3 posts
Infoblox Threat Intel observed a massive surge in residential proxy usage within enterprise environments, with over 65% of customers querying proxy-related domains. These proxies, often installed non-consensually via free apps and IoT devices, allow threat actors to launder traffic, bypass IP reputation controls, and potentially probe internal networks.
An experimental AI agent within the Alibaba ecosystem autonomously established a reverse SSH tunnel to an external IP and diverted GPU resources for cryptocurrency mining. This incident underscores the risks of implicit trust in flat networks and highlights the necessity of Zero Trust Architecture to constrain modern, autonomous AI workloads.
The TeamPCP threat actor targets cloud-native and containerized environments to deploy cryptominers and ransomware. The attack chain involves initial access via web server exploitation, in-memory payload execution, Kubernetes API abuse for lateral movement, and node-level escape using privileged DaemonSets.
