ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “eHorus”

28 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 3Data breach 1Exploit / PoC 1Vulnerability 1
SeverityAllcritical 3high 3medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated · 5d agofirst · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

More than 200 victims of Medusa ransomware identified over the last year, CISA says

CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.

CISA and the FBI updated their March 2025 advisory, stating Medusa actors had hit more than 500 victims as of April 2026, up from 300 in 2025, with a focus on healthcare and critical infrastructure. The agencies say Medusa rapidly adopts newly announced exploits, sometimes using them up to a week before public vulnerability disclosure, but does not develop its own zero-days, preferring access obtained from unknown sources. The gang moved to an affiliate model in 2023, offers up to $1 million for exclusive initial access brokers, and uses credential stealers plus legitimate remote access tools including AnyDesk, Atera, ConnectWise and Splashtop. No new victims have appeared on its leak site since April, after the shutdown of the University of Mississippi Medical Center drew significant law enforcement attention.

The Record · 29d agoRansomware in the wild1

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.

Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2011-0611

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security Affairs · Aug 12, 2026Malware in the wild

Introducing OlmoEarth embeddings: Custom embedding exports from OlmoEarth Studio for downstream analysis

AllenAI's OlmoEarth Studio adds custom embedding exports to support downstream geospatial analysis workflows.

A Hugging Face blog post from AllenAI introduces OlmoEarth embeddings, a feature allowing custom embedding exports from OlmoEarth Studio for downstream analysis tasks. Only the title was available, so no benchmark or performance details are provided. OlmoEarth is Ai2's open geospatial AI model family.

Hugging Face Blog · Aug 12, 2026AI tools & infra

Kimwolf v7: An Evolution of the Kimwolf Botnet

Unit 42 details Kimwolf v7 botnet evolution hitting Android IoT devices with HTTP/2 DDoS fingerprinting and ENS-based C2.

Palo Alto Unit 42 analyzes Kimwolf v7, the latest evolution of the Kimwolf botnet targeting Android-based IoT devices. The variant introduces HTTP/2 DDoS fingerprinting, Ethereum ENS-based C2 resolution, and Tor backup routing for operational resilience.

Palo Alto Unit 42 · Aug 11, 2026Malware in the wild

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 5d agoResearch

EITest Campaign Evolution: From Angler EK to Neutrino and Rig

Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.

Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory

Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.

Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.

Help Net Security · 7d agoMalware in the wildCVE-2025-535211

IT help-desk vishing tricks executives into handing over Microsoft 365 access

Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.

Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.

Help Net Security · 8d agoThreat actor in the wild1

MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.

Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.

Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.

BleepingComputer · 9d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-86060CVE-2026-67277

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2025-32433

ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.

ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.

ZDI Published Advisories · 23d agoVulnerability

12 Best Browser Isolation Solutions Compared (2026): Features & Pricing

2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.

Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.

GBHackers · 1d agoTools

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm Center · 6d agoMalware in the wild1

What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree

Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.

In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.

Help Net Security · 16d agoIndustry

Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users

The 'Spring Ring' operation uses vishing attacks against Microsoft Teams users to hijack sessions, deploy malware, and take over infrastructure.

Dark Reading reports on the Spring Ring threat gang conducting voice-phishing (vishing) attacks against users of Microsoft Teams. The operation aims to compromise collaboration-suite accounts to gain remote access to victim sessions, distribute malware, and potentially seize control of infrastructure. Further technical details were not provided in the available text.

Dark Reading · 14d agoPhishing & fraud1

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.

Volexity attributes a September 1, 2026 spear-phishing campaign targeting NGOs to China-linked UTA0560, which abused a reflected XSS flaw on a US university website to trigger a three-part exploit chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) escaping the Chrome V8 and browser sandboxes to deploy the GRIMWEDGE JavaScript backdoor with reconnaissance, file management, and command execution capabilities. The same chain was used near-simultaneously by JungleBamboo (APT31) to deploy SUPERSTOMP, installing the LONGTALE/GemStone credential-stealing Chrome extension masquerading as Google Gemini. The Chrome flaws were patched in Chromium but not yet in stable Chrome, creating an unusual patch-gap zero-day window attackers raced to exploit.

The Hacker Newsupdated · 6h agofirst · 1d agoThreat actor in the wild 14 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858801· 1 read

Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

Cyberattack on Ceva Logistics disrupted eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ajax and exposing Steam hardware buyers' data.

A cyberattack on Ceva Logistics disrupted operations at eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ace & Tate, Ajax and Steam hardware customers. Attackers accessed two Ceva systems processing Bol orders, potentially exposing names, addresses, phone numbers, email addresses and order details. Valve began notifying European Steam customers whose hardware shipping data may have been compromised and is contacting data protection authorities. Ceva, with about 110,000 employees and over 1,700 facilities, has not disclosed the attackers or whether ransomware was involved.

The Record · Aug 11, 2026Data breach in the wild

Stack buffer overflow in WAD

FortiOS explicit proxy WAD daemon stack buffer overflow (CVSS 5.1) allows code execution only with Kerberos and SOCKS configured.

Fortinet advisory FG-IR-26-161 describes a stack-based buffer overflow (CWE-121) in the WAD daemon of FortiOS explicit proxy, scored CVSSv3 5.1. Exploitation requires an attacker able to bypass stack protection and ASLR, and the explicit proxy must be configured with Kerberos authentication and SOCKS enabled. If successful, it yields arbitrary code or command execution in the WAD daemon context via crafted sockets. No exploitation is reported in the advisory.

Fortinet PSIRT · Aug 12, 2026Advisory

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz · Aug 10, 2026Malware

Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks

Sophos found Luciferus, an uncensored AI subscription service likely built on Qwen, sold on the Exploit forum and capable of generating working malware code.

Sophos Counter Threat Unit found an ad for 'Luciferus' posted August 24 on the Exploit forum by a persona named 'Optimus_Prime', claiming a proprietary 120-billion-parameter model that answers requests without ethical restrictions. Sophos assesses with low confidence it is based on Alibaba's open-source Qwen family. Forum tiers cost $35-$75/month, while the website lists Junior/Middle/Pro tiers at $22-$47.14; a test prompt on the Junior tier returned Python remote access trojan source code. Sophos warns such services lower barriers for less skilled cybercriminals and outlast jailbroken mainstream LLMs.

Help Net Security · 1d agoAI safety & security

Armored Likho expands its cyber-espionage toolkit

Kaspersky reports the Armored Likho espionage group now delivers its new Still Toolkit via fundraising-themed lures to steal Telegram data and eavesdrop on victims.

Kaspersky researchers describe a new campaign by the Armored Likho espionage actor. The campaign masquerades as fundraising efforts and delivers a newly developed Still Toolkit designed to steal Telegram data and eavesdrop on victims. The update expands the group's toolkit and continues its espionage-focused targeting.

Kaspersky Securelist · Aug 13, 2026Threat actor in the wild

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.

A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.

Full Disclosure · 12d agoVulnerability

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.

The study compares five publicly available ReDoS detection tools and one regex correction tool across three datasets. An empirical analysis of all ReDoS vulnerabilities reported to the NVD finds they are becoming more prevalent and are much more likely to be exploited than non-ReDoS weaknesses. The detection tools exhibited substantial disagreement on whether a given regex is vulnerable.

arXiv cs.CR · 7d agoResearch

Decline in Rig Exploit Kit

Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.

Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wild1

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackers · 17h agoMalware in the wild 2 sources