Google dismantled the XCPE botnet, which infected over 1.3 million Android devices, primarily Android TV set-top boxes, but also other IoT devices. The botnet was created and operated by Videostrong Technology, an Android OEM/ODM, for financial gain through ad fraud, data exfiltration, and use as residential proxies. The malware was pre-installed on devices, evading Google's security tests via obfuscation and persisted through a multi-stage architecture. Google took legal action to seize the botnet's infrastructure, disrupting operations and severing access to millions of devices. Videostrong was banned from preloading Google apps due to this deliberate malicious activity.
A botnet named XCPE, composed of over 1.3 million Android TV set-top boxes infected with malware, was dismantled by Google and industry partners. The malware covertly rented out users' Internet connections as residential proxies for criminal activities such as advertising fraud and account takeover. The botnet also infected other Android-based IoT devices including healthcare devices and karaoke machines. The malware was intentionally pre-installed by the manufacturer Videostrong Technology Co., which Google has legally acted against. The takedown is expected to disrupt access to over 10 million additional compromised devices. Several residential proxy providers were implicated in the operation of this botnet. Google has since addressed the security weaknesses exploited by Videostrong.
The XCPE botnet was a large-scale malware operation involving over 1.3 million set-top boxes infected with a backdoor developed and operated by Videostrong Technology Co., an Android device manufacturer. The backdoor enabled criminal affiliates to conduct ad-fraud, create residential proxy networks, and install additional malware. The botnet infrastructure spanned multiple years and device models. Google and industry partners dismantled the botnet, banned Videostrong from Android certification, and improved firmware integrity reviews for Android TV devices to prevent recurrence.
PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.
Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, such as Android TV boxes and smart ovens, potentially creating distributed botnets capable of running AI workloads without centralized data centers. Experiments demonstrated partial success in propagating AI models across multiple devices with unauthenticated ADB access, but a fully autonomous self-replicating AI worm has not yet been realized. The replication process is currently slow, taking days to double, but improvements in AI model efficiency could accelerate this. Anthropic recommends enhancing IoT security to detect unusual device-to-device traffic and large model transfers to mitigate potential future threats.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
This report summarizes multiple cybersecurity incidents and emerging threats including AI-assisted bank breaches in South Korea, a poem-guided botnet called PoeLLM targeting AI and open-source services, a supply chain attack on the Tensorlake npm SDK, and the sentencing of the Empire Market co-founder. The PoeLLM malware uses a novel method of hiding its command-and-control server IP address encoded in a GitHub-hosted poem. The Tensorlake npm SDK was compromised to deliver a credential-stealing worm. Nvidia's DCGM Exporter had a high-severity denial-of-service vulnerability that has been patched. The South Korean bank breaches are under investigation with AI suspected to be involved. The Empire Market co-founder received a 40-year prison sentence for running a dark web marketplace. These events highlight evolving attack techniques and ongoing law enforcement actions.
Since April 2026, the PoeLLM malware campaign has targeted exposed AI/LLM and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. It uses a novel command-and-control method where infected systems extract C2 server addresses from keywords embedded in a poem on GitHub. The malware deploys cryptocurrency miners (XMRig and Iron) connecting victims to Kryptex mining infrastructure. Compromised hosts are also used as scanners and exploit servers to grow the botnet, which has affected over 3,400 servers with up to 800 active daily. The campaign is linked to an Italian-speaking threat actor and mainly impacts victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.
XWorm is a modular malware associated with the DDGroup cybercrime group. It uses multiple delivery methods such as phishing emails, drive-by downloads, exploit kits, USB drives, and RDP exploitation. The malware enables remote access, data theft including passwords and credit card information, ransomware deployment, spyware installation, and can cause system crashes and denial-of-service attacks. Its modular design and diverse attack vectors make it a persistent and multifaceted threat requiring continuous cybersecurity vigilance.
Multiple cheap Android projectors using the Allwinner H713 chipset, sold under various brand names, come pre-installed with a multi-stage malware ecosystem. This malware includes a command-and-control (C2) loader that deploys modular plugins for residential proxy networks, ad-fraud, and botnet activities. The malware has root backdoors and can execute arbitrary code with system privileges. It exfiltrates device identifiers to servers in China and supports geo-fenced malicious activities. The infection chain involves four stages: StoreOS dropper, SilentSDK, PluginManager, and final plugins. Network-level blocking and disabling malicious apps via ADB are recommended mitigations.
