Breaking the silence - Recent Truebot activity
Summary: Cisco Talos reports that Truebot (Silence.Downloader) infections rose from August 2022, with delivery shifting from malicious emails to exploitation of a Netwrix Auditor remote code execution vulnerability (CVE-2022-31199) in August and Raspberry Robin USB malware in October. Talos identified two botnets: one worldwide with focus on Mexico, Pakistan, and Brazil, and a newer one of over 500 infections, roughly 75% in the U.S., composed almost exclusively of internet-facing Windows servers. Post-compromise activity included data theft, Cobalt Strike and Grace payloads, Clop ransomware, and a custom exfiltration tool Talos calls Teleport.
Bottom line: A botnet of more than 500 internet-connected Windows servers, mostly in the U.S., was built through a distribution mechanism Talos has not yet identified, and the operators behind it have already shown they will test a freshly published vulnerability within weeks and deploy Clop ransomware and a custom exfiltration tool once inside.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026