CySecurity News - Latest Information Security and Hacking Incidents: malware

Aisuru botnet Botnet Infrastructure Cloud Security Cyber Threat Intelligence DDOS Attack HTTP Flood Attacks Hyper Volumetric Attacks malware Network Layer DDoS

Largest Ever 31.4 Tbps DDoS Attack Attributed to Aisuru Botnet

A surge of traffic unprecedented to the public internet occurred in November 2025 for thirty five seconds. The acceleration was immediate and absolute, peaking at 31.4 terabits per second before dissipating nearly as quickly as it formed. As the result of the AISURU botnet, also known as Kimwolf, the event demonstrated the use of distributed infrastructure to achieve extreme bandwidth saturation over a short period of time.

Cloudflare has released findings indicating that the incident was the largest distributed denial of service attack disclosed to date as well as contributing to an overall rise in hyper volumetric HTTP DDoS activity observed during the year 2025. In contrast to being an isolated outlier, the November spike is associated with a sustained upward trend in both the scale and operational speed of large-scale DDoS campaigns.

Throughout the year, Cloudflare's telemetry indicated significant increases in attack frequency and intensity, culminating in a sharp increase in hypervolumetric incidents during the fourth quarter. There has been an increase in observed attack sizes by more than 700 percent since late 2024, reflecting a significant change in bandwidth resources and orchestration techniques available to contemporary botnet operators as compared to late 2024. 31.4 Tbps burst was attributed to AISURU Kimwolf infrastructure, which researchers have linked with multiple coordinated campaigns in 2025.

Automated traffic analysis and inline filtering systems helped spot and mitigate the November event, proving how relying on them is becoming more important to combat high speed volumetric floods. This botnet was also involved in the operation that began on December 19, which has been referred to as The Night Before Christmas.

At the peak of that campaign, attack volumes were measured at approximately 3 billion packets per second, 4 Tbps of throughput, and 54 million HTTP requests per second. The peak rates were 9 billion packets a second, 24 Tbps, and 205 million requests a second, which shows simultaneous exploitation of application and network layer vectors. These year-end metrics help you understand the operational environment that inspired these campaigns.

According to Cloudflare, DDoS activity increased by 121 percent during 2025, with defensive systems mitigating an average of 5,376 attacks per hour. The number of aggregated attacks exceeded 47.1 million, more than doubling that of the previous year. It is estimated that 34.4 million network layer attacks took place in the fourth quarter, an increase from 11.4 million in 2024.

These attacks accounted for 78 percent of all DDoS activity. During the last quarter, DDoS incidents increased 31 percent, while year over year, they increased by 58 percent, suggesting a sustained expansion instead of episodic surges.

A distinctive component of that growth curve was hyper volumetric attacks. In the fourth quarter alone, 1,824 such incidents were recorded, as compared to 1,304 recorded in the previous quarter and 717 during the first quarter. As a result, attack volumes increased severalfold within a single annual cycle, and not only the frequency of attacks has increased, but the amplitude has also increased notably.

Combined, the data indicates that the threat landscape has been enhanced by compressed attack windows, increased packet rates, and unprecedented throughput levels, which reinforces concerns that record-breaking DDoS capacity is becoming an iterative benchmark rather than an exceptional event.

It was a calculated extension of the same operational doctrine in the December campaign, known as The Night Before Christmas. As of December 19, 2025, Cloudflare's infrastructure and downstream customers have been subjected to sustained hypervolumetric traffic directed by the botnet, which blends record scale Layer 4 floods with HTTP surges exceeding 200 million requests per second at the application layer.

In September 2025, this operation exceeded the botnet's own previous benchmark of 29.7 Tbps, which marked a significant increase in bandwidth deployment and request augmentation. Upon examining the campaign, investigators determined that millions of unofficial streaming boxes were conscripted into the campaign, which generated packets and requests rarely seen at such a high rate.

At its apex, 31.4 Tbps, the attack reached a magnitude that would have exceeded several major providers' publicly disclosed mitigation ceilings. In purely theoretical terms, Akamai Prolexic's capacity of 20 Tbps, Netscout Arbor Cloud's capacity of 15 Tbps, and Imperva's capacity of 13 Tbps would have reached bandwidth utilization levels exceeding 150 to 240 percent under equivalent load based on stated capacities.

However, this comparison highlights the structural stress such volumes impose on conventional scrubbing architectures when comparing distributed absorption and traffic engineering strategies with real world resilience. In contrast to a single monolithic flood, telemetry from this campaign revealed a pattern of distributed, highly coordinated bursts.

Thousands of discrete attack waves exhibited consistent scaling characteristics, each exhibiting a similar pattern. Ninety-three percent of events reached peak rates between one and five Tbps, while 5.5 percent reached peak rates between five and ten Tbps. There was only a fractional 0.1 percent of events exceeding 30 Tbps, demonstrating that the headline-breaking spike was not only rare, but deliberate from a statistical perspective.

According to packet rate analysis, 94.5 percent of attacks generated packets between one and five billion per second, while 4 percent peaked at five to ten billion, and 1.5 percent reached ten to fifteen billion packets per second. A number of attack waves were engineered as concentrated bursts rather than prolonged sieges, highlighting the tactical refinement of the operation.

There were 9.7 percent of attacks lasting less than 30 seconds, 27.1% lasting between 30 and 60 seconds, and 57.2% lasting 60 to 120 seconds. Only 6% exceeded the two-minute mark, suggesting a focus on high intensity volleys designed to strain defensive thresholds before adaptive mitigation can fully adjust.

In hyper volumetric incidents, 42.5 percent of incidents were targeted against gaming organizations, while 15.3 percent were targeting IT and services organizations. This distribution indicates that it is aimed at industries with high latency sensitives and infrastructure-dependent infrastructures where even brief disruptions can have a substantial impact on operational and financial performance.

In the wake of the December offensive, a botnet has gradually evolved into one of the most significant distributed denial of service threats observed over the past few years. Through the compromise of consumer grade devices, the Aisuru operation, which split into an Android-focused Kimwolf variant in August 2025, expanded aggressively.

According to Synthient, Kimwolf infected more than two million unofficial Android TVs, making them into a global attack grid. They built layered command and control architectures using residential proxy networks to make origin infrastructure look bad and make takedown harder.

Botnet activity captured the attention of the public after it briefly pushed its own domain activity to the top of Cloudflare's global rankings, an outcome achieved as a consequence of artificial traffic amplification rather than organic traffic. Disruption efforts are ongoing. Black Lotus Labs, a division of Lumen Technologies, began counter-operations in early October 2025, disrupting traffic to more than 550 command and control servers connected to Kimwolf and Aisuru.

Although the network displayed adaptive resilience, the endpoints were rapidly migrating to newly provisioned hosts, frequently using IP address space associated with Resi Rack LLC and recurring autonomous system numbers to reconstitute its control plane, and reconfiguring its control plane in a timely manner. This infrastructure rotation illustrates a trend in botnet engineering which emphasizes redundancy and rapid redeployment as part of operational design rather than as a contingency measure.

An accelerating level of DDoS activity was evident across the entire internet as the record-setting events unfolded. There will be 47.1 million DDoS incidents in the year 2025, which represents a 121 percent increase over 2024 and a 236 percent increase over 2023. In the past year, automated mitigation systems processed approximately 5,376 attacks per hour, which included approximately 3,925 network level events and 1,451 HTTP layer floods.

Most of the expansion has occurred at the network layer, with network layer attacks doubling from 11.4 million incidents to 34.4 million incidents year over year. In the fourth quarter alone, 8.5 million such attacks took place, reflecting 152 percent year-over-year growth and 43 percent quarter-over-quarter increase, with network layer vectors accounting for 78 percent of all DDoS activity in that quarter.

Indicators of scale and sophistication reveal an intensifying threat model. There was a 600 percent increase in network layer attacks exceeding 100 million packets per second over the previous quarter, while those surpassing 1 Tbps increased by 65 percent. Nearly 1 percent of network layer attacks exceeded the 1 million packet per second threshold, emphasizing the increasing use of high intensity traffic bursts designed to stress routing and filtering systems.

