 2020 to 2022, to 11 in mid-2023, 30 from February to March 2024, and over 60 from June to August 2024. Tier 1 bots lasted an average of 17 days. Tier 2 and Tier 3 nodes averaged 77 days. “Raptor Train demonstrates what modern campaigns look like when the infrastructure layer becomes the operation, and why defenders need network intelligence to proactively spot, and stop, attacks,” researchers concluded.

Armenian national Hambardzum Minasyan has been extradited to the United States over his alleged role in the administration of the RedLine infostealer malware. The US Justice Department announced Minasyan’s first appearance in a Texas court on Wednesday. According to authorities, the man was involved in maintaining the malware’s infrastructure, including command-and-control servers and administration panels used by affiliates. He also allegedly collected payments from affiliates and handled support requests. “The indictment alleges that Minasyan registered two virtual private servers to host portions of RedLine’s infrastructure as well as two internet domains in support of the RedLine scheme,” the DOJ said. “He also allegedly created repositories on an online file sharing site that were used to distribute RedLine to affiliates. In November 2021, he allegedly registered a cryptocurrency account that was used to receive payments from RedLine affiliates,” the DOJ added. Minasyan has been charged with conspiracy to commit access device fraud, conspiracy to commit money laundering, and conspiracy to violate the CFAA. He faces up to 10 years in prison for access device fraud and up to 20 years in prison for the remaining counts. RedLine is a widely used information stealer offered via a malware-as-a-service model, enabling cybercriminals to steal browser credentials, cryptocurrency wallet data, VPN credentials, and other information. The malware emerged in 2020 and was targeted in an international law enforcement operation in October 2024. However, the takedown effort had limited impact, and RedLine remains one of the most popular infostealers among cybercriminals, frequently cited by security firms as a leading threat in the category. In mid-2025, the US Department of State announced a $10 million reward for information on Maxim Alexandrovich Rudometov, who is believed to be the main developer and administrator of RedLine. Rudometov was born in Ukraine, but fled to Russia in early 2022. Related: US Prisons Russian Access Broker for Aiding Ransomware Attacks Related: Russian Cybercriminal Gets 2-Year Prison Sentence in US Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation

C’è qualcosa di profondamente inquietante nell’idea che il router Wi-Fi, anche quello usato per guardare serie TV in streaming o per far fare i compiti ai nostri figli, possa essere stato arruolato in un esercito digitale criminale a nostra insaputa. È esattamente quello che è accaduto con le botnet Aisuru, KimWolf, JackSkid e Mossad, che per fortuna sono state smantellate il 20 marzo 2026 in un’operazione internazionale coordinata che non ha precedenti per scala e complessità. Nelle quattro botnet insieme, infatti, si contavano tre milioni di dispositivi compromessi che hanno consentito tra l’altro anche di condurre attacchi DDoS che hanno raggiunto il picco di 31,4 terabit al secondo, una cifra che supera qualsiasi record precedente nel panorama delle minacce informatiche. I bersagli includevano sistemi del Dipartimento della Difesa degli Stati Uniti e infrastrutture critiche e aziende private in tutto il mondo. E, dietro a tutto questo, un modello di business sofisticato come quello del cybercrime-as-a-service in cui la capacità distruttiva veniva “noleggiata” al miglior offerente. Indice degli argomenti Secondo quanto comunicato dal Dipartimento di Giustizia degli Stati Uniti, l’operazione ha visto la partecipazione della Defense Criminal Investigative Service (DCIS) e dell’FBI sul fronte americano, del Bundeskriminalamt (BKA) e della ZAC NRW in Germania, e della Royal Canadian Mounted Police (RCMP) insieme a Ontario Provincial Police (OPP) e Sûreté du Québec (SQ) in Canada. Un’alleanza investigativa che ha portato al sequestro di domini internet e server virtuali utilizzati per il comando e controllo (C2) delle botnet, recidendo così il legame tra gli operatori criminali e i milioni di dispositivi infetti. Determinante il contributo del settore privato: dell’imponente operazione di polizia, infatti, hanno fatto parte anche una dozzina di aziende tecnologiche e organizzazioni di threat intelligence, tra cui Cloudflare, Akamai, Amazon Web Services e The Shadowserver Foundation, che hanno fornito supporto tecnico essenziale. Un elemento che merita attenzione inquanto è ormai evidente che, sempre più spesso, le grandi operazioni di contrasto al cybercrime non sarebbero possibili senza questa collaborazione pubblico-privato, a testimonianza del fatto che la sicurezza informatica è ormai una questione di ecosistema e non di singoli attori. Il meccanismo alla base di queste botnet era, nella sua essenza, alquanto semplice: trovare dispositivi IoT esposti su internet con vulnerabilità note o credenziali di default, infettarli con malware e aggregarli in una rete controllata centralmente dai server C2. Da quel momento in poi, ogni dispositivo compromesso diventava potenzialmente un’arma nelle mani degli attaccanti. Particolarmente preoccupante era la capacità dimostrata da KimWolf e JackSkid di compromettere dispositivi protetti da firewall tradizionali. Questo rappresenta un salto qualitativo significativo rispetto alle botnet di precedente generazione: non è più sufficiente posizionare un device dietro un NAT o un firewall perimetrale per ritenersi al sicuro. I criminali hanno affinato tecniche che sfruttano protocolli di rete legittimi, UPnP mal configurato o vulnerabilità nel firmware per raggiungere dispositivi teoricamente isolati. Una volta costruita la rete, gli operatori non la utilizzavano esclusivamente in proprio: la affittavano ad altri criminali attraverso un modello di cybercrime-as-a-service. I clienti pagavano per lanciare attacchi DDoS contro obiettivi specifici, spesso con finalità estorsive portate avanti con la rituale formula del “paga o la tua infrastruttura smette di funzionare”. Come riportato dagli investigatori, i danni per le vittime private hanno raggiunto decine di migliaia di dollari tra perdite dirette e costi di remediation d’emergenza. Al di là della straordinaria dimensione operativa, la vicenda delle quattro botnet smantellate dagli USA pone sul tavolo alcune questioni di carattere strutturale che, chiunque si occupi di sicurezza informatica, non può ignorare. Queste quattro botnet non sono un’anomalia, ma il sintomo di un ecosistema IoT strutturalmente fragile. Miliardi di dispositivi vengono immessi sul mercato con firmware minimale, password di default identiche per tutti gli esemplari del modello, nessun meccanismo di aggiornamento automatico e cicli di vita del prodotto che superano di gran lunga il supporto software del produttore. Quando un router da 30 euro resta in uso per 8 anni e smette di ricevere patch di sicurezza dopo 18 mesi dall’acquisto, il risultato quasi inevitabile è che diventa una risorsa per i criminali. Il volume di traffico raggiunto da queste botnet non è un numero da leggere distrattamente: per dare un’idea della scala, è sufficiente considerare che un attacco DDoS da 31,4 Tbps è sufficiente a saturare la connettività Internet di intere nazioni di medie