30
35
30
30
35
30
30
30
30
SloppyRAT: A New Tool For Ransomware Attacks
Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.
Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.
48
35
45
30
30
30
45
30
30
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.
50
30
45
30
30
30
45
30
45
30
30
30
30
30
30
30
Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras
One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.
Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.
55
30
30
35
30
30