Most HTTP DDoS activity was caused by known botnets, accounting for 71.5 percent, anomalous HTTP attributes accounted for 18.8 percent, fake or headless browser signatures accounted for 5.8 percent, and generic flood techniques accounted for 1.8%. As indicated by the duration analysis, 78.9 percent of HTTP floods ended within ten minutes, suggesting a tactical preference for high impact, compressed attack cycles.

It has been estimated that roughly three out of each hundred HTTP events qualified as hyper volumetric at the application layer while 69.4 percent of HTTP events remain below 50,000 requests per second, whereas 2.8% exceed 1 million requests per second. More than half of HTTP DDoS attempts were automatically neutralized without human intervention through Cloudflare's real-time botnet detection systems, reflecting an increased reliance on machine learning-driven mitigation frameworks.

DDoS traffic observed in the fourth quarter exhibited notable changes in source distribution. Bangladesh emerged as the largest origin, replacing Indonesia, which fell to third place. In second place, Ecuador was ranked, while Argentina rose by twenty places to become the fourth largest source. Hong Kong, Ukraine, Vietnam, Taiwan, Singapore, and Peru also contributed significantly.

Analyzing data from autonomous systems indicates that adversaries disproportionately exploit cloud computing platforms and telecommunications infrastructure to gain an edge over their adversaries. In this report, Russia has lost five positions in the rankings, while the United States has lost four positions.

There were six cloud providers collectively represented in the top ten source networks, including DigitalOcean, Microsoft, Tencent, Oracle, and Hetzner, reflecting the misuse of rapidly deployable virtual machines to generate traffic. The remaining high volume infrastructure has been mainly provided by telecommunications carriers in Asia Pacific, primarily in Vietnam, China, Malaysia, and Taiwan.

With Cloudflare's globally distributed architecture, despite the extraordinary magnitude of the Night Before Christmas campaign, the load was contained within operational limits owing to Cloudflare's global distribution. The spike of 31.4 Tbps consumed approximately 7 percent of available bandwidth across 330 points of presence, leaving considerable residual bandwidth available for the next few months.

In this case, the attack was detected and contained autonomously, without triggering any emergency escalation protocols. This episode highlights the gap between the capabilities of adversarial traffic generators and those of smaller providers in terms of their defensive capabilities.

With volumetric ceilings on the rise and botnets adopting increasingly modular command frameworks, the sustainability of internet-facing services will depend on the availability of hyperscale mitigation infrastructure that can handle not only record-setting spikes in DDoS activity but also an accelerated baseline of global DDoS activity as it continues to grow. These events indicate a trajectory that has clear implications for enterprises, service providers, and infrastructure operators.

In a world where volumetric thresholds continue to grow and botnets continue to industrialize device compromises at scale, incremental upgrades and reactive control cannot be relied upon to maintain a defensive edge. Mitigation partners must be evaluated based on their demonstrated absorption capacity, architectural distribution, maturity in automated response, and transparency in telemetry.

Edge assets, IoT ecosystems, and cloud workloads must also be hardened in order to prevent them from becoming targets and unwitting launch platforms, as they are increasingly exploited.

In addition to indicating a structural shift in adversarial capability, the November and December campaigns serve not only as record setting anomalies. Defining resilience in this environment is less about preventing every attack and more about engineering networks that are capable of sustaining, absorbing, and recovering from traffic volumes that were once considered unimaginable.

Cross-Platform Spyware Campaigns Target Indian Defense and Government Sectors



 

Windows

cyber espionage deskrat Indian Government Linux malware RAT Windows

Cross-Platform Spyware Campaigns Target Indian Defense and Government Sectors

Cybersecurity researchers have identified multiple coordinated cyber espionage campaigns targeting organizations connected to India’s defense sector and government ecosystem. These operations are designed to infiltrate both Windows and Linux systems using remote access trojans that allow attackers to steal sensitive information and retain long-term control over compromised devices.

The activity involves several spyware families, including Geta RAT, Ares RAT, and DeskRAT. These tools have been associated in open-source security reporting with threat clusters commonly tracked as SideCopy and APT36, also known as Transparent Tribe. Analysts assess that SideCopy has operated for several years and functions as an operational subset of the broader cluster. Rather than introducing radically new tactics, the actors appear to be refining established espionage techniques by expanding their reach across operating systems, using stealthier memory-resident methods, and experimenting with new delivery mechanisms to avoid detection while sustaining strategic targeting.

Across the campaigns, initial access is commonly achieved through phishing emails that deliver malicious attachments or links to attacker-controlled servers. Victims are directed to open Windows shortcut files, Linux executables, or weaponized presentation add-ins. These files initiate multi-stage infection chains that install spyware while displaying decoy documents to reduce suspicion.

One observed Windows attack chain abuses a legitimate system utility to retrieve and execute web-hosted malicious code from compromised, regionally trusted websites. The downloaded component decrypts an embedded library, writes a decoy PDF file to disk, contacts a command-and-control server, and opens the decoy for the user. Before deploying Geta RAT, the malware checks which security products are installed and modifies its persistence technique accordingly to improve survivability. This method has been documented in public research by multiple security vendors.

Geta RAT enables extensive surveillance and control, including system profiling, listing and terminating processes, enumerating installed applications, credential theft, clipboard manipulation, screenshot capture, file management, command execution, and data extraction from connected USB devices.

Parallel Linux-focused attacks begin with a loader written in Go that downloads a shell script to install a Python-based Ares RAT. This malware supports remote command execution, data collection, and the running of attacker-supplied scripts. In a separate infection chain, DeskRAT, a Golang-based backdoor, is delivered through a malicious presentation add-in that establishes outbound communication to retrieve the payload, a technique previously described in independent research.

Researchers note that targets extend beyond defense to policy bodies, research institutions, critical infrastructure, and defense-adjacent organizations within the same trusted networks. The combined deployment of Geta RAT, Ares RAT, and DeskRAT reflects a developing toolkit optimized for stealth, persistence, and long-term intelligence collection.

Emerging AI Built Malware Used in Targeted Attacks on Blockchain Engineers



 

supply chain attacks

Blockchain Security Threats Cryptocurrency Cybersecurity Konni APT malware North Korean Hackers Phishing Campaign PowerShell Backdoor supply chain attacks

Emerging AI Built Malware Used in Targeted Attacks on Blockchain Engineers

In the shadows of geopolitics, KONNI has been operating quietly for more than a decade, building on its playbook of carefully staged spear-phishing campaigns and political lures targeted at South Korean institutions.

In the past, KONNI's operations followed the fault lines between diplomacy and regional security, targeting government agencies, academic institutions, non-governmental organizations, and individuals involved in inter-Korean affairs. However, new findings from Check Point Research indicate the organization is no longer restricted to this familiar territory.

In a marked departure from its traditional approach, KONNI is currently conducting phishing campaigns targeted at blockchain developers throughout the Asia-Pacific region — including Japan, Australia, and India — signaling the company's intention of expanding geographically and recalibrating its strategic approach.

As part of the campaign, in addition to shifting attention to individuals with access to blockchain infrastructure, a novel AI-based backdoor is also introduced, illustrating a refinement of the group's technical capabilities and operational priorities. In Check Point's analysis, the campaign appears to be the product of the North Korean threat group Konni (also tracked as Opal Sleet and TA406), which researchers believe has operational overlaps with activity clusters such as APT37 and Kimsuky.

As of at least 2014, the group has been engaged in espionage operations against South Korean entities, Russian entities, Ukrainian entities, and multiple European countries. The telemetry generated by recent analyzed samples, however, indicates that the current wave of malware is concentrated in Asia-Pacific, with submissions originating from Japan, Australia, and India.

This confirms the assessment of a deliberate geographic pivot. Infection chains are carefully staged and multilayered, indicating that they are designed to infect in a controlled manner. There is a Discord link provided to victims that serves a ZIP archive which contains a decoy PDF along with a malicious Windows shortcut file (LNK).

By executing the shortcut, an embedded PowerShell loader will be invoked to extract additional components, including a DOCX lure and a CAB archive. Several payload components are contained in the cabinet file, including a PowerShell-based backdoor, two batch scripts for automating User Account Control (UAC), and an executable for bypassing User Account Control.

