✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Internet
Breach intelligence, attack campaigns, and threat reports targeting the Internet sector.
Explore Other Sectors
Internet Threat Reports
AryStinger Malware Hijacks 4,300 Legacy Routers in 2026
In June 2026, security researchers at QiAnXin's XLab identified a new malware strain named AryStinger, which has compromised over 4,300 outdated routers, primarily D-Link models like DIR-850L and DIR-818LW. The malware exploits old vulnerabilities—CVE-2013-3307 and CVE-2016-5681—to transform these devices into a distributed network for reconnaissance and proxying malicious traffic. Unlike typical botnets used for DDoS attacks, AryStinger focuses on pre-intrusion activities such as internet scanning, service fingerprinting, subdomain enumeration, and traffic tunneling, effectively masking the attacker's origin. This incident underscores the critical risks posed by unpatched, legacy hardware in both residential and small office environments. The widespread infection, notably concentrated in South Korea and China, highlights the necessity for regular firmware updates and the decommissioning of unsupported devices to prevent their exploitation in sophisticated cyber operations.
1 month ago
Kill Chain
AryStinger Botnet Hijacks Over 4,000 D-Link Routers Globally
In June 2026, the AryStinger botnet compromised over 4,000 outdated D-Link routers worldwide, transforming them into proxies for malicious activities. The malware exploited known vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, primarily targeting D-Link DIR-850L and DIR-818LW models. Infected devices were utilized for scanning, proxying, tunneling, and command execution, with the capability to tamper with DNS settings and monitor network traffic. The majority of infections were reported in South Korea (48.5%), China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). This incident underscores the critical need for organizations to replace end-of-life hardware and apply the latest firmware updates to mitigate risks associated with outdated devices. The AryStinger botnet's exploitation of legacy vulnerabilities highlights the ongoing threat posed by unpatched systems in the cybersecurity landscape.
1 month ago
Kill Chain
Operation Endgame: A Major Blow to SocGholish Malware Infrastructure
In June 2026, an international law enforcement coalition comprising agencies from the Netherlands, Canada, the United States, and Germany executed Operation Endgame, targeting the SocGholish malware infrastructure. This coordinated effort led to the takedown of 106 servers and the remediation of 14,971 WordPress websites infected with SocGholish, a JavaScript-based downloader malware. SocGholish, active since 2017, masquerades as browser updates to distribute additional malicious payloads, often leading to ransomware attacks orchestrated by groups like Evil Corp. The operation significantly disrupted the malware's distribution channels, mitigating further risks to global digital systems. ([politie.nl](https://www.politie.nl/en/news/2026/june/18/international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html?utm_source=openai)) The success of Operation Endgame underscores the effectiveness of international collaboration in combating cyber threats. However, the persistent evolution of malware tactics necessitates continuous vigilance and adaptive cybersecurity measures. Organizations are urged to regularly update their systems, monitor for unauthorized access, and educate users about the dangers of deceptive software updates to prevent future infections.
1 month ago
Kill Chain
International Crackdown Dismantles SocGholish Botnet Tied to Evil Corp
In June 2026, international law enforcement agencies, including Europol and Eurojust, executed Operation Endgame, targeting the SocGholish botnet linked to the Russian cybercrime group Evil Corp. This coordinated effort resulted in the cleansing of nearly 15,000 malware-infected WordPress websites and the dismantling of over 100 associated servers. SocGholish, active since at least 2017, operates by injecting malicious JavaScript into legitimate websites, tricking visitors into downloading fake browser updates that install malware, thereby granting attackers access to infected systems. The operation significantly disrupted Evil Corp's infrastructure, mitigating further cyber threats posed by this group. The success of Operation Endgame underscores the effectiveness of international collaboration in combating sophisticated cybercriminal networks. It highlights the critical need for organizations to maintain robust cybersecurity practices, including regular software updates, vigilant monitoring of web assets, and user education to recognize and avoid social engineering tactics employed by malware like SocGholish.
1 month ago
Kill Chain
F5 Releases Patches for Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055
In June 2026, F5 disclosed two critical vulnerabilities in NGINX Open Source: CVE-2026-42530 and CVE-2026-42055, both with a CVSS v4 score of 9.2. CVE-2026-42530 is a use-after-free flaw in the ngx_http_v3_module, exploitable when NGINX is configured with the HTTP/3 QUIC module, potentially allowing remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. CVE-2026-42055 is a heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, triggered under specific configurations involving HTTP/2 proxying, which could also lead to remote code execution under similar conditions. F5 has released patches to address these vulnerabilities and recommends disabling HTTP/3 and adjusting configuration directives as interim mitigations. The discovery of these vulnerabilities underscores the persistent risks associated with widely used open-source software components. Organizations relying on NGINX should promptly apply the provided patches and review their configurations to mitigate potential exploitation. This incident highlights the importance of continuous monitoring and timely updates to maintain the security of critical infrastructure.
1 month ago
Kill Chain
Critical cPanel Plugin Vulnerability (CVE-2026-48172) Actively Exploited
In May 2026, a critical privilege escalation vulnerability (CVE-2026-48172) was discovered in the LiteSpeed User-End cPanel Plugin versions prior to 2.4.5. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected shared hosting servers. LiteSpeed released patches in May 2026, urging users to update to version 2.4.7 or later to mitigate the risk. The active exploitation of this vulnerability underscores the persistent threat posed by privilege escalation flaws in widely used web hosting platforms. Organizations must prioritize timely patching and implement robust monitoring to detect and prevent unauthorized access, especially in shared hosting environments where a single compromised account can jeopardize the entire server.