dimensioni. Significa che anche organizzazioni con infrastrutture anti-DDoS robuste e progettate per assorbire picchi nell’ordine dei terabit, si troverebbero in seria difficoltà. Ciò significa che il settore della mitigazione DDoS dovrà necessariamente ripensare le proprie architetture di riferimento. Il fatto che tra i target figurino indirizzi IP gestiti dal Department of Defense Information Network (DoDIN) suggerisce che almeno parte di questi attacchi avesse una valenza strategica che va oltre la semplice estorsione economica. Non è possibile escludere che la capacità di queste botnet venisse utilizzata o venduta anche per finalità di disruption di infrastrutture militari e governative, con implicazioni che toccano la sicurezza nazionale. Questa operazione di law enforcement è una buona notizia, ma non risolve il problema alla radice. I dispositivi precedentemente infetti sono stati “liberati” dalla disconnessione dei server C2, ma restano vulnerabili e possono essere re-infettati in qualsiasi momento. Ecco le azioni concrete che consiglio, sia ai privati che alle organizzazioni. Cambiare subito le password di default. Router, webcam, NAS, smart TV, termostati intelligenti: qualsiasi dispositivo connesso alla rete deve avere una password univoca e robusta. Le credenziali di fabbrica sono pubblicamente note e sistematicamente sfruttate dai bot di scansione. Aggiornare il firmware. Verificare mensilmente se sono disponibili aggiornamenti per tutti i dispositivi IoT. Se un produttore non rilascia più patch, valutare la sostituzione del dispositivo o l’adozione di firmware alternativi open source (es. OpenWrt per i router). Segmentare la rete domestica. Se il router lo permette (come nella maggior parte dei modelli moderni), è utile creare una rete Wi-Fi dedicata per i dispositivi IoT, separata da quella usata per navigare con PC e smartphone. In questo modo, un dispositivo compromesso non avrà accesso diretto agli altri. Disabilitate UPnP e il port forwarding non necessario. L’Universal Plug and Play è una funzionalità conveniente ma pericolosa: permette ai dispositivi di aprire automaticamente porte sul router, facilitando l’accesso dall’esterno. Disabilitarlo se non strettamente necessario. Monitorate il traffico anomalo. Consumi di banda insolitamente elevati nelle ore notturne, rallentamenti inspiegabili della connessione: possono essere segnali di un dispositivo infetto che partecipa a un attacco. Alcuni router offrono strumenti di monitoraggio del traffico integrati. Inventario completo degli asset IoT. Non si può proteggere ciò che non si conosce. Il primo passo è un asset inventory aggiornato che includa tutti i dispositivi connessi alla rete aziendale, compresi quelli di terze parti (stampanti, sistemi di videosorveglianza, sensori industriali, dispositivi medicali). Strumenti come Nmap, Shodan Enterprise o soluzioni dedicate come Claroty e Armis possono automatizzare questa fase. Zero Trust Network Access per l’IoT. Abbandonare il modello “all’interno del perimetro ci si fida”. Ogni dispositivo IoT deve essere autenticato, autorizzato e monitorato come se fosse potenzialmente ostile. La microsegmentazione di rete con VLAN dedicate e regole di firewall granulari limita drasticamente il ragio d’azione in caso di compromissione. Threat intelligence e monitoraggio continuo. Iscriversi ai feed di threat intelligence rilevanti per il proprio settore produttivo e monitorate gli indirizzi IP pubblici delle infrastrutture aziendali su database come Shadowserver per verificare se risultano associati a botnet note. Implementare un SIEM con regole specifiche per rilevare comportamenti tipici dei bot (scansioni di porte, tentativi di connessione C2, picchi anomali di traffico UDP/ICMP). Piano di risposta agli incidenti aggiornato. Includere esplicitamente gli scenari DDoS e la compromissione IoT nel proprio Incident Response Plan. Definire in anticipo chi contattare (ISP, provider di mitigazione DDoS, CERT nazionale), quali sistemi isolare in via prioritaria e come comunicare con clienti e stakeholder durante un’interruzione prolungata. Valutazione dei fornitori IoT. Nei processi di procurement, introdurre criteri di cyber security by design: verificare che i produttori abbiano politiche di patch management chiare, tempi di supporto documentati e un processo di vulnerability disclosure. Preferire vendor che aderiscano a standard come ETSI EN 303 645 o le linee guida NIST per l’IoT. Dal punto di vista della gestione del rischio aziendale, questa vicenda ribadisce una verità scomoda e cioè che il rischio IoT non è un rischio tecnico di nicchia, è un rischio di business. Un’azienda che subisce un attacco DDoS da 30 Tbps, anche qualora dovesse disporre di un contratto con un provider di mitigazione, andrà di sicuro incontro a interruzione del servizio, danni reputazionali, possibili violazioni degli SLA con i clienti e, in alcuni settori regolamentati, obblighi di notifica alle autorità di vigilanza. Dunque, i danni indiretti spesso superano di gran lunga i costi diretti della remediation. È dunque opportuno valutare l’adozione di questi tre elementi a supporto delle organizzazioni: Assicurazione cyber: verificare che la propria polizza copra esplicitamente gli attacchi DDoS e le perdite da interruzione del servizio. Molte polizze “cyber” contengono esclusioni che emergono solo al momento del sinistro. Business Continuity Planning: testare il piano di continuità operativa almeno una volta l’anno con simulazioni realistiche che includano scenari di attacco DDoS prolungato. La gestione di crisi non si improvvisa sotto pressione. Supply chain security: se i fornitori o partner hanno dispositivi IoT compromessi nelle loro reti, il rischio può propagarsi verso di noi attraverso connessioni VPN, API o integrazioni di sistema. Estendete le vostre valutazioni di rischio all’ecosistema di terze parti. Lo smantellamento delle quattro botnet Aisuru, KimWolf, JackSkid e Mossad è un risultato straordinario, reso possibile dalla combinazione di capacità investigative internazionali e cooperazione pubblico-privato a un livello raramente raggiunto in precedenza. Ma sarebbe un errore interpretarlo come un punto di arrivo. I dispositivi vulnerabili che hanno alimentato queste botnet esistono ancora, a miliardi, connessi a Internet in tutto il mondo e, purtroppo, le tecniche di infezione sono documentate e replicabili con il modello di business criminale del DDoS-as-a-Service che si è dimostrato redditizio: dunque, possiamo ben prevedere che nuove botnet emergeranno o probabilmente già esistono, in fase di crescita silenziosa. La risposta strutturale richiede interventi su più livelli: regolamentazione più stringente sulla sicurezza dei prodotti IoT (l’EU Cyber Resilience Act va nella direzione giusta, ma i tempi di implementazione sono lunghi), responsabilizzazione dei produttori, educazione degli utenti finali e investimenti continuativi in capacity di threat intelligence e law enforcement specializzato. Nel frattempo, la prima linea di difesa siamo noi, aziende e privati che dobbiamo smettere di trattare i dispositivi connessi come gadget e iniziare a trattarli per quello che sono ossia endpoint di sicurezza che richiedono attenzione, aggiornamenti e configurazione consapevole. Il router del salotto (e, di conseguenza, anche quello aziendale) non è più solo un oggetto di consumo, ma un potenziale vettore di attacchi che possono colpire ospedali, infrastrutture critiche e sistemi di difesa. Vale la pena prendersene cura.

Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks. There are also new malware tricks showing attackers are becoming more patient and creative. It’s a mix of old problems that never go away and new methods that are harder to detect. There are quiet state-backed activities, exposed data from open directories, growing mobile threats, and a steady stream of zero-days and rushed patches. Grab a coffee, and at least skim the CVE list. Some of these are the kind you don’t want to discover after the damage is done. ⚡ Threat of the Week Trivy Vulnerability Scanner Breached in for Supply Chain Attack — Attackers have backdoored the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach has triggered a cascade of additional supply-chain compromises stemming from impacted projects and organizations not rotating their secrets, resulting in the distribution of a self-propagating worm referred to as CanisterWorm. Trivy, developed by Aqua Security, is one of the most widely used open-source vulnerability scanners, with over 32,000 GitHub stars and more than 100 million Docker Hub downloads. The Trivy compromise is the latest in a growing pattern of attacks targeting GitHub Actions and developers in general. GitHub changed the default behavior of pull_request_target workflows in December 2025 to reduce the risk of exploitation. BAS vs Automated Pentesting: What Each Actually Covers (and Doesn't) Most teams pick one without knowing what the other misses. This guide breaks down both by use case across blue, red, and purple teams so you can see where each fits and where the gaps are. Download Now ➝ 🔔 Top News DoJ Takes Down DDoS Botnets — A cluster of IoT botnets behind some of the largest DDoS attacks ever recorded -- AISURU, Kimwolf, JackSkid, and Mossad -- were wiped as part of a broad law enforcement operation. The botnets largely spread across routers, IP cameras, and digital video recorders that are often shipped with weak credentials and rarely patched. Authorities removed the command-and-control servers used to commandeer the infected nodes. Together, operators of the four botnets had amassed more than 3 million devices, which they then sold access to other criminal hackers, who then used them to target victims with DDoS attacks to knock websites and internet services offline or mask other illicit activity. Some of these DDoS attacks were aimed at U.S. Department of Defense systems and other high-value targets. No arrests were announced, but two suspects associated with AISURU/Kimwolf are said to be based in Canada and Germany. All four botnets disrupted by the operation are variants of Mirai, which had its source code leaked in 2016 and has served as the starting point for other botnets. The U.S. Justice Department said some victims of the DDoS attacks lost hundreds of thousands of dollars through remediation expenses or ransom demands from hackers who would only stop overloading websites for a price. Google Debuts New Advanced Flow for Sideloading on Android — Google's advanced flow for Android changes how apps from unverified developers are installed, adding friction to combat scams and malware. The feature is aimed at experienced users and allows sideloading through a one-time setup. The advanced flow adds a 24-hour delay and verification steps intended to disrupt coercive pressure and give users time to make decisions. It’s designed to address scenarios where attackers pressure individuals to install unsafe software and play on the urgency of the operation to push them to bypass security warnings and disable protections before they can pause or seek help. Critical Langflow Flaw Comes Under Attack — A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities. The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a case of missing authentication combined with code injection that could result in remote code execution. Cloud security firm Sysdig said that the attacks weaponize the vulnerability to steal sensitive data from compromised systems. "The real-world proof is definitive: threat actors exploited it in the wild within 20 hours of the advisory going public, with no public PoC code available," Aviral Srivastava, who discovered the vulnerability, told The Hacker News. "They built working exploits just from reading the advisory description. That's the hallmark of trivial exploitation when multiple independent attackers can weaponize a vulnerability from a description alone, within hours." Interlock Ransomware Exploited Cisco FMC Flaw as 0-Day — An Interlock ransomware campaign exploited a critical security flaw in Cisco Secure Firewall Management Center (FMC) Software as a zero-day well over a month before it was publicly disclosed. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device. "This wasn't just another vulnerability exploit; Interlock had a zero-day in their hands, giving them a week's head start to compromise organizations before defenders even knew to look," Amazon, which spotted the activity, said. Yet Another iOS Exploit Kit Comes to Light — A new watering hole attack against iPhone users has been found to deliver a previously undocumented iOS exploit kit codenamed DarkSword. While some of the attacks targeted users in Ukraine, the kit has also been put to use by two other clusters that singled out Saudi Arabian users in November 2025, as well as users in Turkey and Malaysia. It's worth noting that these exploits would not be effective on devices where Lockdown Mode is active or on the iPhone 17 with Memory Integrity Enforcement (MIE) enabled. The kit used a total of six exploits in iOS to deliver various malware families designed for surveillance and intelligence gathering. Apple has since addressed all of them. "Completely written in JavaScript, DarkSword comprises six vulnerabilities across two exploit chains that were patched in stages ending with iOS 26.3," iVerify said. "Starting in WebKit and moving down to the kernel, it achieves full iPhone compromise with elegant techniques never publicly seen before." The discovery of DarkSword makes it the second mass attack targeting iOS devices. What's more, the Russian threat actor that deployed DarkSword demonstrated poor operational security. They left the full JavaScript code unobfuscated, unprotected, and easily accessible. The findings also point to a secondary market where such exploits are being acquired by threat actors of varied motivations to actively infect unpatched iOS users on a large scale. Perseus Banking Malware Targets Android — A newly discovered Android malware is masking itself within television streaming apps in order to steal users' passwords and banking data and spy on their personal notes, researchers have found. The malware, dubbed Perseus by researchers at ThreatFabric, is being actively distributed in the wild and primarily targets users in Turkey and Italy. To infect devices, attackers disguise the malware inside apps that appear to offer IPTV services — platforms that stream television content over the internet. These apps are also widely used to stream pirated content and are often downloaded outside official marketplaces like Google Play, making users more accustomed to installing them manually and less likely to view the process as suspicious. Once installed, Perseus can monitor nearly everything a user does in real time. It uses overlay attacks — placing fake login screens over legitimate apps — and keylogging capabilities to capture credentials as they are entered. The malware's most unusual feature is its focus on personal note-taking applications. "Notes often contain sensitive information such as passwords, recovery phrases, financial details, or private thoughts, making them a valuable target for attackers," ThreatFabric said. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-21992 (Oracle), CVE-2026-33017 (Langflow), CVE-2026-32746 (GNU InetUtils telnetd), CVE-2026-32297, CVE-2026-32298 (Angeet ES3 KVM), CVE-2026-3888 (Ubuntu), CVE-2026-20643 (Apple WebKit), CVE-2026-4276 (LibreChat RAG API), CVE-2026-24291 aka RegPwn (Microsoft Windows), CVE-2026-21643 (Fortinet FortiClient), CVE-2026-3864 (Kubernetes), CVE-2026-32635 (Angular), CVE-2026-25769 (Wazuh), CVE-2026-3564 (ConnectWise ScreenConnect), CVE-2026-22557, CVE-2026-22558 (Ubiquiti), CVE-2025-14986 (Temporal), CVE-2026-31381, CVE-2026-31382 (Gainsight Assist), CVE-2026-26189 (Trivy), CVE-2026-4439, CVE-2026-4440, CVE-2026-4441 (Google Chrome), CVE-2026-33001, CVE-2026-33002 (Jenkins), CVE-2026-21570 (Atlassian Bamboo Center), and CVE-2026-21884 (Atlassian Crowd Data Center). 🎥 Cybersecurity Webinars Learn How to Automate Exposure Management with OpenCTI & OpenAEV → Discover how to automate continuous, threat-informed testing using open-source tools like OpenCTI and OpenAEV to validate your security controls against real attacker behavior without increasing your budget. See a live demo on how to verify your security works, identify real gaps, and integrate it into your SOC workflow at no extra cost. Identity Maturity Cracking in 2026: See the New Data + How to Catch Up Fast → Identity programs are under massive pressure in 2026 - disconnected apps, AI agents, and credential sprawl are creating real risks and audit challenges. Join this webinar for new Ponemon Institute 2026 research from over 600 leaders, showing the scale of the problem and practical steps to close gaps, reduce friction, and catch up quickly. 📰 Around the Cyber World WhatsApp Tests Usernames Instead of Phone Numbers — WhatsApp is planning to introduce usernames and unique IDs instead of phone numbers, allowing users to send messages and make voice or video calls without sharing numbers. The optional privacy feature is expected to roll out globally by June 2026, with users and businesses able to reserve unique handles. "We're excited to bring usernames to WhatsApp in the future to help people connect with new friends, groups, and businesses without having to share their phone numbers," the company said in a statement shared with The Economic Times. The feature has been under test since early January 2026. Signal introduced a similar feature in early 2024. FBI Details SE Asia Scam Centers — The U.S. Federal Bureau of Investigation (FBI) detailed its work with Thai authorities to shut down scam centers proliferating in Southeast Asia. The schemes, which primarily target retirees, small-business owners, and people seeking companionship, have been described as a blend of cyber fraud, money laundering, and human trafficking, causing billions of dollars in annual losses. These scam centers operate in a manner that's similar to how legitimate corporations do. "Recruiters advertise high-paying jobs abroad. Workers are flown to foreign countries only to discover that the positions do not exist," the FBI said. "Passports are confiscated. Armed guards patrol the grounds. Under threat of violence, workers are forced to pose as potential romantic partners or savvy investment advisers, cultivating trust with victims over weeks or months." Recent crackdowns in countries like Cambodia have freed thousands of workers from scam compounds, but the FBI warned that these breakthroughs can be temporary, as criminal networks always tend to relocate, rebrand, or