Threats Tagged 'devops'

A newly discovered Windows stealer and remote access trojan called Dolphin X targets over 300 applications including browsers, cryptocurrency wallets, password managers, and cloud command-line tools. The malware collects credentials ranging from browser logins to SSH keys, .env files, and cloud tokens. A distinctive feature called the AI Profiler automatically scores infected victims based on application usage, browsing activity, and installed software, helping attackers identify high-value targets through daily summaries. The malware builder operates through a remote server that compiles agents and offers optional mutation engines to evade detection. Advertised by a vendor using the alias Kontraktnik, Dolphin X poses significant risk to developers and organizations by potentially exposing access to entire production environments through compromised DevOps credentials.

A global hacking campaign dubbed ShadowRay 2.0 has been discovered, exploiting a vulnerability in the Ray AI framework to seize control of computing clusters and create a self-replicating botnet. The attackers use GitLab and GitHub for payload delivery, leveraging AI-generated code to adapt their methods. The campaign has evolved from simple cryptojacking to a sophisticated multi-purpose botnet capable of DDoS attacks and data exfiltration. The operation targets exposed Ray clusters worldwide, utilizing DevOps-style infrastructure for real-time malware updates. This campaign highlights the growing attack surface in AI workloads and the risks associated with disputed vulnerabilities.

MediumMalwareGermanyFranceUnited Kingdom+5#devops#ai infrastructure#self-propagation

This report provides an in-depth analysis of VexTrio's traffic distribution system (TDS) infrastructure. It reveals their use of resilient, fault-tolerant systems spread across multiple hosting providers and data centers. Key components include DevOps tools like Terraform and Kubernetes, tracking software such as Binom, and cloaking capabilities. The analysis exposes VexTrio's reliance on content delivery networks (CDNs) as potential vulnerabilities. Their CDN domains rank among the top 10,000 most popular websites globally, highlighting the massive scale of their operations. The research aims to shed light on the inner workings of malicious adtech networks to spur further investigation into the industry.

MediumCampaignGermanyUnited KingdomFrance+2#binom#devops#content delivery network