Topic
Mass automated scanning and infection of home routers, security cameras and other smart devices to build adversary-controlled relay infrastructure.
FBI and Justice Department investigators seized seven domains that China-linked Flax Typhoon used to scan and in some cases infiltrate critical infrastructure. The risk remains, and with no patch to install, exposed operators have to hunt the group's tradecraft themselves.
Reality
Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
Perspective Coverage
14 publishersReality
FortiGuard Labs says the ClingSTUN Linux backdoor exploits two dozen flaws in a dozen vendors' gear and carries seven more to spread itself. Exploitation is indiscriminate, so any reachable vulnerable device on those lists, Ivanti's included, can join its proxy pool.
Perspective Coverage
3 publishersReality
Nozomi Networks reports a September 5 spike in attacks exploiting CVE-2021-35394, a Realtek SDK flaw patched five years ago, to plant the Cling botnet. Its command-and-control hides inside ordinary STUN traffic, so the beacons resemble legitimate NAT traversal.
Reality
A developer rented boxes in Frankfurt, New York and Singapore, told nobody the addresses, and counted the knocks. One host on Korea Telecom's network sent nearly half the packets, so the background rate only appears once you subtract it.
Reality
Black Lotus Labs assesses the botnet as Chinese state work under Flax Typhoon, assembled from SOHO routers, NVRs, NAS boxes and IP cameras whose 17-day average lifespan makes the infrastructure disposable by design.
Reality
The edited release now says NASA, the Federal Reserve and the Senate were among QTFY's targets. That leaves the public record with seven named agencies and no named breach for anyone to brief a board on.
Reality
A court order killed two Chinese contractor hacking platforms because their command domains were hard-coded into the malware. The pivot hardware they infected is still nobody's asset.
Reality