Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Palo Alto Networks Unit 42 hosts a product archive page for its Advanced DNS Security DNS-layer threat prevention service.
The page is a product category archive on the Unit 42 blog with no article text available. Advanced DNS Security is Palo Alto Networks' DNS-layer threat prevention offering. No research findings, incidents, or vulnerabilities are described.
Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.
Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.
Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.
Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.
Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.
Cisco Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that lets unauthenticated remote attackers execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3), which permits low-privileged logins and can be chained for privilege escalation. Talos identified three post-compromise clusters: UAT-12197 deploying JSP web shells and a JAR command executor for credential theft; UAT-11823, an APT overlapping with Sandworm, deploying a Netcat reverse shell and Cyclops Blink malware; and UAT-11988, assessed as a ransomware operator with TTPs consistent with Qilin affiliates. Hotfixes are available, with a comprehensive hardening release due the week of September 14, 2026.
Unit 42 tracked 19 newly released top-level domains and found large-scale phishing, unwanted program distribution, and cybersquatting tied to TLD launch dates.
Researchers analyzed 19 new generic TLDs, including .zip, .bot, .ing, and .meme, released or approaching general availability over roughly 18 months. Data from passive DNS, registry zone files, newly registered domain feeds, and the Tranco top-1M list showed phishing campaigns, potentially unwanted program distribution, and domain squatting on these TLDs. Abuse correlated with each TLD's rollout phases, indicating attackers monitor general availability dates to register and weaponize domains. The IANA root database now lists over 1,000 generic TLDs.
Akamai argues that unmanaged DNS over HTTPS (DoH) creates enterprise visibility gaps and advocates controlled DoH strategies to restore DNS monitoring.
Akamai published a blog post arguing that unmanaged DNS over HTTPS encrypts DNS queries outside enterprise visibility, creating security monitoring gaps. The post advocates a controlled DoH strategy that restores DNS visibility for defenders while preserving user privacy. No specific incidents, vulnerabilities, or products are cited in the advisory-style piece.
Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.
Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.
Six dnsmasq flaws enable DNS cache poisoning, DoS, memory leaks, and local root code execution; fixes ship in version 2.92rel2.
Researchers disclosed six dnsmasq vulnerabilities spanning memory safety and input validation, including heap buffer overflows in extract_name() and extract_addresses(), DNSSEC infinite-loop and out-of-bounds read flaws, and a DHCPv6 out-of-bounds write allowing local root code execution. Exploitation paths include DNS cache poisoning, bypassing security controls, remote denial of service, and local privilege escalation. Maintainers released version 2.92rel2 with fixes, and a stable 2.93 release is expected within weeks.
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.
An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.
Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.
Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.
Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.
The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.
Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.
Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.
Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.
cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
Cisco patched actively exploited high-severity flaw CVE-2026-20349 in ASA and FTD SSL VPN services, allowing unauthenticated remote denial-of-service attacks.
Cisco released a security advisory addressing CVE-2026-20349, a high-severity vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software. Successful exploitation by an unauthenticated remote attacker can cause affected devices to crash or reload, causing denial of service. The vulnerability is being exploited in the wild, and patches are available; organizations with internet-exposed ASA/FTD VPN endpoints should prioritize updating.
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.
Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
Since March 2023, Unit 42 has tracked threat actors exploiting more than 20 IoT vulnerabilities to spread a Mirai botnet variant, first seen downloading payloads from zvub.us on March 14, 2023. Exploited flaws span CVE-2023-1389 (TP-Link Archer), CVE-2022-30525 (Zyxel), CVE-2022-31499 (Nortek) and many router, camera and DVR bugs. The variant decrypts configuration strings with an XOR key derived from 0xDEADBEEF and lacks built-in credential brute forcing, so spreading relies on manual operator exploitation. Two campaigns observed since October 2022 share infrastructure and near-identical samples.
Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.
The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.
The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.
Cloudflare's 1.1.1.1 resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a 2,420-byte NIST algorithm, preparing DNS for post-quantum migration by 2029.
Cloudflare enabled 1.1.1.1 to validate DNSSEC signatures using ML-DSA-44 (algorithm 18), a NIST-standardized post-quantum signature with 1,312-byte public keys and 2,420-byte signatures, roughly 38x larger than ECDSA P-256. The large signatures exceed common DNS-over-UDP limits, forcing fallback to TCP and creating downgrade risks while conventional algorithms must be published alongside. Cloudflare cites the risk of a quantum computer breaking RSA/ECDSA signatures by 2030 and plans full post-quantum security by 2029.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
CISA adds three actively exploited flaws—Cisco ASA/FTD DoS, Windows Winsock SYSTEM-level UAF, and Metabase SQL injection—to its Known Exploited Vulnerabilities catalog.
CISA added CVE-2026-20349 (CVSS 8.6, heap inspection flaw crashing Cisco ASA/FTD via crafted HTTP requests to the Remote Access SSL VPN service), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows afd.sys Winsock driver allowing SYSTEM-privilege code execution, actively exploited per Microsoft) and CVE-2026-72898 (CVSS 10.0, unauthenticated SQL injection in Metabase) to the KEV catalog. Metabase disclosed its cloud service was attacked with the 0-day, giving the intruder a path to administrator rights and stored credentials for connected databases; cloud instances were patched while self-hosted deployments need urgent updates. Under BOD 22-01, federal civilian agencies must patch by August 14, 2026, except CVE-2026-68820, due August 25.
Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.
Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.
xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.
Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.
ZDI disclosed an unauthenticated infinite-loop denial-of-service flaw (CVE-2026-4890) in dnsmasq DNSSEC NSEC/NSEC3 bitmap processing.
The Zero Day Initiative published ZDI-26-584 describing an infinite loop in dnsmasq's processing of DNSSEC NSEC/NSEC3 type bitmaps. Remote unauthenticated attackers can trigger a denial-of-service condition on affected installations. ZDI assigned a CVSS score of 7.5 and the identifier CVE-2026-4890.
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.
Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.
cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.
Cisco patched an unauthenticated remote DoS in ASA and FTD Remote Access SSL VPN that reloads devices via crafted HTTP requests.
Cisco disclosed a denial-of-service vulnerability in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. Insufficient error checking when processing HTTP requests allows an unauthenticated, remote attacker to send a crafted HTTP request that causes the affected device to reload. Cisco has released software updates addressing the flaw.
Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.
Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.
Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.
Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.
Akamai Blog