Koushik Pal

CloudSEK uncovered that the Androxgh0st botnet compromised a University of California, San Diego subdomain to host its C2 logger. Active since 2023, the botnet exploits vulnerabilities in Apache Shiro, Spring4Shell, WordPress, IoT devices, and more for remote code execution and cryptomining. Webshells were also deployed for persistence.

CloudSEK uncovered a surge in Iran-linked cyberattacks targeting Israel and its allies. Groups like APT42, APT34, MuddyWater, and hacktivist Handala are conducting espionage, data theft, and DDoS attacks. These actors use phishing, credential theft, and stealthy tools to infiltrate sensitive sectors. CloudSEK advises organizations to patch vulnerabilities, monitor DNS traffic, and enforce zero-trust security policies.