shift tactics in response to law enforcement actions. APT28 Exposed Server Leaks SquirrelMail XSS Payload — A second exposed open directory discovered on a server ("203.161.50[.]145") associated with APT28 (aka Fancy Bear) has offered insights into the threat actor's espionage campaigns targeting government and military organizations across Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. According to Ctrl-Alt-Intel, the directory contained command-and-control (C2) source code, scripts to steal emails, credentials, address books, and 2FA tokens from Roundcube mailboxes, telemetry logs, and exfiltrated data. The stolen data consists of 2,870 emails from government and military mailboxes, 244 sets of stolen credentials, 143 Sieve forwarding rules (to silently forward every incoming email to an attacker-controlled mailbox), and 11,527 contact email addresses. One of the newly identified tools is an XSS payload targeting the SquirrelMail webmail software, highlighting the threat actor's continued focus on leveraging XSS flaws to steal data from email inboxes. It's worth noting that the server was attributed to APT28 by the Computer Emergency Response Team of Ukraine (CERT-UA) as far back as September 2024. "Fancy Bear developed a modular, multi-platform exploitation toolkit where a victim simply opening a malicious email – with no further clicks – could result in their credentials stolen, their 2FA bypassed, emails within their mailbox exfiltrated, and a silent forwarding rule established that persists indefinitely," Ctrl-Alt-Intel said. Analysis of a Beast Ransomware Server — An analysis of an open directory on a server ("5.78.84[.]144") associated with Beast, a ransomware-as-a-service (RaaS) that's suspected to be the successor to Monster ransomware, has uncovered the various tools used by the threat actors and the different stages of their attack lifecycle. These included Advanced IP Scanner and Advanced Port Scanner to map internal networks and find open remote desktop protocol (RDP) or server message block (SMB) ports. Also identified were programs to locate sensitive files for exfiltration and flag which servers hold the most data, as well as Mimikatz, LaZagne, and Automim (for credential harvesting), AnyDesk (for persistence), PsExec (for lateral movement), and MEGASync (for data exfiltration). Beast ransomware operations paused in November 2025 and resumed in January 2026. GrapheneOS Opposes the Unified Attestation Initiative — GrapheneOS has come out strongly against Unified Attestation, stating it "serves no truly useful purpose beyond giving itself an unfair advantage while pretending it has something to do with security." The Unified Attestation initiative is an open-source, decentralized alternative to the Google Play Integrity API to provide device and app integrity checks for custom ROMs without requiring Google Play Services. "We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security, and freedom on mobile to avoid it," GraphenseOS said. "Companies selling phones should not be deciding which operating systems people are allowed to use for apps." VoidStealer Uses Chrome Debugger to Steal Secrets — An information stealer known as VoidStealer has observed using a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the "v20_master_key" directly from browser memory and use it to decrypt sensitive data stored in the browser. VoidStealer is a malware-as-a-service (MaaS) infostealer that began being marketed on several dark web forums in mid-December 2025. The ABE bypass technique was introduced in version 2.0 of the stealer announced on March 13, 2026. "The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods," Gen Digital said. VoidStealer is assessed to have adopted the technique from the open-source ElevationKatz project. FBI Says it is Buying Americans' location Data — FBI director Kash Patel admitted that the agency is buying location data that can be used to track people's movements without a warrant. "We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us," Patel said at a hearing before the Senate Intelligence Committee. Iranian Botnet Exposed via Open Directory — An Open Directory on "185.221.239[.]162:8080" has been found to contain several payloads, including a Python-based botnet script, a compiled DDoS binary, multiple C-language denial-of-service files, and IP addresses associated with SSH credentials. "A Python script called ohhhh.py reads credentials in a host:port|username|password format and opens 500 concurrent SSH sessions, compiling and launching the bot client on each host automatically," Hunt.io said. "The exposed .bash_history captured three distinct phases of work: standing up the tunnel network, building and testing DDoS tooling against live targets, and iterative botnet development across multiple script versions." The activity has not been linked to any state-directed campaign. OpenClaw Developers Targeted in Phishing Attack — OpenClaw's combination of flexibility, local control, and a fast-growing ecosystem has made it popular among developers in a very short time. While that unprecedented adoption speed has exposed organizations to new security risks of its own (i.e., vulnerabilities and the presence of malicious skills on ClawHub and SkillsMP), threat actors are also capitalizing on the brand name and reputation to set up fake GitHub accounts for a phishing campaign that lures unsuspecting developers with promises of free $CLAW tokens and trick them into connect their cryptocurrency wallet. "The threat actor creates fake GitHub accounts, opens issue threads in attacker-controlled repositories, and tags dozens of GitHub developers," OX Security researchers Moshe Siman Tov Bustan and Nir Zadok said. "The posts claim that recipients have won $5,000 worth of CLAW tokens and can collect them by visiting a linked site and connecting their crypto wallet." The linked site ("token-claw[.]xyz") is a near-identical clone of openclaw.ai rigged with a wallet-draining "Connect your wallet" button designed to conduct cryptocurrency theft. New Campaign Targets Energy Operations Personnel in Pakistan — A targeted campaign against operations personnel at energy firms linked to projects in Pakistan has leveraged phishing emails mimicking invitations to the upcoming Pakistan Energy Exhibition & Conference (PEEC). The messages, sent from compromised accounts from a Pakistani university and a government organization, aim to deceive victims into opening PDF attachments with a fake Adobe Acrobat Reader update prompt. Clicking the update leads to the download of a ClickOnce application resource that drops the Havoc Demon C2 framework. "The redirect chain was also wrapped in geofencing and browser fingerprinting, limiting access to intended targets," Proofpoint said. "That likely reduced the exposure to automated analysis while keeping the delivery path tightly scoped." The activity has been codenamed UNK_VaporVibes. It's assessed to share overlaps with activity publicly associated with SloppyLemming. Over 373K Dark Web Sites Down — International law enforcement agencies announced the takedown of one of the largest known networks of fraudulent platforms on the dark web, uncovering hundreds of thousands of fake websites used to scam users seeking child sexual abuse content. A 10-day international operation led by German authorities and supported by Europol shut down more than 373,000 dark web domains run by a 35-year-old man based in China, who had been operating a sprawling network of fraudulent platforms since at least 2021. While the sites advertised child abuse material and cybercrime-as-a-service offerings, nothing was actually delivered after victims made a payment in Bitcoin. The fraudulent scheme netted the operator an estimated €345,000 from around 10,000 people. Authorities from 23 countries participated in the operation, and have since identified 440 customers whose purchases are now under active investigation. Malicious npm Packages Steal Secrets — Two malicious npm packages, sbx-mask and touch-adv, have been found to steal secrets from victims' computers. While one invokes the malicious code via the postinstall script, the other executes it when application code is invoked by the developer after importing it. "The evidence strongly suggests account takeover of a legitimate publisher, rather than intentional malicious activity," Sonatype said. "Hijacked publisher accounts are particularly concerning as, over time, maintainers build trust with the users of their components. Attackers aim to take advantage of that trust in order to steal valuable, or profitable, information." China to Have Its Own Post-Quantum Cryptography in 3 Years — China is reportedly planning to develop its own national post-quantum cryptography standards within the next three years, according to a report from Reuters. The U.S. finalized its first set of post-quantum cryptography standards in 2024 and is aiming to achieve full industry migration by 2035. What's Next for Tycoon2FA? — A recent law enforcement operation dismantled the infrastructure associated with the Tycoon2FA phishing-as-a-service (PhaaS) platform. However, a new analysis from Bridewell has revealed that some of the 2FA phishing CAPTCHA pages are still live. The lingering activity, the cybersecurity company noted, stems from the fact that these pages operate on a massive network of compromised third-party sites, legitimate SaaS platforms, and thousands of disposable domains. "Operators and affiliates are highly agile and will attempt to rebuild, migrate to new infrastructure, or pivot to competing PhaaS platforms," it added. "The live CAPTCHA pages we are seeing may belong to surviving criminal affiliates attempting to keep their individual campaigns breathing on secondary proxy networks." 🔧 Cybersecurity Tools MESH → It is an open-source tool from BARGHEST that enables remote mobile forensics and network monitoring over an encrypted, peer-to-peer mesh network resistant to censorship. It connects Android/iOS devices behind firewalls or CGNAT using a modified Tailscale-like protocol (no central servers needed), supports ADB wireless debugging, libimobiledevice, PCAP capture, and Suricata IDS—allowing secure, direct access for live logical acquisitions in restricted or hostile environments. enject → It is a lightweight Rust tool that protects .env secrets from AI assistants like Copilot or Claude. It replaces real values in your .env file with placeholders (e.g., en://api_key). Secrets stay encrypted in a per-project store (AES-256-GCM, master password protected). When you run enject run -- , it decrypts them only in memory at runtime, then wipes them—never leaving plaintext on disk. Open-source, macOS/Linux, perfect for safe local development. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion And that’s the week. The real pattern isn’t any one story; it’s the gap. The gap between a flaw and detection. Between a patch and a deployment. Between knowing and doing. Most of this week’s damage happened in that gap, and it’s not new. Before you move on: update your mobile devices, review anything touching your CI/CD pipeline, and don’t store crypto wallet recovery phrases in notes apps.

