7 posts
Between the 15th and 17th of September 2026, 85[.]137[.]54[.]178 sent 3,761 requests to exposed Docker APIs, including 578 container-creation requests and 295 archive uploads. The source used those containers to deliver six packed builds of Boatnet, a Mirai-linked Linux bot. The…
Akamai's SOTI Security report details how agentic AI is reshaping the threat landscape for commerce, with a 19% YoY increase in AI bot traffic and over 200 billion application/API attacks between 2024 and 2025. Attackers are exploiting consumer-facing chatbots through logic manipulation, back-end AI agents via prompt injection, and public AI endpoints for token freeloading. The retail vertical bore the brunt of Layer 7 DDoS activity (84%), with hacktivist groups like 313 Team leveraging Mirai-derived IoT botnets and browser impersonation for multi-vector attacks.
Google, in coordination with the FBI and Lumen, disrupted the NetNut residential proxy network (aka Popa), which is estimated to comprise at least 2 million consumer devices enrolled as proxy exit nodes via malicious SDKs embedded in apps and firmware. The network was used by 316 distinct threat clusters in a single week for masking origin IPs, password spraying, and other malicious activity. Google disabled associated C2 accounts, shared intelligence with partners, and enabled Google Play Protect to warn users about apps containing NetNut SDKs.
This weekly threat intelligence bulletin highlights multiple active exploitation campaigns targeting network infrastructure (Cisco SD-WAN, Ubiquiti UniFi OS, FortiGate firewalls) and AI platforms (Dify, Langflow), alongside supply chain attacks against Polymarket and AI agent ecosystems. Notable emerging threats include EvilTokens phishing-as-a-service abusing device-code authentication for M365 token theft, the FortiBleed campaign converting 430,000+ firewalls into credential stealers, and Turla's StockStay espionage malware targeting Ukrainian entities. Cloud extortion group FulcrumSec and the DCloud Uni-App fraud framework (236,493+ scam domains) represent additional significant threats requiring defensive attention.
Kaspersky's Q1 2026 threat report highlights significant law enforcement actions against major ransomware operators, alongside the emergence of new ransomware groups like The Gentlemen. The quarter also saw active zero-day exploitation of Cisco Secure FMC (CVE-2026-20131) by the Interlock group, a rise in macOS-targeted crypto stealers and supply chain attacks via the Axios npm package, and persistent IoT botnet activity dominated by Mirai variants.
Threat actors are actively exploiting CVE-2025-29635, a command injection vulnerability in end-of-life D-Link DIR-823X routers, to deploy a Mirai botnet variant. The campaign utilizes malicious HTTP POST requests to download and execute shell scripts that fetch the final Mirai payload, while also targeting vulnerabilities in TP-Link and ZTE devices.
Unit 42 observed active, automated exploitation attempts targeting CVE-2023-33538, a command injection vulnerability in end-of-life TP-Link routers, to deploy Mirai-like botnet malware. While the observed in-the-wild attacks were flawed and failed, technical analysis confirmed the vulnerability is exploitable if attackers authenticate using default credentials, allowing them to inject shell commands via the ssid1 parameter.