The x47.c Windows botnet is a malware campaign that uses AI, specifically xAI Grok, to maintain persistence on infected systems. It offers capabilities including DDoS attacks, credential theft, SOCKS5 proxying, and an AI API draining attack that exhausts victims' paid AI service credits. The botnet is controlled via a command-and-control panel with multiple attack methods and fast-flux domain configurations to evade takedown. It includes modules for persistence, privilege escalation, rootkit-based removal of rival malware, and credential harvesting from browsers and other applications.
This report summarizes multiple cybersecurity incidents and emerging threats including the takeover of the Clop ransomware gang's leak site by the ShinyHunters group, the BragJack vulnerability that allows malicious browser extensions to hijack AI assistants, a new Go implant malware targeting AI agent tooling, and a Docker botnet that steals AI API keys. Additionally, it covers exposed remote access credentials in the US water utility sector, a novel Windows implant using commercial AI models for command decisions, and a high-severity pre-authentication denial-of-service vulnerability in TDengine industrial telemetry software. The report also notes Canonical's changes to Ubuntu kernel update cycles to accelerate patching and the discovery of a new Android banking trojan with AI-assisted development. These events highlight evolving attack methods leveraging AI and targeting critical infrastructure and cloud-native environments.
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]
CARBONATO is a Docker botnet discovered by ThreatDown researchers that targets exposed Docker daemons on port 2375. It operates by distributing trojanized cryptocurrency wallet applications and running a botnet infrastructure. The botnet uses a modified Hermes Agent, an open-source AI framework, to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers and has been active from October 2024 through August 2026. No CVE identifiers or official patches are associated with this threat. The severity is medium due to credential theft and botnet control capabilities.
A Redis cryptomining botnet compromised 3,562 Redis servers by exploiting unsecured no-auth configurations. The botnet operator's own files were exposed in an open directory, revealing the full toolkit and detailed campaign logs. The attack leveraged rogue replication commands to deploy a cron job that runs the XMRig miner, targeting Monero mining pools. The issue is due to missing authentication and insecure default configurations, not a software vulnerability. The affected Redis versions range from 2.8.17 to 7.2.0. Mitigation involves configuring Redis securely by enabling authentication and disabling replication features if unused.
A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.
The Sality peer-to-peer (P2P) botnet, active for 23 years since 2003, has been disrupted through an international law enforcement operation. Sality spread via file infection and did not use centralized command-and-control servers, relying instead on a P2P network of infected machines. The disruption exploited the botnet's trust in peer lists by manipulating these lists to isolate infected machines and sinkhole their communications. Law enforcement also took down URLs hosting Sality payloads, preventing new infections. The Shadowserver Foundation is assisting with identifying and cleaning infected machines. This operation effectively cut off the botnet's criminal operators from controlling infected hosts.
International law enforcement agencies and private partners have dismantled the Sality botnet infrastructure in a coordinated global takedown. Sality is a peer-to-peer (P2P) botnet active since at least 2003, infecting over 15,000 devices worldwide. The botnet was primarily used to distribute various malware families, with the recent primary payload being EggJagger, a clipjacking malware targeting cryptocurrency wallets. The takedown involved seizing Sality-linked domains and sinkholing the botnet's P2P control channels, effectively disrupting its operations and isolating infected machines. The botnet was controlled by a criminal group tracked as SALTY SPIDER, likely based in the Republic of Bashkortostan, Russia. This operation marks the end of Sality's control by its operators after more than two decades of activity.
A misconfigured open directory on IP address 86.53.111[.]212:8080 exposed critical details of an active cybercrime operation, including Moobot botnet source code, denial of service tools with attack records, and a fraudulent Chinese identity verification service. The exposed directory also contained StresD Pro+, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the collection date. The recovered Moobot source code revealed a previously unknown dormant download-and-execute functionality that represents the most plausible mechanism behind APT28's repurposing of Moobot for deploying malware to compromised devices. Despite a 2024 court-authorized disruption by the U.S. Department of Justice, Moobot remains active as of August 2026, with one active C2 server observed conducting over 500 short-duration attacks throughout the month, consistent with DDoS-as-a-service operations.
Researchers at Kaspersky have identified the first malware specifically designed to target car head units, linking it to the BadBox botnet. The malware was found on an Android-based aftermarket infotainment system from the Chinese company DoFun, widely used in China and other APAC countries. Attackers exploited a vulnerability in the system's software update mechanism to deliver malicious Android applications that act as droppers, loaders, clickers, and reverse-proxy loaders. The malware supports multiple commands, primarily used to download a reverse proxy module, indicating its main purpose is to incorporate infected devices into a proxy botnet. The vendor has addressed the vulnerability after notification. The BadBox botnet has been active since at least 2023, primarily targeting Android devices such as TV boxes, and has grown to include millions of devices. This development shows an expansion of BadBox operators' delivery methods and targets to vehicle infotainment systems.
