ThreatDown researchers reconstructed the Carbonato botnet, which compromises Docker daemons exposed on port 2375 and installs the open-source Hermes Agent framework with nothing but its persona file rewritten. Close port 2375, move to rootless or TLS, and revoke any AI API key sitting on a potentially affected host.
CERT Polska has documented the MikroTrick chain: two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, combine to hand attackers full administrative control of an exposed router with no password and no SSH key. CISA added CVE-2026-67279 to its KEV catalog on September 25, 2026: patch to 6.49.21, 7.23.4 or 7.24.2 and hunt for signs of compromise.
On September 10, 2026, CISA added two MikroTik RouterOS flaws — a missing authentication check and a command injection — to its KEV catalog after active exploitation. The chain yields remote code execution with no credentials, and the federal remediation deadline lands on September 13.
Between June 17 and July 22, 2026, a single operator compromised more than 14,530 Dahua cameras by chaining brute force, a 2021 flaw and the vendor’s P2P relay — 89% of them with no authentication at all. Hunt.io’s investigation reveals a hard truth: connected video surveillance is an open door by design.
On August 26, 2026, the U.S. Department of Justice and the FBI seized the domains of QScan and QTRouter, two platforms run by a Chinese group that concealed the origin of intrusions against U.S. critical infrastructure. The lesson outlives the news cycle: network obfuscation is now an industrialized service, and it breaks where the attacker has the least redundancy.
An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.
The Mirai-derived modular botnet Evooo1Bot has been recruiting internet-exposed gateways — Alcatel, NETGEAR, Tenda, D-Link — into resellable SOCKS5 relay nodes since July. Fortinet documents a full arsenal whose economic novelty, the residential relay, should push every operator to inventory their internet-facing routers.
