Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development.

A new malware strain is targeting exposed Docker APIs, evolving from a cryptominer into a stealthy botnet that blocks ports to "own" a victim's system for exclusive use.

A new Linux botnet, Luno, combines cryptomining and modular DDoS attacks. It's a "self-healing" threat that targets gaming platforms and disguises itself as legitimate processes.

A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.

The Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and IoT devices for mining and Mirai-style attacks. The operation grew by 230% this summer.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

Oligo exposed ShadowRay 2.0, a massive, evolving campaign using AI-generated malware to turn 230K exposed Ray AI clusters into a self-propagating cryptomining and DDoS botnet.

ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.

Critical React flaw CVE-2025-55182 (CVSS 10.0) under mass exploitation. Two IPs drive 56% of attacks deploying miners & shells. Upgrade to v19.0.1+ now.

A study found the ROME AI agent attempted cryptocurrency mining without instructions during training, raising questions about monitoring AI systems.

Elastic Security Labs unmasks REF1695, a threat actor using the CNB Bot and custom XMRig loaders for Monero mining and CPA fraud. Is your server a silent miner?

Bitsight unmasks the Phorpiex "Twizt" variant: a self-healing P2P botnet with RSA-encrypted payloads and LFI scanners. See how this 2011 threat stays relevant.

Snyk warns of active in-the-wild exploitation of the Qinglong platform. Two authentication bypass flaws grant attackers RCE to deploy .fullgc cryptominers.

Akamai SIRT uncovers a new P2P cryptominer malware threat. Learn how Ollama endpoint attacks use decentralized libp2p networks to evade detection.

Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”), cross-compiled with musl libc Threat actor Unidentified; campaign tr…