Upon opening the shortcut, a decoy document is displayed while covertly executing a batch file embedded within, thereby ensuring the malicious activity is concealed in legitimate documentation. The lure content itself indicates that attackers intend to penetrate development environments, allowing them access to infrastructure repositories, API credentials, wallet configurations, and possibly cryptocurrency holdings.

An initial batch script establishes a staging directory for persistent storage, deposits the backdoor and secondary scripts and configures a scheduled task designed to run on an hourly basis in order to avoid detection by OneDrive. This procedure consists of retrieving PowerShell payloads from disk, decrypting them at runtime and subsequently removing them from the system in an effort to minimize forensic visibility and complicate incident response.

A Check Point Research report further indicated that KONNI's operators have been contacting IT technicians and developers directly, using carefully constructed phishing emails that appear to be legitimate project requirements. It is the firm's belief that the objective is not limited to compromising individual systems, but is intended to gain access to cloud infrastructure, source code repositories, APIs, and blockchain credentials as well.

It has been reported that a successful compromise results in the deployment of a PowerShell backdoor that is artificial intelligence-assisted, providing persistent access to infected systems and sensitive assets within development environments. The apparent use of artificial intelligence in designing the backdoor is a distinguishing feature of the campaign.

According to Check Point, the malware's modular architecture, structured formatting, embedded developer-style comments, including placeholders indicating that AI tooling was used during development, as well as its embedded developer-style comments.

Instead of introducing fundamentally new exploitation techniques, it appears that the use of artificial intelligence simplifies the generation of code, accelerates iteration cycles, and enables rapid customization while maintaining established delivery methods.

Despite the lack of determination of the exact initial access vector, the intrusion chain unfolds through a multi-stage process that uses ZIP archives hosted by Discord's content delivery network. Each archive contains an innocent-looking PDF decoy in addition to a malicious LNK shortcut.

A shortcut is executed, launching an embedded PowerShell loader that generates an embedded Word document to serve as a distraction, as well as a CAB archive that contains the primary payload components. These include a PowerShell backdoor, two batch scripts, and an executable specifically designed for bypassing User Account Control.

Using the first batch script, the execution environment is prepared, persistence is established by way of scheduled tasks, and the backdoor is staged and launched, and it is then deleted to reduce forensic artifacts. PowerShell implants perform a number of anti-analysis and sandbox-evasion checks prior to profiling the host system and then attempt to gain access to the host system by using FodHelper UAC bypass.

A secondary batch script is executed by the malware after elevation, which removes the dropped UAC bypass binary, configures Microsoft Defender exclusions for the "C:/ProgramData" directory, and replaces the original scheduled task with an elevated task version.

A backdoor is used to maintain remote access by deploying SimpleHelp, a legitimate remote management and monitoring tool. A command-and-control server is connected via an encryption gate to filter non-browser traffic, enabling the backdoor to communicate with it continuously. This channel is used to transmit system metadata periodically and to execute PowerShell instructions provided by the server to the compromised host.

Using this layered approach, Check Point assesses that the campaign's main purpose is to establish footholds within development ecosystems, rather than targeting isolated end users. It combines malicious activity with legitimate administrative tooling to reinforce persistence. Through the use of development environments, multiple projects, services, and digital asset platforms can be leveraged downstream.

As researchers argue, the integration of AI-assisted tooling demonstrates the use of standardization and speed up of malware production while continuing to rely on proven social engineering strategies. North Korea-related operations have been observed in recent months that align with these findings.

A number of campaigns have deployed JavaScript encoded scripts disguised as Hangul Word Processor documents as a means of enabling remote access to Visual Studio Code, while others have distributed LNK files masquerading as PDF documents to deliver the MoonPeak remote access trojan following virtual environment verification.

As a result of activities associated with the Andariel subgroup in 2025, TigerRAT was used against a European law firm. An update mechanism of a South Korean ERP software vendor was compromised, allowing the distribution of multiple Trojans — StarshellRAT, JelusRAT, and GopherRAT — to downstream customers.

According to WithSecure, this ERP vendor was previously utilized in supply chain intrusions in 2017 and 2024 to propagate malware families including HotCroissant and Xctdoor. Several of the newly identified implants demonstrate technical diversity. JelusRAT, developed in C++, is capable of retrieving plugins from command servers; StarshellRAT, created in C#, allows command execution, file transfers, screenshot capture, and GopherRAT, developed in Golang, is capable of enumerating file systems, executing commands, and exfiltrating data.

There has been a continuous display of strategic adaptability on the part of North Korea-related threat groups. Several objectives have been pursued by these groups, ranging from theft of cryptocurrency as a form of financial motivation to gathering intelligence aligned with government priorities.

Through the incorporation of artificial intelligence-assisted development techniques in conjunction with operational flexibility, a sustained evolution in tooling and targeting is evident — particularly in light of adversaries' increasing pursuit of operational areas of high value, such as software supply chains and blockchain ecosystems.

Throughout this campaign, security teams are urged to treat developer workstations, build pipelines, and repository access with the same rigor traditionally reserved for production systems as they represent one of the most strategically valuable attack surfaces in the digital economy.

Multifactor authentication is enforced on source control and cloud platforms by enforcing hardware-backed authentication, restricting local administrative privileges, monitoring schedule creation and PowerShell execution, and auditing endpoint security exclusions to ensure unauthorized changes have not occurred.

Additionally, organizations operating within blockchain-based and digital asset ecosystems should have a strict system of network segmentation, continuous credential rotation, and behavior monitoring capabilities that can detect anomalous behavior involving legitimate remote management tools. In addition, it is necessary to strengthen defenses at the human layer of the attack given the campaign's reliance on convincingly themed project documentation and developer-centered lures.

As a result, targeted phishing simulations and secure code environment awareness training should be prioritised for engineers. Defensers must also anticipate faster tooling cycles and increasingly modular payloads with the emergence of AI-assisted malware development.

Taking proactive measures to mitigate downstream impact will require telemetry correlation across endpoints and cloud environments, as well as rapid incident containment procedures. Resilience will be equally dependent upon integrating security controls directly into the development lifecycle rather than treating them as a downstream safeguard as adversaries continue to recalculate their targeting of high-value technical roles and software supply chains.

Stanley Malware Service Bypasses Chrome Web Store Safeguards



 

Stanley

Chrome Web Store Maas Hack malware Phising Campaign Stanley

Stanley Malware Service Bypasses Chrome Web Store Safeguards

Researchers at Varonis have discovered a new malware-as-a-service (MaaS) offering, dubbed "Stanley," which allows malicious Chrome extensions to evade Google’s review process and be listed on the official Chrome Web Store. Dubbed after the alias of the seller, Stanley is also designed to target other popular browsers like Edge and Brave, making it easier for phishing attacks to be deployed. The service is offered at high-end pricing tiers, going up to $6,000, and is designed to make it easier for malicious actors with less technical knowledge.

The main functionality is achieved through the use of a full-screen iframe overlay of phishing content on top of legitimate websites, with the browser’s address bar still visible to maintain a level of authenticity. The user is presented with interfaces for trusted websites, such as banking websites, but their interactions are instead routed to attacker-controlled pages that are designed for phishing. Other functionalities include IP targeting, geographic filtering, cross-device session correlation, and Chrome-native push notifications to improve user engagement.

The attackers use a web-based control panel to dynamically change hijacking rules, poll command-and-control (C2) servers every ten seconds, and change backup domains to make it more difficult to take down. The service offers subscription plans, with the final option being a "Luxe" plan that includes full support for publication to the Web Store and customization options. Despite the code being described as "rudimentary" with Russian-language comments and poor error handling, the step-by-step implementation of known techniques seems to offer high levels of effectiveness.

This development exacerbates ongoing issues with the Chrome Web Store, where malicious extensions have repeatedly evaded detection, as noted in recent Symantec and LayerX reports. Varonis highlights Stanley's distribution promise as its standout feature amid rising browser add-on threats. Google has been contacted for comment, but such incidents underscore persistent vetting gaps in the ecosystem serving billions.

Users must adopt vigilant habits: install only essential extensions, scrutinize developer reputations and reviews, and enable browser protections like Enhanced Safe Browsing. Enterprises should enforce extension whitelisting and monitor for anomalous behavior via endpoint detection tools. As MaaS evolves, staying proactive against store-approved threats remains critical for cybersecurity in 2026.

