ProtonVPN IP Used in Initial Reconnaissance for Gitea Exploit
An IP address from ProtonVPN service (159.26.98[.]241) was observed in the initial reconnaissance phase of the attempted exploitation of CVE-2026-20896, though no…
Tag: reconnaissance
CountLoader: Multi-Platform Loader with Persistence and Reconnaissance
CountLoader is a malware family delivered via DOUBLECUP, with Windows and macOS variants. It establishes persistence via scheduled tasks, audits browser extensions…
Censys Used to Identify Exposed PLCs in Cyber Attacks
Censys, an internet scanning service, is being leveraged by threat actors to identify internet-exposed PLCs running outdated software. This reconnaissance method is…
JDY Botnet: Covert Reconnaissance Network Expanding to 1,500+ Devices
The JDY botnet is a covert network of compromised SOHO and IoT devices used for targeted scanning and service fingerprinting. It has…
Fscan: Network Scanner for Service Discovery
Fscan is a network scanning tool used by the attackers to identify services running on specific ports, such as SSH and MySQL.…
ksubdomain: Subdomain Enumeration Tool Used by AryStinger
ksubdomain is a subdomain enumeration tool used by the Go-based build of AryStinger on QNAP NAS devices to discover subdomains during reconnaissance.
httpx: HTTP Probing Tool Used by AryStinger
httpx is an HTTP probing tool used by the Go-based build of AryStinger on QNAP NAS devices to fingerprint web services during…
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
A new malware family named AryStinger, discovered by QiAnXin's XLab, has infected at least 4,300 legacy routers to create a distributed reconnaissance…
AryStinger: Router Botnet for Reconnaissance
AryStinger is a botnet that enlists older, vulnerable home routers into a network for distributed reconnaissance and proxying, highlighting the growing threat…
Volt Typhoon: China-Nexus Threat Actor Using JDY Botnet
Volt Typhoon is a Chinese state-sponsored hacking group that has been observed using the JDY botnet for reconnaissance and targeting of vulnerable…