Intel Exchange

The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.

The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.

The ENIBot IoT botnet actively self-propagates via Telnet and ADB brute-forcing to conduct high-volume Layer 7 DDoS attacks.

Adversaries like Mirage Kitten and Cloud Atlas leverage Kerberoasting and DNS tunneling to bypass traditional security perimeters and exfiltrate data.

Evooo1Bot is a highly modular Linux botnet leveraging Mirai's DDoS engine alongside advanced SOCKS relay, SSH brute-forcing, and an extensive CVE exploit arsenal to compromise Internet-facing edge devices.

Forest Blizzard (linked to Russian military intelligence) compromises SOHO routers to perform DNS hijacking and adversary-in-the-middle attacks targeting Microsoft 365 and government servers.

UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.

The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.

Adversaries including Phorpiex and Mozi increasingly utilize direct-to-IP (D2IP) communications to bypass DNS-based security controls and reach hard-coded C2 infrastructure.

Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.