4 casos · pág. 1/1
FortiGuard Labs describes an intrusion in which a compromised Jenkins EC2 build host, tied to Shai Hulud persistence, was used to steal instance role credentials via IMDS and pivot into the victim's AWS environment. The actor used the credentials from external IPs, created an admin IAM user named cloudops-monitor, opened network paths to …
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
