Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
Stories per day · 30 days
1 RSS
6 stories, newest first · one card per story
Stories tagged #github-c2
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Unit 42 attributes the Blinder Tunnel campaign to Iranian state-aligned CL-STA-1178, which impersonated Dubai Airports IT to hit Iraqi critical infrastructure.
11
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Zscaler attributes Operation RapidRust to Pakistan-aligned APT36, targeting Indian and Afghan government and defense entities with new Rust malware and GitHub-based C2.
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.