Threat Intelligence

Moving Target: Spammer Using Over 1000 Home Computers as DNS

Some individual appears to have hijacked more than a 1,000 home computers starting in late June or early July and has been installing a new Trojan Horse program on them. The Trojan allows this person to run a number of small websites on the hijacked home computers. These websites consists of only a few web pages and apparently produce income by directing sign-ups to for-pay porn websites through affiliate programs. Spam emails messages get visitors to come to the small websites.

To make it more difficult for these websites to be shut down, a single home computer is used for only 10 minutes to host a site. After 10 minutes, the IP address of the website is changed to a different home computer... more

98% Of Internet’s Main Root Server Queries Are Unnecccary: Should You Be Concerned?

A recent study by researchers at the Cooperative Association for Internet Data Analysis (CAIDA) at the San Diego Super Computer Center (SDSC) revealed that a staggering 98% of the global Internet queries to one of the main root servers, at the heart of the Internet, were unnecessary. This analysis was conducted on data collected October 4, 2002 from the 'F' root server located in Palo Alto, California.

The findings of the study were originally presented to the North American Network Operators' Group (NANOG) on October 2002 and later discussed with Richard A. Clarke, chairman of the President's Critical Infrastructure Protection Board and Special Advisor to the U.S. President for Cyber Space Security. more

CISA Unveils 2030 Strategy to Shift U.S. Cyber Defense Toward Proactive Threat Removal

CISA's new 2030 strategy shifts US cyber defense toward proactive threat removal, prioritizing critical infrastructure protection and national resilience, with implementation milestones set for the coming year. more

Attackers Hijack Government and School DNS Records to Promote Illegal Gambling

Infoblox researchers uncovered two operations exploiting government and educational DNS infrastructure across three countries to promote illegal gambling, exposing security weaknesses that conventional website monitoring may overlook. more

The Phishing Domain You Missed Shares a Nameserver With the One You Caught

Nameserver-based searches can uncover related domains that conventional phishing monitoring misses. An investigation of shared DNS infrastructure reveals how registration patterns, nameserver pairs and timely zone data can help identify suspicious domain clusters. more

PHP Releases Emergency Security Patches as Researchers Report Exploit Attempts

PHP has released emergency patches for two critical vulnerabilities that could enable unauthenticated remote code execution. Security researchers report attempted exploitation, while authorities urge immediate updates across internet-facing hosting environments. more

Africa’s Digital Health Growth Exposes the Need for Stronger Cybersecurity Governance

As African healthcare systems adopt digital technologies, cybersecurity governance becomes essential to patient safety. Evidence from Ghana highlights gaps in institutional accountability, staff awareness and implementation, underscoring the need for stronger oversight and resilience. more

US Seizes Seven Domains Linked to Alleged Chinese Cyber Espionage Operation

US authorities seized seven domains supporting alleged Chinese cyber espionage tools used against critical infrastructure and other networks across three continents, disrupting scanning and phishing services while leaving questions about their recovery. more

UK and Germany Agree to Coordinate Cyber Defense Against Infrastructure Sabotage

The UK and Germany have announced a partnership to counter cyberattacks and infrastructure sabotage through intelligence sharing and coordinated responses, but have yet to specify participating agencies, covered sectors or operational mechanisms. more

Why Container Security Is Still Fighting Yesterday’s Battle

Rule-based container security can miss attacks that evade predefined patterns, prompting an argument for behavioral detection that models activity across Kubernetes workloads and control planes while retaining rules for known threats. more

UK, US and Dutch Agencies Expose Iranian Spyware Targeting Dissidents and Journalists

UK, US and Dutch agencies have exposed Iranian state-linked spyware that uses personalized social engineering to compromise Windows devices and surveil dissidents, activists and journalists, capturing communications, files, audio and other sensitive data. more

Cyberattackers Are Using AI Across More of the Kill Chain, Anthropic Reports

Anthropic says attackers are increasingly using AI agents to orchestrate cyber operations, automating reconnaissance, exploitation, data theft and malware adaptation while lowering the expertise and resources previously required for sophisticated attacks. more

From Forgotten to Exploited: How AI Changes the Dangling DNS Threat

Dangling DNS records can expose trusted corporate subdomains to takeover, while AI-assisted reconnaissance makes abandoned resources easier to find, increasing the need for continuous DNS monitoring rather than periodic audits. more

Thirty-Five Years Later, Moscow Comes Looking for the Soviet Union’s Domain

Russia is imposing state identity verification on .su, the Soviet Union's surviving domain, as researchers uncover criminal infrastructure across the namespace and ICANN pursues a retirement process that could eventually remove it from the global root. more

More Than 100 Organizations Call for Global Surge in AI-Assisted Cyber Defense

More than 100 organizations are calling for wider use of AI in cyber defense, urging governments, technology providers and AI developers to expand funding, tools, model access and practical support for under-resourced critical infrastructure operators. more