Edge device

October 29, 2026

• Volt Typhoon runs its high-value intrusions through Silent Train, a relay framework of on-demand compromised devices that Lumen's Black Lotus Labs has tracked for three years. Operations route through non-US VPS, then hacked devices — Intelbras modems as overseas relays, Netgear Orbi as US hops — with temporary relays cleaned up after each operation and some enterprise hops persisting for months. Black Lotus confirmed at least four zero-days exploited through it (CVE-2026-16812 VeloCloud Orchestrator, CVE-2026-20127 Cisco Catalyst SD-WAN, CVE-2025-8875/CVE-2025-8876 N-able N-central, CVE-2024-39717 Versa Director) plus a suspected Quest KACE zero-day; targeting concentrates on California, Texas and Hawaii. The build-out followed the FBI's disruption of KV-Botnet (BleepingComputer, Lumen). · Threat Activity

October 16, 2026

• Compromised D-Link and Ubiquiti devices are being resold as residential proxy capacity. The proxyjacking campaign spans devices in 34 countries, turning victim connections into egress for a commercial proxy network and helping downstream abuse blend into residential traffic. GreyNoise details the infrastructure and detection opportunities. · Threat Activity & Espionage

October 6, 2026

• Rejetto HFS CVE-2026-61500 has moved from public PoC to observed probing, but successful exploitation has not been shown. VulnCheck canaries saw small-scale reconnaissance from one China Telecom address against deployments in Japan and the United States after the disclosure covered earlier. The flaw allows signing-key recovery, forged administrator sessions and server-side JavaScript RCE. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixed it, and 3.3.4 is the current stable release. BleepingComputer · Vulnerabilities & Exploits
• Fortinet traced additional infection paths for CLING/ClingSTUN. Beyond the Realtek activity in earlier coverage, researchers observed delivery through CVE-2022-36553, followed by CVE-2025-34035 and CVE-2024-23625. The Linux implant turns IoT devices into back-connect proxies and uses public STUN services to learn external mappings, preserve NAT bindings and blend communications with WebRTC and VoIP traffic. Fortinet · Threat Activity & Espionage

October 4, 2026

• A new IoT botnet, CLING, hides its C2 inside STUN traffic. Nozomi Networks Labs says the malware infects internet-facing routers, cameras and DVRs, then repeatedly contacts public STUN servers — the same NAT-traversal protocol browsers and voice/video apps use — to register infected devices and receive commands, giving it C2 that blends into ordinary real-time-communications noise (Nozomi Networks Labs). · Threat Activity

September 29, 2026

• Carbonato botnet installs the open-source Hermes Agent framework unchanged on Docker daemons exposed without auth on port 2375, then overwrites its SOUL.md persona file with a 39-line prompt instructing the agent to take tasks over Telegram, maintain persistence and prioritise AI API keys. It scans neighbouring networks every five minutes, launches privileged containers, and tunnels reverse SSH to a relay in Costa Rica (The Hacker News, Dark Reading). Continues from our earlier note on the campaign (earlier coverage). · Threat Activity

September 24, 2026

• CARBONATO wires an off-the-shelf agent framework into a Docker botnet. ThreatDown found an unauthenticated Docker registry exposed since May; one day of passive, read-only collection yielded 59 repositories, 234 image tags, 605 verified blobs and 4.3 GB of images spanning October 2024 to August 2026. The implant targets daemons exposed on port 2375, installs the MIT-licensed Hermes Agent unchanged, then overwrites its SOUL.md persona with a 39-line prompt telling it to take tasks over Telegram, persist and collect credentials — the same framework and persona file seen in the card-skimming operation reported this week (ThreatDown) (earlier coverage). · AI-Enabled Threat Activity

August 27, 2026

• DOJ and the FBI seized the domains behind QScan and QTRouter, two complementary platforms used to scan, infect and exploit IoT and edge devices as staging for intrusions into US federal agencies and critical infrastructure — reported victims include NASA, DOE, the Senate, the Federal Reserve and DOJ itself. The activity is attributed to Chinese state-sponsored group QTFY, tied to Nanjing Xinjiuwei Network Technology (DOJ, The Record). BleepingComputer frames the target as a technical "quartermaster" supplying recon, proxy management and operational routing to multiple espionage crews (discussion). · Threat Activity

August 20, 2026

• Attackers are poisoning captive-portal DNS at hotels and conference centres to harvest Microsoft 365 credentials. ReliaQuest reports the campaign has run since at least June 2026, with compromised Wi-Fi gateways in multiple US cities plus India and Saudi Arabia; operators take administrative control of the gateway and redirect victims to fake M365 infrastructure — no phishing email, no device compromise (ReliaQuest, Schneier). Follows the Midnight Blizzard captive-portal activity reported last week (earlier coverage). · Cloud & Identity

August 11, 2026

• FBI and South Korea warned that the Gunra RaaS gang is breaching critical infrastructure via firewall vulnerabilities. Gunra, which moved to a RaaS model in 2026, uses double extortion with a dedicated leak site against government and critical-infrastructure targets (The Record, CISA). · Threat Activity
• Poland disclosed a second heat-plant OT breach hidden for months, and CERT.PL calls the private-APN pivot a first. Attackers reached the OT network of a plant serving ~50,000 residents via a private Access Point Name — the same day 30+ renewable installations were hit (SecurityWeek, BleepingComputer, earlier coverage). · Threat Activity

July 21, 2026

• Russia's FSB is systematically hijacking internet-connected IP cameras across NATO states and Ukraine to surveil military transport routes and weapons shipments bound for Kyiv, per a July 10 advisory from the Netherlands' AIVD and MIVD. The Hacker News. · Threat Activity & Tradecraft

July 18, 2026

• Finland's Supo warns of a multi-year Russian FSB campaign against critical infrastructure, attributed to the FSB's 16th Center, hunting internet-exposed legacy SNMP and Cisco Smart Install devices — of which the NCSC-FI counted only ~20 in Finland (Yle). It aligns with the joint allied advisory on FSB Center 16 router compromises reported last week (earlier coverage). · Threat Activity

July 8, 2026

• Chinese actor UAT-7810 is deploying new "LONGLEASH" malware to grow an Operational Relay Box (ORB) network, primarily by compromising unpatched internet-facing Ruckus routers. BleepingComputer · Threat Activity