Security Risk Advisors

Cisco Talos identified JWR, a previously undocumented phishing framework designed to impersonate login and checkout pages for major platforms including Shopify, PayPal, Apple, Klarna, banks, and other payment services. Unlike static phishing pages that simply collect submitted data, JWR maintains a persistent AES-CTR encrypted WebSocket connection with the threat actor, allow...

FortiGuard Labs identified Evooo1Bot, a previously undocumented Linux botnet that has actively targeted Internet-facing devices since July 2026. The malware builds on the leaked Mirai source code but significantly expands its capabilities with encrypted C2 communications, persistence, credential sniffing, file transfer, interactive shell access, SSH brute-forcing, vulnerabili...

Huntress observed an Akira ransomware affiliate using Windows Safe Mode with Networking as an anti-EDR technique during an August 2026 intrusion. The attack began with credential spraying against an exposed SonicWall SSL VPN without MFA, followed by a successful login and RDP access to the domain controller. The attacker enumerated Active Directory users and computers, collec...

Kaspersky identified a July 2026 campaign in which the Head Mare APT group exploited vulnerabilities in TrueConf Server to obtain SYSTEM-level access and distribute the PhantomCore and PhantomGraph backdoors. Attackers connect to vulnerable servers through TCP port 4307 and chain KLCERT-26-057 and KLCERT-26-058 to execute malicious scripts, escape TrueConf’s isolated executio...

Palo Alto Networks Unit 42 identified Kimwolf v7, an evolved version of the Android and IoT botnet primarily targeting Android TV boxes and set-top boxes. The botnet spreads by abusing residential proxy services to reach devices exposing unauthenticated Android Debug Bridge (ADB), particularly on TCP port 5555. Kimwolf v7 expands its DDoS capabilities with 15 attack methods a...