Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
9 stories match your filters.
CloudSEK says the Doorway botnet compromised 11,363 routers, cameras and servers in a month, mostly via blank or default passwords on MikroTik routers plus old RouterOS and Openfire bugs.
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.
A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.
Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.