botnet news
7 stories
Malware Hijacks Android Car Head Units
Cybersecurity researchers have uncovered a new Android malware variant that leverages legitimate firmware update mechanisms in car head units to establish a proxy botnet. The malware, dubbed BADBOX by researchers, was first identified in June 2026 and represents the first documented instance of malware specifically targeting automotive infotainment systems through their native update channels.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A novel malware family has been identified that specifically targets Android-based car head units, utilizing their built-in firmware update mechanisms for propagation. This sophisticated threat, reportedly linked to the MoYu Group, is designed to engage in ad fraud and to establish a proxy botnet. This marks a significant development as it is described as the first documented instance of…
Operation CameraSwarm Compromised 14,000+ Dahua Cameras
An exposed operator directory has revealed details of "Operation CameraSwarm," an attack that compromised over 14,000 Dahua cameras, primarily in Ukraine and Russia, between June 17 and July 22, 2026. The operation was reconstructed by Hunt.io researchers after their AttackCapture system discovered an open HTTP directory on a server at 154.86[.]119.60 on July 23, exposing 407 MB of the…
Security Affairs newsletter Round 586 by Pierluigi Paganini – INTERNATIONAL EDITION
SonicWall has issued a warning regarding the active exploitation of two zero-day vulnerabilities affecting its SMA 1000 series products. The company did not immediately disclose specific details about the nature of these vulnerabilities or the extent of the observed exploitation.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
A new botnet, named NadMesh, has been observed actively targeting exposed artificial intelligence (AI) services to steal cloud credentials. Written in Go, NadMesh is specifically designed to operate within cloud environments, focusing its efforts on acquiring AWS keys and Kubernetes tokens from vulnerable AI platforms.
Fake 7-Zip Installers Hijack Devices for Proxy Network
A sophisticated operation has been discovered that utilizes fake software installers, specifically those mimicking the popular 7-Zip file archiver, to compromise user devices and enlist them into a large-scale proxy network. This campaign, attributed to a threat group identified as Lurking Lizard, has been active since at least August 2022 and has reportedly ensnared over 230,000 devices.
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
FortiGuard Labs has identified a new variant of the Gafgyt botnet, dubbed C0XMO, which exhibits cross-platform propagation capabilities by exploiting a vulnerability in DD-WRT router firmware. The malware, discovered in March, utilizes CVE-2021-27137 to gain initial access. A notable characteristic of C0XMO is its separation of lateral movement functions into a distinct Python script, allowing…