China-Linked DKnife Threat Underscores Risks to Network Edge Devices



 

Traffic Manipulation

Adversary In The Middle China Linked APT DarkNimbus DKnife Framework malware Network Edge Attacks Router Hijacking ShadowPad Traffic Manipulation

China-Linked DKnife Threat Underscores Risks to Network Edge Devices

Despite adversaries increasing their focus on the network edge, recent findings suggest a sustained and deliberate effort to weaponize routing infrastructure itself for surveillance and delivery purposes. An attacker can observe, modify, and selectively redirect data streams in transit by embedding malicious logic directly into traffic paths rather than relying on endpoint compromise.

This evolution is reflected in the development of the DKnife framework, which has transformed attacker-in-the-middle capabilities into modular, long-lived platforms that are designed to be persistent, stealthy, and operationally flexible.

Through the framework's ability to operate at a level where legitimate traffic aggregation and inspection already take place, the line between benign network functionality and hostile control is blurred, enabling malware deployment and long-term monitoring across a variety of device classes and user environments targeted at targeted users.

According to cybersecurity researchers, DKnife is an adversary-in-the-middle framework that has operated from at least 2019 to maintain router-centric infrastructure by threat actors who have been found to be linked to China.

In order to enable deep packet inspection, selective traffic manipulation, and covert delivery of malicious payloads, seven Linux-based implants are installed on gateways and edge devices. Several code artifacts and telemetry indicate a clear focus on Chinese-speaking users, including credential-harvesting components tailored specifically for Chinese email services, data exfiltration modules specifically targeted at popular mobile applications, and hard-coded references to domestic media domains buried within the implants.

It is argued that DKnife's potential strategic value lies in its ability to act as a conduit between legitimate update and download channels and users. As the framework intercepts binary transfers and mobile application updates in transit, it is possible to deploy and manage established backdoors across a broad range of endpoints ranging from desktop systems to mobile devices to Internet of Things environments, including ShadowPad and DarkNimbus.

According to Cisco Talos, the activity has been associated with the ongoing tracking of a Chinese threat cluster dubbed Earth Minotaur, previously associated with exploit kits like MOONSHINE as well as backdoors like DarkNimbus. The reuse of DarkNimbus is noteworthy, as the malware has also been found in operations attributed to another Chinese advanced persistent threat group, The Wizards, indicating the possibility of sharing tools or infrastructure among these groups.

Upon further analysis of the infrastructure, it was revealed that DKnife-associated resources overlapped with those connected to WizardNet, a Windows implant deployed by TheWizards through an AitM framework called Spellbinder, which was publicized in 2025. This led to additional connections between DKnife-associated systems and WizardNet resources.

As Cisco cautions, current insights into DKnife's targeting may be incomplete due to the fact that the configuration data obtained from a single command-and-control server provide limited information about its target market of Chinese-speaking users. It is possible that parallel servers exist to support operations in other regions as well.

Due to The Wizards' history of targeting individuals and gambling-related entities across Southeast Asia, Greater China, and the Middle East, the convergence of infrastructure and tactics is significant, highlighting the wider implications of DKnife as a traffic hijacking platform with reusable, regionally adaptable features.

Although researchers have not determined the exact vector used to compromise network equipment, researchers have established that DKnife functions to deliver and control backdoors known as ShadowPad and DarkNimbus, both of which have been used by Chinese-allied threat actors for decades. A technical analysis reveals that there are seven discrete modules in the framework.

Each module is designed to support a particular operational role, such as traffic inspection, manipulation, and control-and-control messages, as well as origin obfuscation. In addition to packet inspection and attack logic, the system includes relay services to facilitate communication with remote C2 servers as well as a customized reverse proxy derived from HAProxy to mask and manage malicious traffic flows.

Additionally, DKnife extends its capabilities beyond passive monitoring with additional modules. An attacker is able to establish a virtual Ethernet TAP interface on the compromised router and connect it directly to the local network, effectively placing themselves in the data path of internal communications.

In addition, there are third parties who provide peer-to-peer VPN connectivity using modified n2n software, coordinate the download and update of malicious Android applications, and manage the deployment of the DKnife implants themselves.

Together, these elements provide a range of tools for a wide range of activities, including DNS hijacking, intercepting legitimate binary and application updates, selectively disrupting security-related traffic, and exfiltrating detailed user activity to external command infrastructures. In addition to intercepting and rewriting packets destined for their original hosts once activated on a device, DKnife also uses its network-bridging capabilities to substitute malicious payloads during transit transparently.

Through this technique, weaponized APK files can be delivered to Android devices as well as compromised binaries to Windows systems connected to the affected network using this technique. Research conducted by Cisco Talos demonstrated instances in which the framework first installed ShadowPad backdoors for Windows, signed by Chinese certificates, followed by the installation of DarkNimbus backdoors to establish long-term access.

Unlike secondary droppers, DarkNimbus was delivered directly to Android environments through the manipulated update channel. It was further revealed by investigators that infrastructure was associated with a framework hosting the WizardNet backdoor, a Windows implant previously associated with Spellbinder AitM. This confirmed the link between DKnife and previously documented adversary-in-the-middle attacks.

Incorporating these tools within the same operational environment implies that development resources will likely be shared or infrastructure will be coordinated. As a result, threat actors are becoming increasingly sophisticated in their use of compromised network devices as covert malware distribution channels as opposed to utilizing endpoints to spread malware.

The Cisco Talos team further concluded that DKnife is capable of intercepting Windows binary downloads in addition to mobile ecosystems. As observed, the framework was capable of manipulating download URLs in transit, either substituting legitimate installers for trojanized counterparts or redirecting users to malicious distribution points controlled by the attackers.

In combination with its DNS manipulation capabilities and control over application update channels, DKnife provides an extensive traffic-hijacking platform that can silently deliver malware while maintaining the appearance of normal network behavior.

The framework's components work together to create a continuous attack system at the network gateway that functions in conjunction with each other. Moreover, DKnife offers a broad range of secondary functionality in addition to payload delivery, such as credential harvesting through decrypted POP3 and IMAP sessions, hosting phishing pages, selectively disrupting antivirus and security product traffic, and detailed user activity monitoring.

Several applications and services were observed to collect telemetry, including messaging platforms, navigation tools, news consumption, telephony, ridesharing, and online shopping, by researchers. In particular, WeChat was observed to receive significant attention, with the framework tracking voice and video calls, message content, media exchanges, and articles accessed through the application. The placement of DKnife on gateway devices permits near real-time visibility into user behavior.

Activity events are processed internally across the framework's modular components first before being exfiltrated via structured HTTP POST requests to dedicated API endpoints and then forwarded to remote command-and-control infrastructure.

A significant reduction in the need for persistent malware on individual endpoints is achieved through this architecture, which allows attackers to correlate traffic flows and user actions as packets traverse the network. Researchers note that this approach reflects a greater trend towards infrastructure-level compromise, which is the use of routers and edge devices as persistent delivery platforms for malware.

According to Cisco Talos, DKnife-associated command-and-control servers remain active as of January 2026, highlighting the continued nature of this threat. An exhaustive set of indicators of compromise has been developed by the firm to assist defenders in identifying compromised systems, as well as emphasizing the need to pay increased attention to network infrastructure as adversaries continue to utilize its unique position within modern digital environments to their advantage.

Attackers Exploit Revoked EnCase Driver to Disable Endpoint Security Using New EDR Killer Malware



 

vulnerable driver abuse

BYOVD Attack EDR killer malware EnCase driver exploit kernel driver security malware vulnerable driver abuse

Attackers Exploit Revoked EnCase Driver to Disable Endpoint Security Using New EDR Killer Malware

Threat actors are increasingly deploying a new strain of EDR killer malware capable of disabling 59 popular endpoint protection products. According to Huntress researchers, the malware abuses a Windows kernel driver that was once legitimately distributed with Guidance Software’s EnCase digital forensics tool.

Although the driver is genuine, its signing certificate expired and was revoked over a decade ago. Despite this, Windows systems still permit the driver to load, making it an attractive target for attackers.

