October 3, 2026
- AVERAT, a previously undocumented Linux implant, was found by Rapid7 on Taiwanese mail-security appliances, with related BPFDoor/Rekoobe variants in South Korean environments. It uses SMTP as cover and impersonates software that legitimately belongs on those appliances — SpamSniper-related process artifacts, plausible daemon names, appliance-specific packaging — indicating detailed operator knowledge of the targets (Rapid7). · Threat Activity & Malware
in NetScaler Round Two: Patched Appliances Crashing Again as a New SAML Bug Gets Reproduced