Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.

depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.