#botnet

6 articles

The botnet's command channel is the protocol that exists to tell a machine its own public address, and nobody can block it

2026-10-07Security

Cling takes routers and DVRs through vulnerabilities going back to 2014, then talks to its operator over STUN — the NAT-traversal service every video call depends on. Its traffic looks like a device keeping a connection alive, because that is literally what the packets are. It is the third campaign this fortnight to put its command channel somewhere undeletable.

Police used Sality's own peer list against it. The 15,000 machines are still infected

2026-09-02Security

Sality trusted any peer that spoke its protocol, so investigators became its peers and substituted sinkholes for the real ones. The operator is reportedly still in Bashkortostan, no arrests are reported, and the malware sitting on every one of those machines is exactly where it was on Sunday.

The malware reaches the car through the update channel the car trusts

2026-08-22Gadgets

Kaspersky found previously unknown malware on Android head units running DoFun, delivered through the legitimate update mechanism of a system app over an MQTT broker. It checks in every 90 minutes, runs ad fraud, and is attributed with high confidence to the group behind the BADBOX botnet.

The camera-hacking crew left 407 MB of their own working directory on the internet, shell history included

2026-08-20Gadgets

Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.

The botnet does not want your router for a DDoS — it wants to sell your address as a residential proxy

2026-08-18Security

Fortinet has tracked Evooo1Bot since July 2026 across Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link gateways. It picks one of twelve builds to match your CPU, clears Bash history, and turns the device into a SOCKS5 node.

This botnet's DDoS traffic looks like Chrome because it builds a complete browser fingerprint

2026-08-13Gadgets

Unit 42's analysis of Kimwolf v7 describes HTTP/2 floods that mirror real browser behaviour at the protocol and header level. It runs on Android TV boxes with port 5555 open, and resolves its C2 through Ethereum Name Service.