Nozomi Networks

Search everything

Mentions · 7d1
Mentions · 30d8
All mentions10
First seenSep 11, 2026
Last mentioned1d ago

Timeline

10 articles · newest first

Kairos botnet infects Linux hosts through passwordless Telnet

Nozomi honeypots saw the same Go binary, which holds thousands of TCP sockets open during each attack.

Cyber Security NewsOct 30, 13:22 UTC · 1d agoMalware 2 sources1

Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security

Anthropic launched unreviewed AI vulnerability reports for OSS maintainers and an OT security program with 11 firms.

SecurityWeekOct 9, 08:19 UTC · 22d agoAI industry4 · 1 read

Anthropic Cyber Mission to Support Defenders with Tools, Research, and Resources

Anthropic launched a Cyber Mission pairing Claude, engineers, and partners to defend critical infrastructure and open-source projects.

Cyber Security NewsOct 9, 03:11 UTC · 22d agoAI industry4 · 3 reads

Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software

Anthropic launched a program pairing Claude with security firms to find and fix flaws in critical infrastructure and open-source software.

CyberScoopOct 8, 21:32 UTC · 22d agoAI industry2 · 1 read

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.

GBHackersOct 6, 11:15 UTC · 25d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+56 · 3 reads

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.

The Hacker NewsOct 5, 11:46 UTC · 26d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2016-10372+510 · 2 reads

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.

Cyber Security NewsOct 5, 07:43 UTC · 26d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+58 · 3 reads

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.

GBHackersOct 3, 07:48 UTC · 28d agoMalwareExploitedCVE-2021-3539410 · 3 reads

Nozomi Compass helps industrial teams manage OT assets and vulnerabilities

Nozomi Networks launched Compass, an OT asset and vulnerability management platform unifying asset records, remediation workflows, and compliance evidence for industrial teams.

Help Net SecuritySep 16, 10:27 UTC · Sep 16, 2026Tools2 · 1 read

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks

Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.

Cyber Security NewsSep 11, 14:17 UTC · Sep 11, 2026MalwareExploitedCVE-2026-46300 CVE-2026-43284 CVE-2026-314313 · 1 read

Related CVEs

by mentions

CVE-2021-35394100%9.8
Remote Code Execution via Memory Corruption in Realtek Jungle SDK
published Aug 16, 2021Realtek Jungle Software Development Kit (SDK)KEVPoC
CVE-2014-8361100%—
Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
published —Realtek SDKKEV
CVE-2025-3403791%10.0
Unauthenticated OS Command Injection in Linksys E-Series Routers
published Jun 24, 2025Linksys E-Series routers (various models; vulnerable /tmUnblock.cgi and /hndUnblock.cgi CGI endpoints over HTTP on port 8080)
CVE-2023-2680178%9.8
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
published Mar 26, 2023lb-link bl-lte300 firmwarePoC
CVE-2016-1037282%9.8
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as…
published May 16, 2017eir d1000 modem firmwarePoC ×2
CVE-2023-410113%9.8
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary…
published Sep 14, 2023chinamobile intelligent home gateway firmwarePoC
CVE-2016-2001686%9.8
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI
published Oct 19, 2022mvpower tv-7104he firmwarePoC ×2
CVE-2024-372186%6.3
TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the…
published Apr 13, 2024
CVE-2026-3143198%7.8
Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
published Apr 22, 2026Linux kernel (algif_aead / AF_ALG crypto interface)KEVPoC ×12
CVE-2026-4328494%8.8
Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
published May 8, 2026Linux kernelPoC

Appears with

Realtekvendor · 4
Clingmalware · 4
LB-LINKvendor · 3
Palo Alto Networksorganization · 3
Hitachiorganization · 3
Anthropicvendor · 3
PwCorganization · 3
Claudeai model · 3
Booz Allenorganization · 3
Insane Cyberorganization · 3
FiberHomevendor · 3
Realtek Jungle SDKproduct · 3
Nozomi Networksvendor · 3
Claudeproduct · 3
Linksysvendor · 3
Dragosorganization · 3

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.