>decode·13 min
Cling's STUN Disguise Is the Detection Signal
Cling hides its C2 inside STUN traffic to 13 public servers. The protocol it abuses to blend in is exactly what gives it away.
securitymalwareiot
>read more_
> booting the archive…
Loading
[ // tag: #malware ] (4)
>decode·7 min
NeedyMantis backdoor means long-term network access
Microsoft ties NeedyMantis to China-linked Storm-3069 — DLL sideloading, custom archives and WebSockets C2 built to outlast the initial breach.
cybersecuritythreat-intelligencemalware
>read more_
>decode·7 min
Carbonato: a Docker botnet run through an AI agent
CARBONATO hijacks exposed Docker hosts, installs Hermes Agent, rewrites its persona, then drives them via Telegram. AI does post-exploitation, scripts spread.
malwareai-agentsinfrastructure
>read more_
>decode·6 min
CLOSEDQUORUM: AI Models Vote on the Next Move
Cisco Talos found CLOSEDQUORUM, a Windows implant that lets DeepSeek, Qwen, Mistral and Gemini vote on what it does next, with no human C2 panel at all.
aicybersecuritythreat-intelligence
>read more_