FlagThis - Latest Cybersecurity News

Aeternum is a persistent botnet loader that utilizes the Polygon blockchain to implement a decentralized Command and Control (C2) architecture. By embedding encrypted commands and payload locations within smart contracts and blockchain transactions, the threat actor eliminates the need for centralized C2 servers. This methodology renders standard mitigation techniques, such as DNS sinkholing or IP blocking, ineffective. The malware leverages "ClickFix" techniques for C2 domain distribution and blends malicious signaling with legitimate Web3 traffic, ensuring high resilience against law enforcement and security vendor takedown efforts.

China-nexus state-sponsored actors have scaled the JDY botnet to over 1,500 compromised SOHO and IoT devices, serving as a high-performance reconnaissance engine following the disruption of the KV-botnet. Targeting MIPS and MIPSEL Linux architectures, the botnet utilizes Tor-based C2 to orchestrate high-speed SYN scanning, banner grabbing, and TLS certificate collection. This infrastructure is primarily used for the industrialized mapping of U.S. military assets and critical infrastructure in the energy and defense sectors. By leveraging compromised edge devices from vendors like Cisco and Ubiquiti, actors mask malicious traffic within residential IP space to bypass geolocation and reputation-based filters during the preparation phase of the kill chain.

The FBI and Google Threat Analysis Group (TAG) have dismantled the NetNut residential proxy platform and the associated Popa botnet, which compromised approximately two million home IoT devices, including Smart TVs. The operation leveraged malicious SDKs embedded in legitimate software to transform residential hardware into a for-hire relay network, masking malicious traffic and supporting broader cyber operations. This disruption involved the seizure of hundreds of command-and-control (C2) and proxy domains. The infrastructure was managed by Alarum Technologies, a publicly traded company, highlighting a sophisticated abuse of the residential proxy business model to facilitate botnet-scale traffic obfuscation.

Threat actors and commercial entities are leveraging Smart TV ecosystems—specifically Samsung Tizen, LG WebOS, and Android TV—to establish massive residential proxy networks. Attackers exploit OS-level vulnerabilities in Tizen (versions through 9.0) and WebOS, alongside exposed Android Debug Bridge (ADB) ports on Android TV devices, to deploy botnets like Kimwolf. Concurrently, "gray-market" commercial actors embed SDKs (e.g., Bright Data/Luminati) within free consumer applications to hijack outbound bandwidth. This dual-vector approach enables large-scale web scraping, unauthorized monetization of consumer IP reputation, and significant privacy erosion by transforming always-on residential devices into high-bandwidth proxy exit nodes.

State-sponsored cyber espionage has evolved into a decentralized industrial complex where national intelligence services outsource the attack lifecycle to Private Sector Offensive Actors (PSOAs), botnet operators, and data brokers. This model utilizes commercial 0-day exploits and custom frameworks, such as DevilTongue malware, deployed via third-party infection chains. By decoupling the target intelligence (sourced from PII data brokers) and the Command and Control (C2) infrastructure (sourced from criminal botnets) from the state architect, actors achieve significant operational scale and plausible deniability. This shift complicates attribution as state-grade capabilities now overlap with criminal toolsets, accelerating the attack lifecycle and broadening the threat surface for high-value targets.