The phishing-as-a-service (PhaaS) platform Tycoon 2FA’s operation has continued despite an international effort to disrupt it, CrowdStrike reports. A subscription-based service active since 2023, Tycoon 2FA allows miscreants to mount phishing attacks, bypass multi-factor authentication (MFA), and compromise accounts without triggering alerts. Responsible for 62% of the phishing attempts blocked by Microsoft in 2025, Tycoon 2FA has been used to generate over 30 million malicious emails monthly, targeting half a million organizations. The platform has been linked to roughly 96,000 distinct phishing victims worldwide. In early March, Europol and Microsoft announced the seizure of 330 active Tycoon 2FA domains and legal action against multiple individuals linked to the PhaaS, as part of an international effort involving law enforcement agencies in six countries and a dozen private companies. According to CrowdStrike, the takedown effort left only a minor dent in Tycoon 2FA’s operations, which are now back to pre-disruption levels. On March 4 and 5, following the law enforcement operation, Tycoon 2FA activity volume dropped to roughly 25%, but returned to previous levels shortly after, with “daily levels of cloud compromise active remediations returning to early 2026 levels”, CrowdStrike says. “Additionally, Tycoon2FA’s TTPs have not changed following the takedown, indicating that the service’s operations may persist beyond this disruption,” the cybersecurity firm notes. These TTPs include phishing emails directing to malicious CAPTCHA pages, session cookie theft upon CAPTCHA validation, use of JavaScript files for email address extraction, credential proxying via malicious JavaScript files, and use of stolen credentials to access the victims’ cloud environments. In March, CrowdStrike says, Tycoon 2FA has been used for business email compromise (BEC) phishing, email thread hijacking, SharePoint and cloud compromise for phishing URL distribution, and in cloud account takeover attacks. CrowdStrike observed failed Tycoon 2FA attacks after the phishing pages were suspended, identified eight IP addresses likely acquired after the takedown operation, and identified phishing domains used since 2025 that were not targeted by the law enforcement operation. While Tycoon 2FA likely began recovering the same day Europol and Microsoft announced the takedown, domains associated with the Salty 2FA phishing kit appear to have been affected by the disruption. “The efforts by Europol and private industry partners to degrade the operations of Tycoon 2FA will likely have a positive impact on the eCrime landscape overall, even if temporary. The service’s disruption likely set back current customers of the service by impeding phishing operations and damaged the long-term reputation of the PhaaS provider in the crimeware landscape,” CrowdStrike notes. Related: US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown

Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What smart factories keep getting wrong about cybersecurity In this Help Net Security interview, Packsize CSO Troy Rydman breaks down the biggest vulnerabilities in smart factory environments today, from IoT devices and legacy systems to human error. He explains how unmanaged devices, from sensors to robotic components, often go unpatched and become entry points for attackers. Certificate lifespans are shrinking and most organizations aren’t ready The push for shorter TLS certificate lifespans has grown for years. Google first promoted 90-day certificates, and Apple later proposed 47-day ones, prompting the CA/Browser Forum to set a formal timeline. That plan cuts validity from one year to 200 days, then 100, and finally 47, forcing organizations to rethink certificate purchasing and management. Stop building security goals around controls In this Help Net Security interview, Devin Rudnicki, CISO at Fitch Group, argues that security strategy fails when it loses its connection to business outcomes. Rudnicki walks through how to align security goals with corporate priorities, why CISOs must present risk in terms leadership can act on, and how to balance innovation speed with measured risk. AI got it wrong with high confidence. Now what? In this Help Net Security interview, Christian Debes, Head of Data Analytics & AI at SPRYFOX, talks about the growing gap between what AI models do and what their operators can explain. He argues this gap is already a liability, particularly when decisions affect people or money and no one can say why a model produced a certain output. Field workers don’t need more access, they need better security In this Help Net Security interview, Chris Thompson, CISO at West Shore Home, discusses least privilege and credential hygiene for a field-based workforce. He covers access management, authentication practices, and data risk processes that support employees in the field. Thompson also outlines security awareness efforts and how field teams are integrated into an organization’s security posture. CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday. DarkSword: Researchers uncover another iOS exploit kit A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared. Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in a commercial surveillance operation, by state-linked threat actors engaged in cyber espionage, and cybercriminals. Unpatched ScreenConnect servers open to attack (CVE-2026-3564) ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted authentication. The ScreenConnect remote access platform is popular with managed service providers, IT departments, and technology solution providers. They can opt for the cloud-hosted version or can deploy it on their own servers or in their private cloud. Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed. What to do in the first 24 hours of a breach In this Help Net Security video, Arvind Parthasarathi, CEO of CYGNVS, walks through a 10-step process for handling a cybersecurity breach. The first five steps cover preparation, while the next five address what to do once a breach is underway. Cloud misconfiguration has evolved and your controls haven’t In this Help Net Security video, Kat Traxler, Principal Security Researcher – Public Cloud at Vectra AI, walks through two AWS misconfigurations that go beyond the basics of bucket visibility. The first is bucket name squatting, and the second is the cross-service confused deputy problem. Fake scandal clips on Facebook bait victims into investment scams Bitdefender researchers uncovered hundreds of scam campaigns promoted through Facebook ads that use fake news stories, celebrity impersonation, and redirect chains to funnel victims into investment fraud schemes. The activity ran through 310 malvertising campaigns distributed on Meta platforms from February 9 to March 5, 2026. The campaigns generated more than 26,000 ad sightings with localized content in more than 15 languages. 45,000 malicious IP addresses taken down, 94 suspects arrested An international law enforcement operation has taken down more than 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware activity. The action was carried out as part of Operation Synergia III, an investigation that ran from July 18, 2025 to January 31, 2026. Hackers tried to breach Poland’s nuclear research centre Poland’s National Centre for Nuclear Research (NCBJ) thwarted a cyberattack targeting its IT infrastructure. The attempted intrusion was detected and blocked before attackers could compromise systems or disrupt operations. Meta ditches end-to-end encrypted messaging on Instagram End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026. Meta justified the move by saying the feature was rarely used, with only a small fraction of Instagram users enabling encryption. The company advised users seeking end-to-end encryption to switch to WhatsApp, where it is enabled by default. Hidden instructions in README files can make AI agents leak data Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents. Millions of UK firms on alert after Companies House data exposure Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed the personal data of millions of firms. An investigation indicates the flaw was likely introduced during an October 2025 update. EU sanctions Chinese company behind 65,000-device hack The EU Council has sanctioned companies from China and Iran, along with two individuals, over cyberattacks targeting its member states and partners. With the latest listings, the EU cyber sanctions regime applies to 19 individuals and 7 entities. Global fraud losses climb to $442 billion Online fraud is reaching more victims and generating larger losses, driven by digital tools and organized networks operating across borders. In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud sits among the top five global crime threats, with a 54% rise in fraud related Notices and Diffusions from 2024 to 2025. Big tech companies step in to support the open source security ecosystem Backed by new funding commitments from major technology players, open source security efforts are moving beyond threat identification toward practical solutions for defenders. The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source security. Apple starts issuing lightweight security updates between software releases Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1. Apple describes Background Security Improvements as lightweight security releases for components such as Safari, the WebKit framework, and other system libraries, delivered through ongoing patches between software updates. Firefox is getting a free built-in VPN Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. Elite members of North Korean society fake their way into Western paychecks Increased federal activity, including indictments over the past year, has drawn attention to a pattern that has been unfolding inside corporate hiring pipelines. North Korean nationals are securing roles as remote IT contractors and full-time staff within organizations across North America and Western Europe, using standard hiring channels to get in. Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults Samba 4.24.0 arrived carrying a set of Kerberos security changes aimed at Active Directory deployments. The release fixes a vulnerability, extends audit coverage for sensitive AD attributes, and introduces configuration options to counter two related Kerberos impersonation techniques. 900,000 contact records exposed in Aura data breach Aura, the online safety service, confirmed that an unauthorized party accessed about 900,000 records, mostly names and email addresses from a marketing tool linked to a company it acquired in 2021. The incident occurred as a result of a targeted phone phishing attack that tricked one of the employees. Secure endpoint management systems immediately, CISA urges The US Cybersecurity and Infrastructure Security Agency (CISA) warns that the cyberattack on Stryker Corporation serves as a signal to U.S. organizations that foreign cyber activity tied to Middle East conflicts may be spilling into their operations. Attackers breached Stryker’s internal Microsoft environment and reportedly wiped 200,000 systems, servers, and mobile devices, while extracting 50 terabytes of data. 4chan shrugs off UK regulator, refuses to pay £520,000 in fines over online safety violations The U.K.’s media regulator Ofcom fined 4chan £450,000 under the Online Safety Act for failing to introduce age checks to stop children from accessing pornographic content on its platform. 4chan is an online forum notorious for its extreme right-wing content, gory videos, and non-consensual pornography. Authorities disrupt four IoT botnets behind record DDoS attacks The U.S. Justice Department and international partners have disrupted four IoT botnets linked to DDoS attacks that reached 30 terabits per second, among the largest ever recorded. The four botnets targeted in the operation—Aisuru, KimWolf, JackSkid and Mossad—infected millions of devices worldwide, primarily IoT systems such as digital video recorders, web cameras and WiFi routers. Terminated contract led to $2.5 million cyber extortion scheme A federal jury convicted Cameron Curry, 27, a Charlotte resident, of carrying out an extensive cyber extortion scheme targeting a Washington, D.C.