🚨 RemControl Targets 30+ Banks Across Six Countries infosecurity-magazine.com/ne… RemControl is a new Android banking trojan targeting users across Western Europe, the Middle East, and Canada. Victims are lured through fake Google Play pages, while the dropper uses a local VPN to block Google Play Protect traffic before installing the payload. Once the victim grants Accessibility Service permissions, RemControl can take over the device, display full-screen banking overlays, capture PINs and banking codes, log keystrokes and unlock patterns, and capture screen content. Its main C2 channel uses WebSockets, with Telegram used to hide the real server address. #ThreatIntel #Android #RemControl #Malware #CyberSecurity

🚩 PamStealer Adds Live C2 Decryption and Stronger macOS Persistence thehackernews.com/2026/09/pa… PamStealer is changing how its macOS payload gets delivered. The latest variant downloads a decryption utility called pkgunpack, performs an X25519 key exchange with its C2 server, and uses the resulting key to decrypt the encrypted payload bundle. Without the C2 server’s private key, that payload cannot be recovered through static analysis. It also adds persistence through LaunchAgents, ~/.zshrc, repair scripts, and Git hooks. The stealer targets browser credentials, Keychain data, shell history, system details, and user files. #ThreatIntel #PamStealer #macOS #Malware #CyberSecurity

🚨 CARBONATO Botnet Combines Docker Exposure, Hermes Agent, and Telegram C2 securityaffairs.com/199716/m… A newly detailed botnet called CARBONATO has been targeting exposed Docker daemons since at least October 2024. It scans TCP/2375, launches privileged containers with the host filesystem mounted, opens reverse SSH access, and installs the open-source Hermes Agent. The agent’s SOUL[.]md prompt is modified to prioritize credential theft, especially AI API keys. Those stolen keys are then used to fund the operators’ own LLM gateway, while Telegram is used for C2 tasking and result reporting during post-exploitation. #ThreatIntel #CARBONATO #Botnet #CyberSecurity

📌 How One Open Directory Exposed a 3,562-Server Redis Botnet If you skipped this investigation when we published it two weeks ago, now’s a good time to go back to it. An exposed operator directory revealed 147 files, including exploit code, campaign logs, a portable Python runtime, and registry hives. The operation used Redis rogue replication to write cron persistence, pull XMRig, and mine over TLS. Across two runs, 3,562 distinct Redis servers were compromised, spanning versions 2.8.17 through 7.2.0. Check out the full article here 👉 hunt.io/blog/redis-cryptomin… #ThreatHunting #ThreatIntel #CyberSecurity

⚠️ ShinyHunters Claims FBI Data Theft After PeopleSoft Zero-Day Exploitation bleepingcomputer.com/news/se… ShinyHunters says it breached FBI systems through an unpatched Oracle PeopleSoft zero-day, defaced the FBI Jobs site, and then moved laterally into AWS GovCloud. The group says it stole 2–3 TB of data and is now using the same alleged flaw against other organizations, including Fortune 500 companies. The FBI confirmed it is investigating, but the zero-day, lateral movement, and claimed data volume remain unverified. #ThreatIntel #ShinyHunters #PeopleSoft #FBI #CyberSecurity

While hunting suspicious infrastructure on @Huntio, I came across 176.65.139[.]158 exposing a /bins/ directory with Linux payloads for ARM, MIPS, x86, PPC, SH4 and several other architectures. I collected the exposed binaries and started reversing the x86_64 and MIPS builds. The samples are consistent with a Mirai-derived codebase and contain an embedded RedKill identifier. The x86_64 bot creates an AF_INET/SOCK_DGRAM socket, connects it to 8.8.8.8:53/UDP, and then uses getsockname() to determine the host's local IPv4 address. It subsequently establishes a TCP connection to the hard-coded C2: 176.65.139[.]158:6722/TCP The initial 12-byte client message sent after the connection is established is: 00 00 00 01 07 52 65 64 4b 69 6c 6c The final seven bytes decode to RedKill. The C2 parser accepts attack commands and forks separate worker processes. Reversing the attack dispatcher exposed several DDoS capabilities, including UDP flooding with randomized payload data, raw TCP flooding, GRE flooding with a TEB (0x6558) mode, and a TCP socket-hold/connection-flood routine. The exposed dbg binary provided additional context. It is a ~1 MB statically linked x86_64 build containing verbose strings such as socket_hold_attack, a default 1000 connection limit, mirai, RedKill, the same C2 address and 8.8.8.8. The currently hosted MIPS payload also has a different SHA256 from an earlier public Mirai sample I compared against. I treat it as a separate build; the hash difference alone is not enough to establish a payload-rotation cadence.

