botnet
Malware Hijacks Android Car Head Units
Researchers have identified new Android malware that hijacks car head units by exploiting their official update mechanisms. The malware installs proxy software, turning vehicles into nodes for the BADBOX botnet, primarily for ad fraud and to provide anonymized internet connections. This marks the first documented instance of malware specifically targeting car head units through their native update channels.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A new malware family targeting Android-based car head units has been discovered, exploiting built-in firmware updaters for distribution. This malware, attributed to the MoYu Group, aims to facilitate ad fraud and establish a proxy botnet. Researchers noted this is the first documented case of malware specifically designed for car head units with a tailored infection chain.
Operation CameraSwarm Compromised 14,000+ Dahua Cameras
An exposed operator directory has revealed details of 'Operation CameraSwarm,' a campaign that compromised over 14,000 Dahua cameras, primarily in Ukraine and Russia. The attacker exploited vulnerabilities, including an authentication bypass, and in some cases, leveraged Dahua's cloud relay using only the camera's serial number. The compromised data provided researchers with the attacker's tools, including scanning engines and exploit chains.
Security Affairs newsletter Round 586 by Pierluigi Paganini – INTERNATIONAL EDITION
The latest Security Affairs newsletter covers a range of global cybersecurity incidents and trends. Key topics include ransomware extortion, significant cyberattacks on major companies like Odido and a Japanese taxi operator, and the compromise of the AsyncAPI npm organization. The newsletter also highlights new malware strains, exploitation campaigns targeting CMS, and state-sponsored cyber activities from Russia, China, and North Korea.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
A newly identified botnet written in Go, dubbed NadMesh, is actively scanning for and exploiting exposed AI services. The botnet specifically targets cloud environments, seeking to steal AWS keys and Kubernetes tokens from vulnerable AI platforms. Researchers have observed it scanning for services like ComfyUI and Ollama, which are often deployed without adequate security measures.
Fake 7-Zip Installers Hijack Devices for Proxy Network
A threat group known as Lurking Lizard has established a large-scale residential proxy network using over 230 fake domains. This operation, active since at least August 2022, leverages compromised devices, including those infected via fake 7-Zip installers, to route traffic for malicious purposes.
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
A new variant of the Gafgyt malware, named C0XMO, has been identified. This variant is notable for its ability to exploit DD-WRT firmware and spread across multiple processor architectures, thereby increasing the reach of its Internet of Things botnet.