-based international technology company. He faces up to two years in prison on each of the six charges. VulHunt: Open-source vulnerability detection framework Binarly has published VulHunt Community Edition, making the core scanning engine from Binarly’s commercial Transparency Platform available to independent researchers and practitioners. VulHunt Community Edition is a framework for detecting vulnerabilities in compiled software. It operates against multiple binary representations simultaneously, working across disassembly, an intermediate representation layer, and decompiled code. Targets include POSIX executables and UEFI firmware modules. Microsoft Edge 146 adds IP privacy and local network access controls Microsoft Edge version 146 (Stable) became available on March 13, 2026, bringing updates to tracking protection, IP privacy, and enterprise network security policies. Microsoft zeroes in on AI-driven data risks in Fabric New Microsoft Purview innovations for Microsoft Fabric help organizations secure data and accelerate AI adoption. The updates focus on identifying risks, preventing data oversharing, and strengthening governance and data quality across the data estate. Your APIs are under siege, and attackers are just getting warmed up Internet-facing systems are handling sustained levels of malicious traffic across APIs, web applications, and DDoS channels. Akamai’s State of the Internet security report places these patterns within the same operating environment, with activity increasing across each area through 2025. Betterleaks: Open-source secrets scanner Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and standard input for leaked credentials, API keys, tokens, and passwords. Java 26 ships with new cryptography API and HTTP/3 support Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement Proposals spanning language changes, garbage collection improvements, cryptographic tooling, and network protocol support. EDR killers are now standard equipment in ransomware attacks Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild. Google limits Android accessibility API to curb malware abuse Google is restricting how Android apps can use accessibility features after years of abuse by banking Trojans and mobile malware. The changes, introduced in Android 17.2, limit access to the accessibility API when Advanced Protection Mode (APM) is enabled. Apps that do not serve a core accessibility function can no longer use these services, closing off a common attack vector. Llamafile, Mozilla’s portable LLM runner, gets GPU support and a rebuilt core Running a large language model on a single machine without cloud access or a container runtime remains a priority for practitioners working in air-gapped or resource-constrained environments. Llamafile, Mozilla-AI’s project for packaging and running LLMs as self-contained executables, has received its most significant architectural overhaul to date with version 0.10.0. Fake AI songs streamed billions of times, netting fraudster $10 million Michael Smith, 54, of Cornelius, North Carolina, has pleaded guilty in federal court to running a scheme that exploited music streaming platforms and diverted royalty payments from artists. He admitted to one count of conspiracy to commit wire fraud, which carries a maximum sentence of five years in prison, and agreed to forfeit $8,091,843.64. Google slows Android sideloading to trip up scammers Google’s advanced flow for Android changes how apps from unverified developers are installed, adding steps to reduce scam-driven sideloading. The feature is aimed at experienced users and allows sideloading through a controlled, one-time setup. It addresses scam scenarios where attackers pressure individuals to install malicious software. Cybersecurity jobs available right now: March 17, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: March 20, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Intel 471, Kore.ai, NinjaOne, Pindrop, Secure Code Warrior, Token Security, and Xona Systems.

US seizes domains and infrastructure used in sprawling botnet campaigns Law enforcement agencies in the U.S., Germany and Canada coordinated on a disruption operation designed to seize infrastructure used by four large botnets. The Justice Department said on Thursday evening that the Aisuru, KimWolf, JackSkid and Mossad botnets were used to target victims with distributed denial-of-service (DDoS) attacks that overloaded websites and made them unreachable. The four botnets were composed of about three million compromised devices around the world, many of which are Internet of Things (IoT) devices like cameras, routers and video recorders. Court documents said there were hundreds of thousands of devices compromised in the U.S. The KimWolf and JackSkid botnets were known to also target devices that were behind firewalls. The operators behind the botnets sold access to the devices to cybercriminals, who used them to either launch DDoS attacks or mask other criminal activity. The DOJ said victims of the DDoS attacks lost hundreds of thousands of dollars through remediation expenses or ransom demands from hackers who would only stop overloading websites for a price. Multiple U.S.-registered internet domains, virtual servers and other infrastructure were seized through warrants executed by the Department of Defense Office of Inspector General. The Department of Defense Information Network (DoDIN) had IP addresses that were targeted by DDoS attacks launched through the botnets. The Aisuru botnet “issued more than 200,000 DDoS attack commands, the Kimwolf botnet issued more than 25,000 DDoS attack commands, the JackSkid botnet launched more than 90,000 DDoS attack commands and the Mossad botnet launched more than 1,000 DDoS attack commands,” according to prosecutors. Companies like Cloudflare have warned for years about Aisuru and Kimwolf, writing in recent months that the botnets had more than 1 million devices at their disposal and could launch DDoS attacks that can could “cripple critical infrastructure, crash most legacy cloud-based DDoS protection solutions, and even disrupt the connectivity of entire nations.” Earlier this year, cybersecurity journalist Brian Krebs identified at least one alleged operator behind the botnets living in Canada. The Justice Department did not say if any arrests were made in conjunction with the infrastructure takedown. In addition to Canadian and German law enforcement agencies, the DOJ said dozens of tech companies were involved in the operation. In a blog post, Amazon vice president Tom Scholl said the company helped the FBI and Defense Department identify the botnet's command-and-control infrastructure and reverse engineered the malware to understand its operations. Scholl said Kimwolf was a novel botnet because it targeted residential proxy networks, infiltrating home networks through compromised devices — including streaming TV boxes and other IoT devices. The botnet “gained access to local networks that are typically protected from external threats by home routers.” “This technique allowed the operators to compromise millions of devices globally, growing to over 2 million infected devices. The Jackskid botnet would later use this same technique to increase its scale as well,” he said. Law enforcement agencies continue to target botnets with infrastructure seizure operations and arrests due to how frequently they are used by cybercriminals and nation-states to amplify attacks, mask activity and more. Botnets like QakBot, 911 S5, IPStorm, KV, DanaBot, Anyproxy, 5socks and others have faced law enforcement scrutiny since 2021. Last week, the U.S. partnered with Europol to take down a cybercriminal platform that offered access to the AVRecon botnet, which was made up of thousands of residential routers. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

The United States government has for the first time officially linked the notorious Handala hacker group to the Iranian government. The announcement came amid the takedown of several websites used by Handala. Handala has been on the radar of cybersecurity firms for years, but it gained widespread attention in recent days after ramping up its activity following the start of the US-Israel-Iran conflict. Handala has allegedly launched many attacks against Israel, including wiping military weather servers, hijacking security camera feeds, exfiltrating and deleting corporate data, publicly exposing details of intelligence personnel, and compromising an oil and gas exploration firm. However, its best-known attack targeted the US-based medical technology giant Stryker, causing significant disruption after wiping thousands of its systems. Handala portrays itself as a pro-Palestinian hacktivist group motivated by anti-Israeli ideology. The cybersecurity community, however, widely regards it as a cover for Void Manticore, an Iranian state-sponsored threat actor believed to operate under the direction of Iran’s Ministry of Intelligence and Security (MOIS). The Justice Department has now confirmed the connection between Handala and Iran’s MOIS, after it took down four websites used by the hacker group for psychological operations. Specifically, authorities seized four domains: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to. The Justice Department said Iran’s MOIS used the seized websites “in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons”. An X account used by the hacker group was also suspended in recent days. The US Department of State is offering a reward of up to $10 million for information on foreign hackers who target critical infrastructure. Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

Authorities disrupt four IoT botnets behind record DDoS attacks The U.S. Justice Department and international partners have disrupted four IoT botnets linked to DDoS attacks that reached 30 terabits per second, among the largest ever recorded. The four botnets targeted in the operation—Aisuru, KimWolf, JackSkid and Mossad—infected millions of devices worldwide, primarily IoT systems such as digital video recorders, web cameras and WiFi routers. KimWolf and JackSkid targeted devices designed to be shielded from direct internet exposure, compromising and bringing them under the control of their operators. The infected systems were then folded into a cybercrime-as-a-service model, where access to the botnets was sold to other actors. Both the operators and their customers used these devices to carry out hundreds of thousands of DDoS attacks against computers and servers worldwide, in some cases demanding extortion payments from victims. “Some victims reported that the DDoS attacks resulted in tens of thousands of dollars in losses and remediation expenses,” authorities said. According to court documents, the Aisuru botnet issued more than 200,000 DDoS attack commands, followed by KimWolf with more than 25,000, JackSkid with over 90,000, and Mossad with more than 1,000. During the operation, the Defense Criminal Investigative Service (DCIS), part of the Department of Defense Office of Inspector General, executed seizure warrants targeting U.S.-registered internet domains, virtual servers and other infrastructure linked to criminal activity, including DDoS attacks against IP addresses on the Department of Defense Information Network (DoDIN). “Collaboration among law enforcement and industry partners has proven vital to this success,” noted Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, DCIS, Cyber Field Office. The total number of DDoS attacks more than doubled in 2025 to 47.1 million, while network-layer attacks more than tripled year over year. Cloudflare’s threat research unit, Cloudforce One, recorded 19 record-setting attacks during the year. The largest, a 31.4 Tbps UDP flood linked to the Aisuru botnet in November 2025, was nearly six times larger than the biggest attack recorded in 2024. Most attacks in 2025 lasted under 10 minutes, limiting the window for human-led mitigation. The Aisuru botnet and its successor, KimWolf, are estimated to control between one and four million infected devices.