Huntress analysts identified the intrusion earlier this month and determined that attackers followed a multi-step process. They initially gained entry into the victim’s environment by authenticating to a SonicWall SSLVPN using previously stolen credentials. Once inside, the attackers conducted internal reconnaissance before deploying the EDR killer malware, which contained the vulnerable kernel driver embedded within it.

To evade detection, the malware uses a custom encoding mechanism that conceals the driver from security tools. After decoding, the driver is written to disk under a directory that resembles a legitimate OEM component. The file is hidden, its timestamps are copied from an authentic system file to avoid suspicion, and it is registered as a Windows kernel service to ensure persistence across reboots.

“Once loaded, the driver exposes an IOCTL interface that allows usermode processes to terminate arbitrary processes directly from kernel mode. This bypasses all usermode protections, including Protected Process Light (PPL) that typically guards critical system processes and EDR agents,” the researchers explained.

This attack leverages the Bring Your Own Vulnerable Driver (BYOVD) technique, which enables adversaries to achieve kernel-level access by abusing trusted but flawed drivers. Rather than developing a malicious driver from scratch, attackers reuse legitimate drivers created by hardware vendors or software providers.

After such a driver is loaded into the kernel, its vulnerabilities or exposed interfaces can be exploited to disable security tools, weaken system defenses, or directly access system memory.

While defenders have been aware of BYOVD attacks for years, mitigating them at scale remains challenging. Windows Driver Signature Enforcement (DSE) can block unsigned or altered drivers, but it does not validate Certificate Revocation Lists (CRLs).

“This limitation exists for practical reasons: drivers load early in the boot process before network services are available, and CRL checks would significantly impact boot performance. Even when a CRL is manually imported into local certificate storage, the kernel bypasses this check entirely,” the researchers explained.

To address this gap, Microsoft maintains a Vulnerable Driver Blocklist. However, this approach has an inherent weakness: only drivers already identified as malicious are included, leaving a window of opportunity for attackers to exploit new or overlooked drivers. Microsoft also allows certain exceptions to preserve backward compatibility.

“Drivers signed with certificates issued before July 29, 2015, that chain to a supported cross-signed certificate authority] are still permitted to load,” the researchers noted. “The EnCase driver’s certificate was issued on December 15, 2006, well before this cutoff.”

Huntress believes the attackers’ end goal was to deploy ransomware, but the campaign was stopped before reaching that stage. To reduce risk, the researchers recommend enabling multi-factor authentication across all remote access services and closely reviewing VPN logs for unusual activity. Organizations should also enable Memory Integrity to enforce Microsoft’s Vulnerable Driver Blocklist, watch for suspicious services masquerading as legitimate hardware components, and apply Windows Defender Application Control and Attack Surface Reduction rules to block the loading and abuse of known vulnerable drivers.

AISURU/Kimwolf Botnet Behind Record 31.4 Tbps DDoS Attack, Cloudflare Reveals



 

Record DDoS Attack

AISURU Kimwolf botnet Android botnet malware Cloudflare DDoS report hyper volumetric DDoS malware Record DDoS Attack

AISURU/Kimwolf Botnet Behind Record 31.4 Tbps DDoS Attack, Cloudflare Reveals

A massive distributed denial-of-service (DDoS) assault reaching an unprecedented peak of 31.4 terabits per second (Tbps) has been attributed to the AISURU/Kimwolf botnet. The attack, which lasted just 35 seconds, is now being described as one of the largest hyper-volumetric DDoS events ever recorded.

Cloudflare said it automatically identified and blocked the activity, noting that the incident was part of a wider surge in hyper-volumetric HTTP DDoS attacks linked to AISURU/Kimwolf during the fourth quarter of 2025. The specific attack occurred in November 2025.

The botnet has also been associated with a separate campaign dubbed The Night Before Christmas, which began on December 19, 2025. According to Cloudflare, attacks observed during this campaign averaged 3 billion packets per second (Bpps), 4 Tbps, and 54 million requests per second (Mrps). At their peak, the attacks escalated to 9 Bpps, 24 Tbps, and 205 Mrps.

"DDoS attacks surged by 121% in 2025, reaching an average of 5,376 attacks automatically mitigated every hour," Cloudflare's Omer Yoachimik and Jorge Pacheco said. "In 2025, the total number of DDoS attacks more than doubled to an incredible 47.1 million."

The web infrastructure firm reported mitigating 34.4 million network-layer DDoS attacks throughout 2025, a sharp increase from 11.4 million in 2024. In the final quarter of 2025 alone, network-layer incidents represented 78% of all DDoS activity. Overall, DDoS attacks climbed 31% quarter-over-quarter and rose 58% compared to the previous year.

Hyper-volumetric DDoS attacks also saw a significant rise, increasing by 40% in Q4 2025 compared to the previous quarter, jumping from 1,304 to 1,824 incidents. Earlier in the year, Q1 2025 recorded 717 such attacks. Alongside the growing frequency, the scale of these attacks expanded dramatically, with sizes increasing by more than 700% compared to large-scale incidents observed in late 2024.

AISURU/Kimwolf is believed to have compromised over 2 million Android devices, largely unbranded Android TVs, which were absorbed into its botnet. Many of these infections were facilitated through residential proxy networks such as IPIDEA. In response, Google recently disrupted the proxy service and initiated legal action to dismantle dozens of domains used to manage infected devices and route proxy traffic.

Google also collaborated with Cloudflare to interfere with IPIDEA’s domain resolution capabilities, significantly weakening the operators’ command-and-control infrastructure.

“As part of the Google-led disruption effort, Cloudflare participated by suspending access to many accounts and domains that were misusing its infrastructure," Cloudflare told The Hacker News over email. "Threat actors were attempting to distribute malware and provide markets for people seeking access to the network of illicit residential proxies."

Investigations suggest that IPIDEA recruited infected devices using at least 600 malicious Android applications embedded with proxy SDKs, along with more than 3,000 trojanized Windows executables masquerading as OneDriveSync tools or Windows updates. The Beijing-based firm has also promoted VPN and proxy applications that covertly transformed users’ Android devices into proxy exit nodes without their awareness or permission.

Additionally, threat actors have been identified operating more than a dozen residential proxy services posing as legitimate businesses. These offerings, despite appearing separate, are all reportedly connected to a centralized infrastructure controlled by IPIDEA.

Cloudflare highlighted several additional trends observed during Q4 2025. Telecommunications companies, service providers, and carriers were the most targeted industries, followed by IT services, gambling, gaming, and software sectors. The most attacked countries included China, Hong Kong, Germany, Brazil, the United States, the United Kingdom, Vietnam, Azerbaijan, India, and Singapore.

Bangladesh overtook Indonesia as the largest source of DDoS traffic globally, with Ecuador, Indonesia, Argentina, Hong Kong, Ukraine, Vietnam, Taiwan, Singapore, and Peru also ranking among the top origins of attack traffic.

"DDoS attacks are rapidly growing in sophistication and size, surpassing what was previously imaginable," Cloudflare said. "This evolving threat landscape presents a significant challenge for many organizations to keep pace. Organizations currently relying on on-premise mitigation appliances or on-demand scrubbing centers may benefit from re-evaluating their defense strategy."

Threat Actors Leverage Hugging Face to Spread Android Malware at Scale



 

social engineering attacks

Android Android Spyware Cloud Infrastructure Abuse Hugging Face Abuse malware Mobile Credential Theft Mobile Security Threats Remote Access Trojan social engineering attacks

Threat Actors Leverage Hugging Face to Spread Android Malware at Scale

Initially appearing as a routine security warning for mobile devices, this warning has evolved into a carefully engineered malware distribution pipeline. Researchers at Bitdefender have identified an Android campaign utilizing counterfeit security applications that serve as the first stage droppers for remote access Trojans, known as TrustBastion.

The operators have opted not to rely on traditional malware hosting infrastructure, but have incorporated their delivery mechanism into Hugging Face's public platform, allowing it to conceal malicious activity through its reputation and traffic profile.

Social engineering is used to drive the infection chain, with deceptive ads and fabricated threat alerts causing users to install the malware. The app silently retrieves a secondary payload from Hugging Face once it has been installed on the device, providing persistence via extensive permission abuse.