🔍 Go Beyond CVE Lists With Hunt’s Vulnerability Module Our Vulnerability module brings CVE tracking and investigation into one place. You can follow weaponized CVEs, see what’s hot in the news, review new KEVs, check fresh exploits and PoCs, and more. Simply open a specific CVE and keep digging through related reporting, IOC Hunter stories, and AttackCapture sources. In this example, a PaperCut CVE leads into reports with exploitation details, infrastructure, exposed credentials, files, and other indicators. Track the vulnerability, open the context, and keep the investigation flowing 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

🚩 Graphalgo Deploys RAT Through Malicious Terraform Providers and Go Modules gbhackers.com/graphalgo-malw… Graphalgo, a supply-chain campaign previously linked to Lazarus Group, has moved beyond npm and PyPI, using trojanized Terraform providers and malicious Go modules to deliver a Go-based RAT. The RAT only activates when a specific SHA-256 condition is met, suggesting targeted delivery rather than broad infection. Once active, the malware collects host data and uses both Slack APIs and the Arbitrum Sepolia testnet for C2. #ThreatIntel #Graphalgo #Terraform #Malware #CyberSecurity

🕵️‍♂️ Turn a Malware Name Into a Threat Hunting Lead Sometimes the easiest place to begin a hunt is the malware itself. With Hunt’s Malware Search, you can pick any family and immediately explore related IPs, hosts, SHA256s, posts, live signals, and more. In this example, we start with Vshell, review its associated infrastructure, and pivot into 124.223.221[.]83, one of the many IPs connected to it. That immediately gives us more host context, including ASN, geolocation, network data, risk signals, and additional pivots. From a single malware name, the investigation expands into infrastructure, ownership, location, risk, and more, all without breaking the investigation flow. Start your next hunt from a malware family and follow the pivots from there 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

⚠️ BambooToken Linux Backdoor Uses MQTT as Its C2 Channel cybersecuritynews.com/bamboo… A newly analyzed Linux backdoor called BambooToken is using MQTT as its C2 channel. Once deployed, it connects to an MQTT broker over TCP/2883, collects host information, runs shell commands through /bin/sh -c, and supports file upload, download, listing, and deletion. Its C2 design uses separate MQTT topics and workers for shell and file operations, while payloads and topic names are XOR-encoded. For file transfers, downloads are split into 128 KiB chunks, with a NUL byte separating JSON metadata from the raw file content. #ThreatIntel #BambooToken #Linux #Malware #CyberSecurity

(n/2) The link resolves to /verify, and before you ever see a password field, you get a CAPTCHA. The kit is branded captcha-0195cc74 mentioned on @Huntio #threathunting #scatteredspider

🚀 Add Fresh C2 Intelligence to Your Security Workflow Hunt’s OEM C2 feed gives your platform access to newly identified C2 infrastructure, including activity that often never reaches public OSINT sources. That can mean up to 10x more C2 coverage. Each result is enriched with host data, malware and threat actor context, associated domains, JA4 fingerprints, and detections from more than 150 techniques. We also review the dataset every day to keep stale or low-value entries out. Try it free for 14 days and explore C2 infrastructure detected during the past seven days. Apply here 👉 hunt.io/oem-c2-threat-feeds #ThreatHunting #ThreatIntel

🚩 North Korean ROOFDECK Backdoor Hides C2 Behind Nostr Profiles cyberpress.org/roofdeck-uses… The North Korea-linked group TraderTraitor is targeting DevOps engineers with fake GitHub interview projects containing weaponized .terraform.lock.hcl files. The fake Terraform projects use attacker-controlled provider domains to deliver FLATROOF and ROOFDECK on macOS. ROOFDECK takes an interesting approach to C2 by querying Nostr relays instead of hardcoding a server, finding an attacker-controlled profile, and reading the website field as the active C2 address. Operators can change infrastructure by simply updating the profile. #ThreatIntel #TraderTraitor #Malware #CyberSecurity

🚨 Brevo Supply-Chain Attack Affected Over 100,000 Websites securityaffairs.com/199355/h… A Brevo supply-chain attack potentially affected more than 100,000 websites through infrastructure they already trusted. Attackers used a compromised Cloudflare API key to deploy a malicious Worker that modified Brevo-hosted scripts at the edge. Visitors saw fake "prove you’re human" ClickFix prompts, while logged-in WordPress admins could have a malicious plugin installed through their active session. Brevo’s origin files stayed clean the whole time. The malicious changes happened at the CDN edge. #ThreatIntel #Brevo #CloudFlare #CyberSecurity

🚩 Settra Ransomware Abuses MeshAgent and Windows Recovery Tools infosecurity-magazine.com/ne… A newer Settra ransomware variant is showing a pretty consistent post-compromise playbook across retail and manufacturing attacks. Threat actors deployed MeshAgent for persistent access, launched ransomware from local folders, cleared Windows Event Logs, disabled Windows Recovery Environment, removed recovery partitions, and used a cipher to make deleted data harder to recover. Another attack also involved BYOVD to interfere with security tooling. Encrypted files received the .locked extension, while ransomware binaries were named after the victim’s domain. #ThreatIntel #ThreatHunting #Settra #Ransomware #CyberSecurity

🚨 Handala Deploys HEAVYGRAM Backdoor With Telegram C2 thehackernews.com/2026/09/ir… Handala, an Iran-linked threat actor, has been tied to HEAVYGRAM, a Python-based Windows backdoor that uses Telegram for C2. Delivered through scripts, HTA files, embedded archives, and fake apps, it can run commands, capture screenshots, steal saved passwords, collect local Telegram and WhatsApp data, upload or download files, activate the microphone, and deploy additional malware. A related tool, CRUDEEXCLUDE, prepares the host by adding Microsoft Defender exclusions before later payloads are delivered. #ThreatIntel #HEAVYGRAM #Telegram #Malware #CyberSecurity