Authorities from the United States, Germany, and Canada have taken down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices. The joint law enforcement action also targeted virtual servers, internet domains, and other infrastructure used by the four botnets to launch hundreds of thousands of massive Distributed Denial of Service (DDoS) attacks against victims worldwide in recent months, including IP addresses owned by the Department of Defense Information Network (DoDIN). For instance, in December, the Aisuru botnet set a new record with a DDoS attack that peaked at 31.4 Tbps and 200 million requests per second as part of a broader campaign targeting multiple companies, most of which were in the telecommunications sector. Aisuru was also behind a previous DDoS record of 29.7 Tbps, while an incident originating from 500,000 IP addresses(which Microsoft attributed to the same botnet) peaked at 15.72 Tbps in November. "This operation, in coordination with other international law enforcement actions, is intended to disrupt communications associated with the Aisuru, KimWolf, JackSkid, and Mossad botnets, preventing further infection to victim devices and limiting or eliminating the ability of the botnets to launch future attack," the Justice Department said. "Court documents allege that the Aisuru botnet issued more than 200,000 DDoS attack commands, the KimWolf botnet issued more than 25,000 DDoS attack commands, the JackSkid botnet launched more than 90,000 DDoS attack commands and the Mossad botnet launched more than 1,000 DDoS attack commands." According to the U.S. Justice Department, these botnets have collectively infected and ensnared over three million IoT devices, including web cameras, digital video recorders, and WiFi routers, many of them located in the United States. The botnet operators sold access to other cybercriminals under a cybercrime-as-a-service model, enabling them to launch DDoS attacks that resulted in tens of thousands of dollars in losses and remediation costs. "These attacks can cripple core internet infrastructure, cause significant service degradation for ISPs and their downstream customers, and even overwhelm high-capacity cloud-based mitigation services," said cybersecurity and cloud computing company Akamai, which was one of the private sector firms involved in the joint action. "Cybercriminals used these botnets to launch hundreds of thousands of attacks, in some cases demanding extortion payments from victims." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The US Justice Department on Thursday announced the results of an international operation to disrupt several IoT botnets used by threat actors to launch distributed denial-of-service (DDoS) attacks. The operation targeted the Aisuru, Kimwolf, JackSkid, and Mossad botnets and involved several major cybersecurity and tech companies, as well as law enforcement in Germany and Canada. Authorities said the botnets have compromised more than 3 million devices as of March 2026, including DVRs, cameras, Wi-Fi routers, and other IoT devices. Aisuru has made headlines over the past several months for its massive DDoS attacks, including several record-breaking attacks. It is tightly connected to Kimwolf, which is essentially Aisuru’s Android-focused successor. Kimwolf was in the spotlight for abusing residential proxy networks to expand and for ensnaring roughly 2 million devices. Aisuru and Kimwolf were both linked by Cloudflare in February to the largest DDoS attack recorded to date, which peaked at 31.4 Tbps. According to the DoJ, cybercriminals used the Aisuru botnet to issue over 200,000 DDoS attack commands, while Kimwolf issued 25,000 such commands. JackSkid and Mossad are lesser-known botnets, but the DoJ said they issued 90,000 and 1,000 DDoS attack commands, respectively. AWS, which was involved in the takedown, reported that just like Kimwolf, the JackSkid botnet used residential proxy networks to grow. The botnet disruption efforts included seizing multiple internet domains, virtual servers, and other infrastructure used by Aisuru, Kimwolf, JackSkid, and Mossad. The DoJ said law enforcement agencies in Canada and Germany “conducted their own operations targeting botnet administrators and botnet infrastructure”, but did not say whether anyone was arrested. Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

The U.S. Department of Justice (DoJ) on Thursday announced the disruption of command-and-control (C2) infrastructure used by several Internet of Things (IoT) botnets like AISURU, Kimwolf, JackSkid, and Mossad as part of a court-authorized law enforcement operation. The effort also saw authorities from Canada and Germany targeting the operators behind these botnets, with a number of private sector firms, including Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B, and QiAnXin XLab assisting in the investigation efforts. "The four botnets launched distributed denial-of-service (DDoS) attacks targeting victims around the world," the DoJ said. "Some of these attacks measured approximately 30 Terabits per second, which were record-breaking attacks." In a report last month, Cloudflare attributed AISURU/Kimwolf to a massive 31.4 Tbps DDoS attack that occurred in November 2025 and lasted only 35 seconds. Towards the end of last year, the botnet was also responsible for a series of hyper-volumetric DDoS attacks that had an average size of 3 billion packets per second (Bpps), 4 Tbps, and 54 million requests per second (Mrps). Independent security journalist Brian Krebs also traced the administrator of Kimwolf to a 23-year-old Jacob Butler (aka Dort) from Ottawa, Canada. Butler told Krebs he has not used the Dort persona since 2021 and claimed someone is impersonating him after compromising his old account. Butler also said, "he mostly stays home and helps his mom around the house because he struggles with autism and social interaction." According to Krebs, the other prime suspect is a 15-year-old residing in Germany. No arrests have been announced. First documented by XLab in December 2025, Kimwolf has conscripted more than 2 million Android devices into its network, most of which are compromised, off-brand Android smart TVs and set-top boxes. It's an Android-focused version of another botnet known as AISURU, which is known to be active since at least August 2024. In all, the four botnets are estimated to have infected no less than 3 million devices worldwide, such as digital video recorders, web cameras, or Wi-Fi routers, of which hundreds of thousands are located in the U.S. Cloudflare described the maximum attack traffic of the combined AISURU and Kimwolf botnets as equivalent to "the combined populations of the U.K., Germany, and Spain all simultaneously typing a website address and then hitting 'enter' at the same second." "The Kimwolf and JackSkid botnets are accused of targeting and infecting devices which are traditionally 'firewalled' from the rest of the internet. The infected devices were enslaved by the botnet operators," the DoJ said. "The operators then used a 'cybercrime as a service' model to sell access to the infected devices to other cyber criminals." These infected devices were then used to conduct DDoS attacks against targets of interest across the world. Court documents allege that the four Mirai botnet variants have issued hundreds of thousands of DDoS attack commands - AISURU - >200,000 DDoS attack commands Kimwolf - >25,000 DDoS attack commands JackSkid - >90,000 DDoS attack commands Mossad - >1,000 DDoS attack commands "Kimwolf represented a fundamental shift in how botnets operate and scale. Unlike traditional botnets that scan the open internet for vulnerable devices, Kimwolf exploited a novel attack vector: residential proxy networks," Tom Scholl, VP/Distinguished Engineer at AWS, said in a post shared on LinkedIn. "By infiltrating home networks through compromised devices — including streaming TV boxes and other IoT devices — the botnet gained access to local networks that are typically protected from external threats by home routers." Lumen Black Lotus Labs, in a statement shared with The Hacker News, said it has null-routed nearly 1,000 of the C2 servers used by AISURU and then Kimwolf. According to data gathered by the cybersecurity company, JackSkid averaged over 150,000 daily victims in the first two weeks of March 2026, hitting 250,000 on March 8. Mossad averaged over 100,000 daily victims during the same period. "The problem is, there are just so many devices out there that are vulnerable that two things happened – first, Kimwolf proved to be incredibly resilient," Ryan English, security researcher at Lumen's Black Lotus Labs, said. "The second problem was that multiple new botnets started to emulate the technique of using the vulnerability to grow very large, very fast." Black Lotus Labs also confirmed that the vulnerability – which affected proxy providers like IPIDEA and granted threat actors access to local network devices with Android Debug Bridge (ADB) exposed – has been exploited by JackSkid and Mossad as well to achieve the same goals as Kimwolf. This allowed them to leverage the residential proxy networks and "sweep up those bots for their own use." XLab told the publication that it provided sample hashes, decrypted C2 configurations, and screenshots of DDoS attacks as evidence. Akamai said the hyper-volumetric botnets generated attacks exceeding 30 Tbps, 14 billion packets per second, and 300 Mrps, adding that cybercriminals leveraged these botnets to launch hundreds of thousands of attacks and demand extortion payments from victims in some cases. "These attacks can cripple core internet infrastructure, cause significant service degradation for ISPs and their downstream customers, and even overwhelm high-capacity cloud-based mitigation services," the web infrastructure company said.

