Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.

Related Posts:

• Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants
• CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

The post 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks appeared first on Daily CyberSecurity.

Unit 42 reveals the CL-UNK-1211 SysGoRAT malware campaign, where attackers use AI scripts and SysGoRAT malware to breach government Linux servers.

Related Posts:

• 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks
• Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants
• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

The post CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers appeared first on Daily CyberSecurity.

The ClingSTUN backdoor hijacks unpatched IoT devices and hides in traffic to public STUN servers. Learn how it spreads and how to stop it.

Related Posts:

• Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells
• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

The post ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes appeared first on Daily CyberSecurity.

A new BPFDoor backdoor variant and the AVERAT implant hide on telecom edge devices by posing as mail traffic. See how they work and how to hunt them.

Related Posts:

• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel
• New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes

The post BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices appeared first on Daily CyberSecurity.