Attackers are evolving and so are defenders. |
From autonomous AI operations to botnet takedowns, data theft, and WAF issues, today's stories highlight how quickly the threat landscape continues to shift. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
NetNut Botnet Loses 2 Million Devices |
A coordinated operation disrupted the NetNut residential proxy network, cutting off access to an estimated two million compromised Android devices. The botnet enabled cybercriminals and espionage groups to route malicious traffic through legitimate residential IP addresses, helping them evade detection during attacks. |
Google disrupted the botnet's C2 infrastructure, expanded Google Play Protect detections, and shared threat intelligence with industry and law enforcement partners.
Audit Android-based devices for unauthorized applications, ensure Google Play Protect remains enabled, and monitor authentication logs for activity originating from residential IP addresses that could indicate proxy-enabled attacks. |
AI Agent Runs JadePuffer Ransomware Attack |
Sysdig researchers say they have documented the first ransomware attack carried out almost entirely by an autonomous AI agent.
After exploiting a Langflow remote code execution flaw, the AI agent autonomously performed reconnaissance, stole credentials, moved laterally, escalated privileges, and encrypted data while adapting to failures in real time.
The PoC demonstrates how AI can accelerate attacks and lower the barrier for cybercriminals targeting vulnerable internet-facing applications.
Apply patches or virtual patching, implement compensating controls, and monitor for unusual automation, rapid privilege changes, and adaptive AI-driven attack behavior. |
Moody Bible Data Leak Exposes Millions |
ShinyHunters allegedly exposed millions of Moody Bible Institute records affecting donors, students, alumni, and supporters. The leaked dataset reportedly includes more than 2.3 million email addresses along with names, dates of birth, addresses, and phone numbers.
Moody Bible Institute is continuing to investigate the incident with cybersecurity experts. If your organization has ties to Moody Bible Institute, watch for phishing emails, enable phishing-resistant MFA, and check affected email addresses against trusted breach notification services. |
|
|
|
Who should be responsible for securing Android-based smart devices? |
|
|
|
Yesterday's Pulse Check Results |
How confident are you that government agencies can protect your sensitive data? |
|
|
|
Security Tools You Can Use |
-
Oligo provides runtime security for modern applications, cloud workloads, and AI systems, detecting and blocking threats by continuously analyzing runtime behavior. Learn more
-
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
-
Stay ahead of threats — explore the best cybersecurity tools and lock down your business today.
|
|
|
|
OWASP ModSecurity Flaws Bypass WAF Protections |
Two OWASP ModSecurity vulnerabilities could let attackers bypass web application firewall protections. The flaws affect ModSecurity through version 3.0.15 and can allow malicious payloads to bypass inspection. |
Organizations using ModSecurity, especially with multipart/form-data processing or 32-bit deployments, should apply patches as soon as possible.
Patch to the latest version, validate that WAF rules inspect multipart requests as expected, and test applications for parser inconsistencies that could allow malicious traffic to bypass inspection. |
TrojPix Steals Air-Gapped Data |
Researchers demonstrated TrojPix, an attack that steals data from compromised air-gapped computers up to 208 meters away. Although TrojPix cannot breach an air-gapped system by itself, it provides attackers with a stealthy way to exfiltrate data once malware is present.
The attack requires only user-level privileges and uses standard video cables to transmit stolen data. Restrict removable media and evaluate electromagnetic shielding or fiber-optic display connections in environments handling highly sensitive data. |
|
|
|
Discover hands-off endpoint management that doesn't get out of hand. Powered by AI, grounded in trusted data — all on one unified platform. Explore how your organization can achieve endpoint autonomy without compromise. |
|
|
|
Botnets remain a threat, powering ransomware, credential stuffing, DDoS attacks, and other malware distribution. |
How to reduce botnet risk: |
- Patch any internet-facing systems, disable unnecessary remote access, and enable phishing-resistant MFA on accounts.
- Segment IoT devices onto separate networks to limit lateral movement if a device becomes compromised.
-
Monitor for suspicious traffic with EDR/XDR, SIEM, and SASE platforms, and use threat intelligence solutions to help track C2 activity.
|
Reducing the attack surface and improving visibility remain essential components of an effective botnet defense strategy. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