The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline. The Justice Department said the Department of Defense Office of Inspector General’s (DoDIG) Defense Criminal Investigative Service (DCIS) executed seizure warrants targeting multiple U.S.-registered domains, virtual servers, and other infrastructure involved in DDoS attacks against Internet addresses owned by the DoD. The government alleges the unnamed people in control of the four botnets used their crime machines to launch hundreds of thousands of DDoS attacks, often demanding extortion payments from victims. Some victims reported tens of thousands of dollars in losses and remediation expenses. The oldest of the botnets — Aisuru — issued more than 200,000 attacks commands, while JackSkid hurled at least 90,000 attacks. Kimwolf issued more than 25,000 attack commands, the government said, while Mossad was blamed for roughy 1,000 digital sieges. The DOJ said the law enforcement action was designed to prevent further infection to victim devices and to limit or eliminate the ability of the botnets to launch future attacks. The case is being investigated by the DCIS with help from the FBI’s field office in Anchorage, Alaska, and the DOJ’s statement credits nearly two dozen technology companies with assisting in the operation. “By working closely with DCIS and our international law enforcement partners, we collectively identified and disrupted criminal infrastructure used to carry out large-scale DDoS attacks,” said Special Agent in Charge Rebecca Day of the FBI Anchorage Field Office. Aisuru emerged in late 2024, and by mid-2025 it was launching record-breaking DDoS attacks as it rapidly infected new IoT devices. In October 2025, Aisuru was used to seed Kimwolf, an Aisuru variant which introduced a novel spreading mechanism that allowed the botnet to infect devices hidden behind the protection of the user’s internal network. On January 2, 2026, the security firm Synthient publicly disclosed the vulnerability Kimwolf was using to propagate so quickly. That disclosure helped curtail Kimwolf’s spread somewhat, but since then several other IoT botnets have emerged that effectively copy Kimwolf’s spreading methods while competing for the same pool of vulnerable devices. According to the DOJ, the JackSkid botnet also sought out systems on internal networks just like Kimwolf. The DOJ said its disruption of the four botnets coincided with “law enforcement actions” conducted in Canada and Germany targeting individuals who allegedly operated those botnets, although no further details were available on the suspected operators. In late February, KrebsOnSecurity identified a 22-year-old Canadian man as a core operator of the Kimwolf botnet. Multiple sources familiar with the investigation told KrebsOnSecurity the other prime suspect is a 15-year-old living in Germany.

Your APIs are under siege, and attackers are just getting warmed up Internet-facing systems are handling sustained levels of malicious traffic across APIs, web applications, and DDoS channels. Akamai’s State of the Internet security report places these patterns within the same operating environment, with activity increasing across each area through 2025. The number of web attacks against apps and APIs continued an upward trajectory from January 2024 to December 2025, demonstrating their prevalence as a major threat to organizations (Source: Akamai) API activity centers on how applications behave API traffic continues to expand, and attack activity is rising with it. The average number of API attacks per enterprise per day reached 258 in 2025, compared with 121 in 2024. Most organizations reported at least one API-related security incident during the year. This places API security within routine operations for many teams. Attack activity is shifting toward how applications behave during normal use. Behavior-based threats now account for a larger share of API traffic. These threats focus on how requests move through workflows and how systems respond to those requests. Common weaknesses in APIs remain tied to configuration and access control. Security misconfiguration appears most often in vulnerability data, followed by authorization and authentication issues. Incident data reflects similar patterns, with unsafe API consumption and authentication problems appearing frequently. “Attackers increasingly focus on degrading performance, driving up infrastructure costs, and exploiting AI-driven automation at scale, rather than seeking headline-grabbing campaigns,” said Patrick Sullivan, CTO of Security Strategy at Akamai. “Automation and AI are making these sophisticated campaigns cheap, repeatable, and fast. And as enterprises invest heavily in AI transformation, attackers are targeting the APIs that power that transformation.” These conditions place API security within everyday application behavior. Requests that appear normal at first can still expose weaknesses when systems process them. Sensitive data remains part of API exposure API environments include large volumes of sensitive data. Each customer manages thousands of APIs that handle this type of information. A portion of these APIs contains security weaknesses, and some of those weaknesses involve sensitive data exposure. The number of APIs exposing sensitive data has increased over time. This reflects how APIs are used to connect systems and move data between services. Organizations also report uneven visibility into their API environments. Many maintain an inventory of APIs, and fewer can identify which APIs return sensitive data. This gap places sensitive data within systems that are still being mapped and understood. Sensitive data exposure remains tied to how APIs are configured and maintained. These conditions extend across development and production environments. DDoS activity spans multiple layers DDoS activity continues across application and network layers. Attack campaigns include Layer 3, Layer 4, and Layer 7 traffic within the same operations. This reflects how attackers move across different parts of the stack during a single campaign. Layer 7 DDoS activity has increased over time, placing pressure on application-facing systems. Network-layer activity continues alongside it, contributing to overall traffic volume during attacks. Botnet activity supports these campaigns. Variants such as Aisuru and Kimwolf infect large numbers of IoT and Android devices. These devices contribute to the traffic used in DDoS activity. Industry targeting data places software and SaaS among the sectors receiving sustained DDoS activity across both application and network layers. These environments rely on continuous availability, which places them within the flow of ongoing attack activity. Web application attacks remain steady Web application attacks are increasing alongside API activity. Attack volume has grown since 2023, with injection-based techniques remaining part of observed activity. These attacks target application inputs and how systems process data. They remain part of routine traffic across many environments. Regional data shows continued pressure in APAC, where web application and API attacks reach into the tens of billions over the course of a year. DDoS activity in the region includes both application-layer and network-layer traffic. These conditions show that attack activity spans regions and systems. Application traffic and network traffic operate within the same environment.