Topic
Security vendor research units analyzing leaked datasets to verify attacker claims and estimate the scale of exposed infrastructure.
Hunt.io says one operator brute-forced its way through more than 14,000 internet-exposed cameras in five weeks. The tooling was borrowed; the exposure did the work.
Perspective Coverage
6 publishersReality
Zscaler tracked three changes to Vidar's string encryption between early May and early September 2026, ending in a per-build virtual machine and stream cipher that make a key pulled from one sample useless against the next.
Reality
SOCRadar's teardown of the $250-a-month service puts the elevation step behind an administrator account and permissive UAC settings, so on a fleet of standard users the rental buys remote access and credential theft and stops there.
Reality
Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.
Reality
The Windows implant, its Linux control server, the protocol between them and the licensing all came from one author, sold at $250 a month. SOCRadar puts the operator's undetected run at nearly four years.
Reality
Unit 42 committed a fresh, overly permissive AWS key to a random GitHub repository with the usual quarantine policy switched off, then timed how long a cryptojacking crew took to find it and start mining.
Reality