Threat Source newsletter (Sept. 2, 2021)
Summary: Cisco Talos reported that attackers are abusing internet-sharing "proxyware" platforms such as Honeygain and Nanowire, silently installing clients to sell victims' bandwidth and, in some cases, patching the client to suppress alerts, while trojanized installers also deliver coin miners and information stealers. Talos also described a Mirai-like botnet called "Dark.IoT" scanning for wireless routers vulnerable to a recently disclosed denial-of-service flaw in Realtek chipset SDKs, incorporating new proof-of-concepts within days.
Key Takeaway: Proxyware's expected performance hit gives coin miners a perfect disguise, and a botnet that weaponizes published proof-of-concepts within days means the window between disclosure and exploitation on your routers is measured in days, not weeks.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026