Year in Malware 2023: Recapping the major cybersecurity stories of the past year
Summary: Cisco Talos' year-end review of 2023 malware activity records attackers shifting to Shell Link (LNK) files after Microsoft blocked macros by default in Office documents, and the Prometei botnet reaching over 10,000 compromised machines with a new version that added an alternative C2 domain generating algorithm, a self-updating mechanism, and a bundled Apache Webserver with a web shell. The review also covers the return of Emotet with malicious Word document lures, the new YoroTrooper actor targeting government and energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other CIS countries, and the disclosure of the largest distributed denial-of-service attack ever, tied to a vulnerability in the HTTP/2 protocol tracked as CVE-2023-44487.
Why it matters: The HTTP/2 flaw behind the largest DDoS attack ever recorded, CVE-2023-44487, is a protocol-level exposure that Talos urged users to patch immediately, and the Prometei botnet's 10,000 compromised machines show how quickly an unpatched estate becomes someone else's infrastructure.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026