55
60
55
55
55
60
55
55
55
60
55
55
60
60
55
60
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.
50
55
60
57
30
60
Iranian APTs increased activity against US industries in late spring, researchers say
Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.
Nozomi Networks telemetry showed 28 Iran-linked attacks against customers in May and June versus 12 in the prior two months, a 133% increase focused on transportation and manufacturing. MuddyWater was the most active group, targeting at least five US companies, followed by APT33 with at least three; OilRig, CyberAv3ngers, FoxKitten and Homeland Justice were also active. In a separate report, Morphisec said Fox Kitten is recruiting ransomware affiliates with an 80% share of proceeds for attacks against Iran's adversaries, including the US and Israel. The activity comes amid heightened concerns over Iranian cyber retaliation after US strikes on Iranian nuclear facilities.
66
60
55
55
30
42
55
60
30
55
55
60
55
60
60
30
30
55