New cryptomining campaigns by Soco404 and Koske exploit cloud misconfigurations in PostgreSQL and JupyterLab, deploying stealthy, AI-generated malware hidden in images.

A new report reveals a multi-stage cryptomining attack delivered via infected USB drives, a tactic that leverages DLL hijacking to bypass security.

A new Mandiant report reveals a multi-stage USB malware campaign that uses DLL side-loading and stealthy loaders to deploy backdoors and coinminers.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development.

A new malware strain is targeting exposed Docker APIs, evolving from a cryptominer into a stealthy botnet that blocks ports to "own" a victim's system for exclusive use.

A new Linux botnet, Luno, combines cryptomining and modular DDoS attacks. It's a "self-healing" threat that targets gaming platforms and disguises itself as legitimate processes.

A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.

The Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and IoT devices for mining and Mirai-style attacks. The operation grew by 230% this summer.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

Oligo exposed ShadowRay 2.0, a massive, evolving campaign using AI-generated malware to turn 230K exposed Ray AI clusters into a self-propagating cryptomining and DDoS botnet.

ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.