Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Go-based Linux botnet named PumaBot has been identified targeting IoT devices, particularly surveillance systems. It brute-forces SSH credentials using lists from a C2 server, then deploys itself and establishes persistence. The malware disguises itself as legitimate system files, creates systemd services, and adds SSH keys for backdoor access. It also includes components for credential theft and system monitoring. The botnet demonstrates sophisticated evasion techniques and aims for long-term access to compromised devices.

PumaBot is a newly identified Linux-based botnet written in Go, specifically targeting Internet of Things (IoT) devices, with a focus on surveillance systems. The botnet operates by brute-forcing SSH credentials using credential lists obtained from a command and control (C2) server. Once access is gained, PumaBot deploys itself onto the compromised device and establishes persistence by masquerading as legitimate system files and creating systemd services. It also adds SSH keys to maintain backdoor access, allowing the attacker to regain control even after reboots or attempts to remove the malware. PumaBot includes modules for credential theft and system monitoring, indicating its intent to harvest sensitive information and maintain long-term surveillance of infected devices. The malware employs sophisticated evasion techniques to avoid detection, including disguising its files and processes. The botnet’s tactics align with multiple MITRE ATT&CK techniques such as T1021.004 (SSH Remote Services), T1082 (System Information Discovery), T1205 (Traffic Signaling), T1562.004 (Impair Defenses: Disable or Modify Tools), and others related to persistence, credential access, and lateral movement. Although no known exploits are currently reported in the wild, the botnet’s ability to brute-force SSH credentials and establish persistent backdoors poses a significant threat to IoT surveillance devices, which often have weak security configurations. The use of Go language enhances cross-platform capabilities and complicates reverse engineering efforts. PumaBot’s focus on surveillance devices is particularly concerning as these devices often handle sensitive video feeds and are integral to physical security infrastructures.

Detailed information about PumaBot: Novel Botnet Targeting IoT Surveillance Devices. Get real-time updates, technical details, and mitigation strategies.

PumaBot: Novel Botnet Targeting IoT Surveillance Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

PumaBot: Novel Botnet Targeting IoT Surveillance Devices

Threats Tagged 'pumabot'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'pumabot'

Lead Pen Test Professional