1 month ago
Kill Chain
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
In May 2026, a critical vulnerability (CVE-2026-54420) was identified in the LiteSpeed cPanel Plugin versions prior to 2.4.8, allowing users with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux or CageFS. This flaw, resulting from improper handling of symbolic links, was actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog on June 15, 2026. Administrators were urged to upgrade to LiteSpeed WHM Plugin v5.3.2.1 or later to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-54420?utm_source=openai)) The incident underscores the persistent threat posed by privilege escalation vulnerabilities in widely used web hosting environments. It highlights the importance of timely patch management and vigilant monitoring to prevent unauthorized access and potential system compromise.
1 month ago
Kill Chain
OpenAI Identifies Chinese Influence Operations Leveraging ChatGPT
In June 2026, OpenAI's threat intelligence team identified two distinct influence operations originating from China, utilizing ChatGPT to generate content aimed at exacerbating divisive topics such as AI and data centers. The first operation, termed "Data Center Bandwagon," produced imagery and social media posts alleging that data center expansions were increasing electricity costs for Americans. The second operation created content portraying tariffs as covert tools for nations to exert control over the global technological landscape, selectively including U.S. President Donald Trump while omitting Chinese President Xi Jinping. Both campaigns employed VPNs to mask their origins, used ChatGPT in simplified Chinese to generate content in both English and Chinese, and impersonated Americans on platforms like X and YouTube. Despite these efforts, OpenAI found minimal evidence of significant engagement beyond the operators' own amplification networks, indicating limited impact on public discourse. This incident underscores the evolving use of AI tools in state-sponsored influence operations and highlights the necessity for vigilance against such tactics. The use of generative AI by foreign actors to manipulate public opinion represents a growing challenge in the cybersecurity landscape, emphasizing the need for robust detection and mitigation strategies to counteract misinformation campaigns.
1 month ago
Kill Chain
Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
In early June 2026, multiple significant cybersecurity incidents emerged, including the exploitation of Meta's AI-driven customer support system to hijack high-profile Instagram accounts, a critical zero-day vulnerability in Qualcomm chipsets affecting numerous Android devices, and a self-replicating worm targeting Microsoft's GitHub repositories. These events underscore the persistent and evolving nature of cyber threats, highlighting vulnerabilities in widely used platforms and the need for robust security measures. The exploitation of AI systems for unauthorized access, the discovery of critical hardware vulnerabilities, and the targeting of major code repositories reflect a broader trend of increasingly sophisticated cyberattacks. Organizations must remain vigilant, continuously update their security protocols, and invest in advanced threat detection to mitigate these evolving risks.
1 month ago
Kill Chain
C0XMO Botnet's 2026 Exploitation of DD-WRT Router Vulnerability
In June 2026, the C0XMO botnet, a sophisticated variant of the Gafgyt malware, exploited a buffer overflow vulnerability (CVE-2021-27137) in DD-WRT router firmware to compromise devices across multiple CPU architectures, including ARM, MIPS, and x86. The botnet's modular design enabled it to launch distributed denial-of-service (DDoS) attacks using 19 different methods and to eliminate competing malware by terminating their processes and removing persistence mechanisms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/?utm_source=openai)) This incident underscores the escalating threat posed by advanced IoT botnets that leverage unpatched vulnerabilities in widely used devices. Organizations must prioritize timely firmware updates, enforce strong authentication practices, and disable unnecessary remote access to mitigate such risks.
1 month ago
Kill Chain
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
In early June 2026, an autonomous AI agent developed by security startup Depthfirst identified 21 zero-day vulnerabilities in FFmpeg, a widely used open-source media library. These vulnerabilities, including heap and stack overflows, had been present in the codebase for up to 23 years. Concurrently, Google released Chrome version 149, addressing a record-breaking 429 security flaws, with over 100 classified as critical or high severity. This surge in vulnerability discoveries underscores the growing role of AI in cybersecurity, enabling faster identification of longstanding security issues. Organizations must adapt to this accelerated pace by implementing more frequent patch cycles and enhancing their vulnerability management processes to mitigate emerging threats effectively.
1 month ago
Kill Chain
Dark Web Vendor Sentenced to Over 26 Years for Drug Trafficking
In June 2026, Darren Hughes, a 39-year-old from San Jose, California, was sentenced to over 26 years in federal prison for trafficking fentanyl and methamphetamine via the dark web platform Nemesis Market. Hughes operated a vendor store on Nemesis Market, offering free samples of methamphetamine to attract clients. Between 2023 and 2024, he sold methamphetamine and fentanyl pills to undercover law enforcement agents on five occasions, accepting cryptocurrency as payment. His arrest in June 2024 led to the seizure of approximately 672 grams of methamphetamine and a loaded 9mm 'ghost gun' without a serial number. This case underscores the persistent threat posed by dark web marketplaces in facilitating the global distribution of illegal narcotics. Despite the takedown of Nemesis Market in March 2024, similar platforms continue to emerge, highlighting the ongoing challenges law enforcement faces in combating online drug trafficking.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports