Search: “Open WebUI”

5 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 8 Malware 7 Threat actor 4 Exploit / PoC 2 Ransomware 1 Research 1 Policy & legal 1 AI safety & security 1 Phishing & fraud 1 Model release 1

SeverityAll critical 9 high 9 medium 5 low 1 info 3

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Malware in the wildCVE-2024-36401

New GobRAT Remote Access Trojan Targeting Linux Routers in Japan

The Hacker NewsMay 29, 09:50 UTC · May 29, 2023Malware

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42Aug 19, 12:04 UTC · 27d agoMalware in the wild

OWASP Nettacker: Open-source scanner for recon and vulnerability assessment

Help Net SecurityJun 11, 00:00 UTC · Jun 11, 2025Vulnerability

Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step

Help Net SecurityMar 31, 00:00 UTC · Mar 31, 2026Threat actor