Malware & Threats Sophisticated Quasar Linux RAT Targets Software Developers The persistent, evasive implant provides remote access, surveillance, and credential exfiltration capabilities. Ionut ArghireMay 6, 2026
Malware & Threats VoidLink Linux Malware Framework Targets Cloud Environments Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits. Ionut ArghireJanuary 15, 2026
Malware & Threats Sophisticated Koske Linux Malware Developed With AI Aid The Koske Linux malware shows how cybercriminals can use AI for payload development, persistence, and adaptivity. Eduard KovacsJuly 25, 2025
Malware & Threats Prometei Botnet Activity Spikes Palo Alto Networks has observed a spike in Prometei activity since March 2025, pointing to a resurgence of the botnet. Ionut ArghireJune 24, 2025
Ransomware Albabat Ransomware Expands Targets, Abuses GitHub New versions of the Albabat ransomware target Windows, Linux, and macOS, and retrieve configuration files from GitHub. Ionut ArghireMarch 24, 2025
Malware & Threats New ‘Auto-Color’ Linux Malware Targets North America, Asia New Linux malware named Auto-Color, which allows full remote access to compromised devices, targets North America and Asia. Eduard KovacsFebruary 26, 2025
Malware & Threats New ‘Hadooken’ Linux Malware Targets WebLogic Servers The recently observed Hadooken malware targeting Oracle WebLogic applications is linked to multiple ransomware families. Ionut ArghireSeptember 13, 2024
Malware & Threats 400,000 Linux Servers Hit by Ebury Botnet The Ebury Linux botnet has ensnared over 400,000 Linux systems in 15 years, with roughly 100,000 still infected. Ionut ArghireMay 15, 2024
Malware & Threats Magnet Goblin Delivers Linux Malware Using One-Day Vulnerabilities The financially motivated threat actor Magnet Goblin is targeting one-day vulnerabilities to deploy Nerbian malware on Linux systems. Ionut ArghireMarch 11, 2024
Malware & Threats Linux Malware Campaign Targets Misconfigured Cloud Servers A new malware campaign has been observed targeting misconfigured Apache Hadoop, Confluence, Docker, and Redis instances. Ionut ArghireMarch 6, 2024