At scale, the campaign is distinguished by a high degree of automation, resulting in thousands of distinct Android package variants, thereby evading signature-based detection and complicating attribution, thus demonstrating the shift toward a more industrialized approach to mobile malware.

Using this initial foothold as a starting point, the campaign illustrates how trusted developer infrastructure can be repurposed to support a large-scale theft of mobile credentials. As a consequence, threat actors have been using Hugging Face as a distribution channel for thousands of distinct Android application packages that were designed to obtain credentials related to widely used financial, banking, and digital payment services.

Generally, Hugging Face is regarded as a low-risk domain, meaning that automated security controls and suspicion from users are less likely to be triggered by this site's hosting and distribution of artificial intelligence, natural language processing, and machine learning models.

Despite the fact that the platform has previously been abused to host malicious AI artifacts, Bitdefender researchers point out that its exploitation as a delivery channel for Android malware constitutes an intentional attempt to disguise the payload as legitimate development traffic. It has been determined that the infection sequence begins with the installation of an application disguised as a mobile security solution known as TrustBastion.

Using scareware-style advertisements, the app presents fake warnings claiming that the device has been compromised, urging immediate installation to resolve alleged threats, including phishing attempts, fraudulent text messages, and malware.

Upon deployment, the application displays a mandatory update prompt which is closely similar to that of Google Play, thereby reinforcing the illusion of legitimacy. In lieu of embedding malicious code directly, the dropper contacts infrastructure associated with the trustbastion[.]com domain, which redirects the user to a repository containing Hugging Face datasets.

After retrieving the final malicious APK via Hugging Face's content delivery network, the attackers complete a staged payload delivery process that complicates detection and allows them to continuously rotate malware variants with minimal operational overhead, complicating detection. This stage demonstrates why Hugging Face was purposefully integrated into the attacker's delivery chain during this phase of the operation.

It is common for security controls to flag traffic from newly registered or low-reputation domains quickly, causing threat actors to route malicious activity through well-established platforms that blend into normal network behavior, resulting in the use of well-established platforms.

TrustBastion droppers are not designed to retrieve spyware directly from attacker-controlled infrastructure in this campaign. Rather than hosting the malware itself, it initiates a request to a website associated with the trustbastion[. ]com domain, which serves as an intermediary rather than as a hosting point for it.

The server response does not immediately deliver a malicious application package. The server returns a HTML resource that contains a redirect link to a Hugging Face repository where the actual malware can be found. By separating the initial contact point from the final malware host, the attackers introduce additional indirection, which makes static analysis and takedown efforts more challenging.

According to Bitdefender, the malicious datasets were removed after being notified by Hugging Face before publication of its findings. Telemetry indicates the campaign had already reached a significant number of victims before the infrastructure was dismantled, despite the swift response. Furthermore, analysis of the repositories revealed unusually high levels of activity over a short period of time.

A single repository accumulated over 6,000 commits within a month, indicating that it was fully automated. A new payload was generated and committed approximately every 15 minutes, according to Bitdefender. A number of repositories were taken offline during the campaign, but the campaign displayed resilience by reappearing under alternative redirect links, using the same core codebase and only minor cosmetic changes to the icons and application metadata.

The operators further undermined traditional defense effectiveness by utilizing polymorphic techniques throughout the payloads they used. The uploaded APKs were freshly constructed, retaining identical malicious capabilities while introducing small structural changes intended to defeat hash-based detection.

It was noted by Bitdefender that this approach increased evasion against signature-driven tools, but that the malware variants maintained consistent behavioral patterns, permission requests, and network communication traits, which made them more susceptible to behavioral and heuristic analysis in the future.

After installation, the malware presents itself as a benign "Phone Security" feature and guides users through the process of enabling Android Accessibility Services. This step allows the remote access trojan to obtain extensive information about user activity and on-screen activity. In order to monitor activity in real time, capture sensitive screen content, and relay information to the malware's command and control servers, additional permissions are requested.

By impersonating legitimate financial and payment applications, such as Alipay and WeChat, this malware enhances the threat. By intercepting credentials and collecting lock-screen verification information, it becomes a full-spectrum tool to collect credentials and spy on mobile devices.

In a defensive perspective, this campaign reminds us that trust in popular platforms can be strategically exploited if security assumptions are not challenged. By combining legitimate developer infrastructure abuse with high levels of automation and polymorphic payload generation, traditional indicators alone cannot detect these types of attacks.

For Bitdefender's users, the findings reinforce the importance of identifying such threats earlier in the infection chain through behavioral analysis, permission monitoring, and anomaly-based network inspection. Users are advised to take precautions when responding to unsolicited security alerts or applications requesting extensive system privileges based on the findings.

Additionally, the operation highlights the growing adoption of cloud-native distribution models by malicious mobile malware actors, emphasizing the importance of platform providers, security vendors, and enterprises collaborating more closely to monitor abuse patterns and respond quickly to emerging misuses of trusted ecosystems.

China-Linked Hackers Step Up Quiet Spying Across South-East Asia



 

malware

APT41 China cybersecurity Southeast Asia Cyberthreats malware

China-Linked Hackers Step Up Quiet Spying Across South-East Asia

Threat actors linked to China have been blamed for a new wave of cyber-espionage campaigns targeting government and law-enforcement agencies across South-East Asia during 2025, according several media reports. Researchers at Check Point Research said they are tracking a previously undocumented cluster, which they have named Amaranth-Dragon, that has targeted Cambodia, Thailand, Laos, Indonesia, Singapore and the Philippines.

The activity shows technical and operational links to APT41, a well-known Chinese hacking ecosystem.

“Many of the campaigns were timed to coincide with sensitive local political developments, official government decisions, or regional security events,” Check Point said. “By anchoring malicious activity in familiar, timely contexts, the attackers significantly increased the likelihood that targets would engage with the content.”

The firm described the operations as tightly scoped and deliberately restrained, suggesting an effort to establish long-term access rather than cause disruption. Infrastructure was configured to communicate only with victims in specific countries, reducing the risk of discovery.

A key technique involved exploiting CVE-2025-8088, a now-patched flaw in WinRAR that allows arbitrary code execution when a malicious archive is opened. Check Point said the group began exploiting the vulnerability within days of its public disclosure in August. “The speed and confidence with which this vulnerability was operationalised underscores the group’s technical maturity and preparedness,” the researchers said.

Although the initial infection vector remains unclear, analysts believe spear-phishing emails were used to distribute malicious RAR files hosted on cloud services such as Dropbox. Once opened, the archive launches a loader using DLL side-loading, a tactic frequently associated with Chinese groups. The loader then retrieves an encryption key from one server, decrypts a payload from another location and executes it directly in memory.

The final stage deploys Havoc, an open-source command-and-control framework. Earlier versions of the campaign relied on ZIP files containing Windows shortcuts and batch files, while a separate operation in Indonesia delivered a custom remote-access trojan known as TGAmaranth RAT. That malware used a hard-coded Telegram bot for command and control and supported functions such as taking screenshots, running shell commands and transferring files.

Check Point said the command infrastructure was shielded by Cloudflare and restricted by geography, accepting traffic only from targeted countries. Compilation times and working patterns pointed to operators based in China’s time zone.

“In addition, the development style closely mirrors established APT41 practices,” the company said, adding that overlaps in tools and techniques suggest shared resources within the ecosystem. The findings come as another Chinese group, Mustang Panda, was linked to a separate espionage campaign uncovered by Dream Research Labs. The operation, dubbed PlugX Diplomacy, targeted officials involved in diplomacy, elections and international coordination between December 2025 and mid-January 2026.

“Rather than exploiting software vulnerabilities, the operation relied on impersonation and trust,” Dream said.

Victims were lured into opening files disguised as diplomatic or policy documents, which triggered infection automatically. The files installed a modified version of PlugX, a long-used Chinese espionage tool, through a multi-step process involving Windows shortcuts, PowerShell scripts and DLL search-order hijacking using a legitimate signed executable. A decoy document was shown to victims while the malware quietly embedded itself in the system.

“The correlation between actual diplomatic events and the timing of detected lures suggests that analogous campaigns are likely to persist as geopolitical developments unfold,” Dream concluded.

CrossCurve Bridge Hit by $3 Million Exploit after Smart Contract Flaw



 

malware

active exploitation Bug Exploit CrossCurve EYWA malware

CrossCurve Bridge Hit by $3 Million Exploit after Smart Contract Flaw

CrossCurve, a cross-chain bridge formerly known as EYWA, has suffered a major cyberattack after hackers exploited a vulnerability in its smart contract infrastructure, draining about $3 million across multiple blockchain networks. The CrossCurve team confirmed the incident on Sunday, saying its bridge infrastructure was under active attack and urging users to immediately stop interacting with the protocol. “Our bridge is currently under attack, involving the exploitation of a vulnerability in one of the smart contracts used,” CrossCurve said in a post on X.

“Please pause all interactions with CrossCurve while the investigation is ongoing.” Blockchain security account Defimon Alerts said the exploit stemmed from a gateway validation bypass in CrossCurve’s ReceiverAxelar contract. According to the analysis, the contract was missing a critical validation check, allowing attackers to call the expressExecute function using spoofed cross-chain messages.

By abusing this flaw, the attackers were able to bypass the intended gateway validation logic and trigger unauthorized token unlocks on the PortalV2 contract, resulting in the loss of funds. The exploit affected CrossCurve deployments across several blockchain networks.

Data from Arkham Intelligence, shared by Defimon Alerts, shows that the PortalV2 contract balance fell from roughly $3 million to nearly zero around Jan. 31. Transaction records indicate the attack unfolded across multiple chains rather than a single network.

CrossCurve operates a cross-chain decentralized exchange and liquidity protocol built in partnership with Curve Finance. The system relies on what it describes as a Consensus Bridge, which routes transactions through multiple validation layers, including Axelar, LayerZero, and the EYWA Oracle Network. In its documentation, CrossCurve had described this architecture as a security advantage, stating that “the probability of several crosschain protocols getting hacked at the same time is near zero.”

The incident, however, showed that a single smart contract flaw can still compromise a broader system. The project has backing from prominent figures in decentralized finance. Michael Egorov invested in the protocol in September 2023, and CrossCurve later said it had raised $7 million from venture capital firms. Following the exploit, Curve Finance warned users with exposure to EYWA-related pools to reassess their positions.

“Users who have allocated votes to Eywa-related pools may wish to review their positions and consider removing those votes,” Curve Finance said on X.

Security researchers said the attack echoes earlier bridge exploits, drawing comparisons to the 2022 Nomad bridge hack, in which about $190 million was drained after attackers discovered a faulty validation mechanism.

Iran-Linked Hackers Target Human Rights Groups in Redkitten Malware Campaign



 

RedKitten

Campaign Iran hackers Iranian state malware RedKitten

Iran-Linked Hackers Target Human Rights Groups in Redkitten Malware Campaign

A Farsi-speaking threat actor believed to be aligned with Iranian state interests is suspected of carrying out a new cyber campaign targeting non-governmental organizations and individuals documenting recent human rights abuses in Iran, according to a report by HarfangLab.

The activity, tracked in January 2026 and codenamed RedKitten, appears to coincide with nationwide unrest that erupted in Iran in late 2025 over soaring inflation, rising food prices, and currency depreciation. The protests were followed by a severe security crackdown, mass casualties, and an internet blackout.

“The malware relies on GitHub and Google Drive for configuration and modular payload retrieval, and uses Telegram for command-and-control,” HarfangLab said.

Researchers said the campaign is notable for its apparent use of large language models to help develop and coordinate its tooling. The attack chain begins with a 7-Zip archive bearing a Farsi filename, which contains malicious Microsoft Excel files embedded with macros.

The XLSM spreadsheets purport to list details of protesters who died in Tehran between Dec. 22, 2025, and Jan. 20, 2026. Instead, the files deploy a malicious VBA macro that acts as a dropper for a C# implant known as AppVStreamingUX_Multi_User.dll using a technique called AppDomainManager injection. HarfangLab said the VBA code itself shows signs of being generated by an LLM, citing its structure, variable naming patterns, and comments such as “PART 5: Report the result and schedule if successful.”

Investigators believe the campaign exploits the emotional distress of people searching for information about missing or deceased protesters. Analysis of the spreadsheet data found inconsistencies such as mismatched ages and birthdates, suggesting the content was fabricated. The implanted backdoor, dubbed SloppyMIO, uses GitHub as a dead drop resolver to obtain Google Drive links hosting images that conceal configuration data using steganography. This data includes Telegram bot tokens, chat IDs, and links to additional modules.

The malware supports multiple modules that allow attackers to run commands, collect and exfiltrate files, establish persistence through scheduled tasks, and launch processes on infected systems. “The malware can fetch and cache multiple modules from remote storage, run arbitrary commands, collect and exfiltrate files and deploy further malware with persistence via scheduled tasks,” HarfangLab said. “SloppyMIO beacons status messages, polls for commands and sends exfiltrated files over to a specified operator leveraging the Telegram Bot API for command-and-control.”

Attribution to Iranian-linked actors is based on the use of Farsi-language artifacts, protest-themed lures, and tactical overlaps with earlier operations, including campaigns associated with Tortoiseshell, which previously used malicious Excel documents and AppDomainManager injection techniques. The use of GitHub as part of the command infrastructure mirrors earlier Iranian-linked operations. In 2022, Secureworks, now part of Sophos, documented a campaign by a sub-group of Nemesis Kitten that also leveraged GitHub to distribute malware.

HarfangLab noted that reliance on widely used platforms such as GitHub, Google Drive, and Telegram complicates traditional infrastructure-based attribution but can also expose operational metadata that poses risks to the attackers themselves. The findings follow recent disclosures by U.K.-based Iranian activist and cyber investigator Nariman Gharib, who detailed a separate phishing campaign using a fake WhatsApp Web login page to hijack victims’ accounts.

“The page polls the attacker’s server every second,” Gharib said. “This lets the attacker serve a live QR code from their own WhatsApp Web session directly to the victim.” That phishing infrastructure was also designed to request access to a victim’s camera, microphone, and location, effectively turning the page into a surveillance tool. The identity and motive of the operators behind that campaign remain unclear.

Separately, TechCrunch reporter Zack Whittaker reported that related activity also targeted Gmail credentials using fake login pages, impacting around 50 victims across the Kurdish community, academia, government, and business sectors. The disclosures come amid growing scrutiny of Iranian-linked cyber groups following a major data leak affecting Charming Kitten, which exposed details about its operations and a surveillance platform known as Kashef. Gharib has also highlighted leaked records tied to Ravin Academy, a cybersecurity school linked to Iran’s Ministry of Intelligence and Security, which was sanctioned by the United States in 2022.

eScan Antivirus Faces Scrutiny After Compromised Update Distribution



 

Trusted Update Abuse

Antivirus Update Breach command and control servers Compromised Code Signing Cybersecurity Infrastructure Endpoint security eScan Malware Incident malware Supply Chain Attack Trusted Update Abuse

eScan Antivirus Faces Scrutiny After Compromised Update Distribution

MicroWorld Technologies has acknowledged that there was a breach of its update distribution infrastructure due to a compromise of a server that is used to deliver eScan antivirus updates to end users, which was then used to send an unauthorized file to end users.

It was reported that the incident took place within a narrow two-hour window on January 20, 2026, in a regional update cluster. It affected only a small fraction of customers who had downloaded updates during that period, and was confined to that cluster.

Following the analysis of the file, it was confirmed that it was malicious, and this demonstrates how even tightly controlled security ecosystems can be compromised when trust mechanisms are attacked.

Despite MicroWorld reporting that the affected systems were swiftly isolated, rebuilt from clean baselines, and secured through credential rotation and customer remediation within hours of the incident, the episode took place against the backdrop of escalating cyber risks that are continually expanding.

An unprecedented convergence of high-impact events took place in January 2026, beginning with a major supply chain breach involving a global antivirus vendor, followed by a technical assault against a European power grid, and the revelation of fresh vulnerabilities in artificial intelligence-driven systems in the first few weeks of January 2026.

There are a number of developments which have led to industry concerns that the traditional division between defensive software and offensive attack surfaces is eroding, forcing organizations to revisit long-standing assumptions about where trust begins and ends in their security architectures as a result.

