Organization

Nozomi Networks

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 11, 2026 · last 36m ago

Timeline2 articles

Nozomi Compass helps industrial teams manage OT assets and vulnerabilitiesnew

Nozomi Networks launched Compass, an OT asset and vulnerability management platform unifying asset records, remediation workflows, and compliance evidence for industrial teams.

Nozomi Networks announced Compass, an OT asset and service management platform built on real-time first-party asset data from its Vantage cyber-physical security platform. It provides OT-native workflows, governed change approvals, consequence-based risk scoring, and continuous audit-ready compliance evidence mapped to NERC CIP, IEC 62443, NIS2, and TSA. The platform integrates with EAM, CMDB, ITAM, ITSM, SIEM, and SOAR tools and is designed to safely support AI-driven and agentic OT workflows with human oversight.

Help Net Security10:27 UTC · 36m agoTools

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks

Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.

Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.

Cyber Security NewsSep 11, 14:17 UTC · 4d agoMalware in the wild 2 sources CVE-2026-46300 CVE-2026-43284 CVE-2026-31431

Related CVEsby mentions

CVE-2026-314317.8100%
Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
· Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass
CVE-2026-432848.893%
Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred.
· Linux kernelmass
CVE-2026-463007.89%
In the Linux kernel, the following vulnerability has been resolved:
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags…
· linux linux kernel—

Appears with

vendor Nozomi Networks 2 malware Mirai 1 product BusyBox 1 malware KATARU 1 product OpenWrt 1 product Vantage 1 product Nozomi Compass 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.