According to further technical analysis, eScan's compromised update channel was directly used to deliver the previously unknown malware, effectively weaponizing a trusted distribution channel that had been trusted.

A report indicated that multiple security platforms detected and blocked attempted attacks associated with the malicious file the day of its distribution, prompting a quick external scrutiny to take place. It was MicroWorld Technologies who indicated to me that the incident was identified internally on January 20 through a combination of monitoring alerts and customer reports, with the affected infrastructure isolated within an hour of being identified.

The company issued a security advisory the following day, January 21, as soon as the attack was under control and the situation had been stabilised. In spite of the fact that cybersecurity firm Morphisec later revealed that it had alerted eScan during its own investigation, MicroWorld maintains that containment efforts were already underway when the communication took place.

The company disputes any suggestion that customers were not informed of the changes, claiming proactive notifications and direct outreach as part of the remediation process to address any concerns.

A malicious update was launched by a file called Reload.exe, which set off a multi-stage infection sequence on the affected systems through the use of a file called Reload.exe.

The researchers that conducted the initial analysis reported that the executable modified the local HOSTS file to prevent the delivery of corrective updates from eScan update servers and that this led to a number of client machines experiencing update service errors.

As part of its persistence strategy, the malware created scheduled tasks, such as CorelDefrag, and maintained communication with external command-and-control infrastructure to retrieve additional payloads, in addition to disrupting operations.

During the infection process, there was also a secondary malicious component called consctlx.exe written to the operating system, which further embedding the threat within the system. A further detail provided by Morphisec, an endpoint security company, provided a deeper technical insight into the underlying mechanism and intent of the malicious update distributed through the trusted infrastructure of eScan.

As Morphisec stated in its security bulletin, the compromised update package contained a modified version of the eScan update component Reload.exe that was distributed both to enterprise environments and consumer environments via legitimate update channels.

Despite the binary's appearance of being signed with eScan's code signing certificate, validation checks conducted by Windows and independent analysis platforms revealed that the signature was not valid. Morphisec's analysis revealed that the altered Reload.exe functions as a loader for a malware framework that consists of several stages. This raises concerns about certificate integrity and abuse of trusted signing processes.

When the component is executed, it establishes persistence on infected machines, executes arbitrary commands, and alters the Windows HOSTS file to prevent access to eScan's update servers, preventing eScan from releasing updates by using routine update mechanisms.

Additionally, the malware started communicating outwards with a distributed command-and-control infrastructure, thus allowing it to download additional payloads from a variety of different domains and IP addresses in order to increase its reach.

According to Morphisec, the final stage of the attack chain involved the deployment of a second executable, CONSCTLX.exe. This secondary executable acted as both a backdoor and a persistent downloader.

A malicious component that was designed to maintain long-term access created scheduled tasks with benign-sounding names like CorelDefrag that were designed to avoid casual inspection while ensuring that the task would execute across restarts as well.

The company MicroWorld Technologies developed a remediation utility in response to the incident that is specifically intended to identify and reverse unauthorized changes introduced by the malicious update. Using this tool, the company claims that normal update functionality is restored, a successful cleanup has been verified, and the process only requires a standard reboot of the computer to complete.

Several companies, including eScan and Morphisec, have advised customers to take additional network-level security measures to protect themselves from further malicious communications during the recovery phase of the campaign by blocking the command-and-control endpoints associated with it.

In addition, the incident has raised concerns about the recurring exploitation of antivirus update mechanisms, which have caused an increase in industry concern. There was an incident of North Korean threat actors exploiting eScan’s update process in 2024 to install backdoors inside corporate networks, illustrating again how security infrastructure remains one of the most attractive targets for state-sponsored attacks, particularly those aiming for high volumes of information.

As this breach unfolds, it is part of a wider pattern of consequential supply chain incidents that have taken place in early 2026. These incidents range from destructive malware targeting European energy systems to large-scale intellectual property theft coupled with soon-to-appear AI-driven assault tactics.

The events highlighted by these events also point to a persistent strategic reality in that organizations are increasingly dependent on trusted vendors and automated updates pipelines. If trust is compromised across the digital ecosystem, defensive technologies can become vectors of systemic risk as a result of a compromise in trust.

In an industry context, the incident is notable for the unusual method of delivery used by the perpetrators. In spite of the fact that software supply chain compromises have been a growing problem over the past few years, malware is still uncommonly deployed through the security product’s own update channel.

An analysis of the implants involved indicates that a significant amount of preparation has been performed and that the target environment is well known. A successful operation would have required attackers to have acquired access to eScan’s update infrastructure, reverse engineering aspects of its update workflow, and developing custom malware components designed specifically to function within that ecosystem in order to be successful.

Such prerequisites suggest a deliberate, resource-intensive effort rather than a purely opportunistic one. In addition, a technical examination of the implanted components revealed resilience features that were designed to ensure that attacker access would not be impeded under adverse conditions.

There were multiple fallback execution paths implemented in the malware, so that continuity would be maintained even if individual persistence mechanisms were disrupted. In one instance, the removal of a scheduled task used to launch a PowerShell payload was not sufficient to neutralize the infection, since the CONSCTLX.exe component would also be able to invoke the same functionality.

Furthermore, blocking the command-and-control infrastructure associated with the PowerShell stage did not completely eliminate an attacker's capabilities, as CONSCTLX.exe retained the ability to deliver shellcode directly to affected systems, as these design choices highlight the importance of operational redundancy, which is one of the hallmarks of well-planned intrusion campaigns.

In spite of the sophistication evident in the attack's preparation, the attack's impact was mitigated by its relatively short duration and the techniques used in order to prevent the attack from becoming too effective.

Modern operating systems have an elevated level of trust when it comes to security software, which means that attackers have theoretically the possibility to exploit more intrusive methods, including kernel-mode implants, which provide attackers with an opportunity to carry out more invasive attacks.

In this case, however, the attackers relied on user-mode components and commonly observed persistence mechanisms, such as scheduled tasks, which constrained the operation's stealth and contributed to its relatively quick detection and containment, according to analysts.

It is noteworthy that the behavioral indicators included in eScan's advisory closely correspond with those found by Morphisec independently. Both parties deemed the incident to have a medium-to-high impact on the enterprise environments in question. Additionally, this episode has revealed tensions between the disclosures made by vendors and researchers.

As reported by Bloomberg News, MicroWorld Technologies has publicly challenged parts of Morphisec's public reporting, claiming some of it was inaccurate. It is understood that they are seeking legal advice in response to these claims.

It was advised by eScan to conduct targeted checks to determine whether the systems were affected from an operational perspective, including reviewing schedule tasks for anomalous entries, inspecting the system HOSTS file for blocked eScan domains, and reviewing update logs from January 20 for irregularities.

A remediation utility has been released by the company and is available through its technical support channels. This utility is designed to remove malicious components, reverse unauthorized changes, and restore normal update functionality.

Consequently, customers are advised to block known command-and-control addresses associated with this campaign as a precaution, reinforcing the lesson of the incident: even highly trusted security infrastructure must continually be examined as potential attack surfaces in a rapidly changing threat environment.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Largest Ever 31.4 Tbps DDoS Attack Attributed to Aisuru Botnet

Cross-Platform Spyware Campaigns Target Indian Defense and Government Sectors

Emerging AI Built Malware Used in Targeted Attacks on Blockchain Engineers

Stanley Malware Service Bypasses Chrome Web Store Safeguards

China-Linked DKnife Threat Underscores Risks to Network Edge Devices

Attackers Exploit Revoked EnCase Driver to Disable Endpoint Security Using New EDR Killer Malware

AISURU/Kimwolf Botnet Behind Record 31.4 Tbps DDoS Attack, Cloudflare Reveals

Threat Actors Leverage Hugging Face to Spread Android Malware at Scale

China-Linked Hackers Step Up Quiet Spying Across South-East Asia

CrossCurve Bridge Hit by $3 Million Exploit after Smart Contract Flaw

Iran-Linked Hackers Target Human Rights Groups in Redkitten Malware Campaign

eScan Antivirus Faces Scrutiny After Compromised Update Distribution

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item