# orderedItems[].object.content
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open

Two Russia-aligned campaigns continue exploiting CVE-2025-8088, a WinRAR path traversal vulnerability patched in July 2025, against Ukrainian organizations through April 2026. SHADOW-EARTH-066 deploys an evolved GIFTEDCROOK information stealer using in-memory DLL loading via direct NT system calls, harvesting browser credentials, session cookies, and documents across 35 file extensions before self-deleting. Earth Dahu employs an HTA-based infection chain delivering espionage modules through Cloudflare Workers infrastructure. Both campaigns leverage the same CVE-2025-8088 exploit but use distinct tooling: SHADOW-EARTH-066 relies on compiled C++ with RC4-encrypted C&C communication, while Earth Dahu uses script-based approaches with Dynamic DNS. The persistent exploitation nearly a year post-patch demonstrates how unmanaged software lacking centralized update mechanisms creates enduring attack surfaces that threat actors deliberately target.

Pulse ID: 6a2699c6a6badcc8eac21083
Pulse Link: https://otx.alienvault.com/pulse/6a269 9c6a6badcc8eac21083
Pulse Author: AlienVault
Created: 2026-06-08 10:30:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CandC #Cloud #Cookies #CyberSecurity #DNS #ELF #Espionage #InfoSec #OTX #OpenThreatExchange #RAT #Russia #SMS #UK #Ukr #Ukraine #Ukrainian #Vulnerability #WinRAR #bot #AlienVault

# orderedItems[].object.ephemeral.metadata[].description
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.content
🆕 blog! “How many consecutive hyphens can you have in a domain name?”

A seemingly simple question which sent me down into the murky depths of standards. How many consecutive hyphens can you have in a domain name? It probably isn't sensible to name your online presence a----------hyphen.com - but is there anything technically…

👀 Read more: https://shkspr.mobi/blog/2026/06/how-m any-consecutive-hyphens-can-you-have-in-a-domain-name/
⸻
#dns #ICANN #IETF #internet #standards #web

# orderedItems[].object.content
PowerDNS Authoritative Server 5.1.1 Released

https://blog.powerdns.com/2026/06/08/p owerdns-authoritative-server-5.1.1-released

#dns #dnssec

# orderedItems[].object.ephemeral.metadata[].twitterTitle
PowerDNS Authoritative Server 5.1.1 Released

# orderedItems[].object.ephemeral.metadata[].description
This is the release of Authoritative Server 5.1.1.

# orderedItems[].object.ephemeral.metadata[].ogDescription
This is the release of Authoritative Server 5.1.1.

# orderedItems[].object.ephemeral.metadata[].ogTitle
PowerDNS Authoritative Server 5.1.1 Released

# orderedItems[].object.ephemeral.metadata[].twitterDescription
This is the release of Authoritative Server 5.1.1.

# orderedItems[].object.content
With Cascade 0.1.0 beta1 “Slàinte mhath” we begin our journey to the first production release of our #DNSSEC signing solution.

We rewrote our signer from the ground up using a state machine based architecture, ensuring that each zone pipeline is in a single consistent state at all times.

In addition to built-in pre-signing and pre-publication review hooks, there’s now incremental signing, TSIG support, downstream IXFR, zone persistence, metrics and much more. #DNS

https://blog.nlnetlabs.nl/cascade-beta 1-release/

# orderedItems[].object.ephemeral.metadata[].ogDescription
By Ximon Eighteen

Cascade beta 1 “Slàinte mhath” is out, so this is your opportunity to kick the tires and take it for a spin around your testing grounds!

Cascade is our new purpose built hidden DNSSEC signer. Those lucky enough to be at DNS OARC 46 in Edinburgh in

# orderedItems[].object.ephemeral.metadata[].twitterDescription
By Ximon Eighteen

Cascade beta 1 “Slàinte mhath” is out, so this is your opportunity to kick the tires and take it for a spin around your testing grounds!

Cascade is our new purpose built hidden DNSSEC signer. Those lucky enough to be at DNS OARC 46 in Edinburgh in

# orderedItems[].object.content
Silent Ransom Group Uses DNS Fast Flux in Attacks https://www. securityweek.com/silent-ransom-group-uses-dns-fast-flux-in-attacks/ #SilentRansomGroup #Ransomware #fastflux #DNS

# orderedItems[].object.ephemeral.metadata[].twitterTitle
Silent Ransom Group Uses DNS Fast Flux in Attacks

# orderedItems[].object.ephemeral.metadata[].description
The Silent Ransom Group was caught using DNS fast flux to hide its infrastructure in attacks against law firms and other industries.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure.

# orderedItems[].object.ephemeral.metadata[].ogTitle
Silent Ransom Group Uses DNS Fast Flux in Attacks

# orderedItems[].object.ephemeral.metadata[].twitterDescription
Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure.

# orderedItems[].object.content
Agentic AI Uncovers New China-Linked Cluster OP-512

A newly identified China-linked espionage cluster designated OP-512 has been discovered targeting Internet Information Services (IIS) servers through advanced AI-driven detection. The operation involves deploying a sophisticated custom web shell framework consisting of three components: a file manager with command-and-control notification channel and two cryptographically authenticated command handlers. Each deployment is cryptographically unique, utilizing RSA and RC4 encryption alongside timestomping techniques to evade signature-based detection. The attacker maintained persistence for 75 days before rapid deployment of multiple access paths, privilege escalation tools including BadPotato, SweetPotato, and EfsPotato, and establishment of dual notification channels through DNS and HTTP. The framework employs hex-encoded subdomain queries for self-reporting and automated builder-generated code with randomized variables. This represents the fourth China-linked cluster documented targeting legacy IIS infrast...

Pulse ID: 6a23107727fdc1e824252731
Pulse Link: https://otx.alienvault.com/pulse/6a231 07727fdc1e824252731
Pulse Author: AlienVault
Created: 2026-06-05 18:07:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#China #CyberSecurity #DNS #ELF #Encryption #Espionage #HTTP #InfoSec #OTX #OpenThreatExchange #RAT #bot #AlienVault

# orderedItems[].object.ephemeral.metadata[].description
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.content
After releasing the Cascade beta, NLnet Labs HQ has a @jpmens vs. @bortzmeyer poll going.

#DNS #DNSSEC

# orderedItems[].object.attachment[].name
A poll that asks “How many GitHub issues will JP Mens and Stephane Bortzmeyer create by Monday?”

# orderedItems[].object.content
How to direct more traffic to #IPv6 CDN Endpoints?

#DeLegacy your DNS.

Thank you @mynacol @dxld @miyuru for your work.

How does this work?
Watch @mynacol 's talk

https://media.ccc.de/v/gpn24-503-deleg acy-forcing-ipv6-at-scale

#DNS #BIND #GPN24 #RPZ #unbond #knot #PowerDNS

# orderedItems[].object.ephemeral.metadata[].description
Find out how to increase the proportion of IPv6 traffic by manipulating DNS responses, and how to persuade X/Twitter and Discord to suppo...

# orderedItems[].object.ephemeral.metadata[].ogDescription
Find out how to increase the proportion of IPv6 traffic by manipulating DNS responses, and how to persuade X/Twitter and Discord to suppo...

# orderedItems[].object.content
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts download button clicks into handoffs to a Traffic Distribution System (TDS), which enforces strict gating including first-visit state, click confirmation, anti-bot logic, VPN filtering, and frequency capping. The ecosystem appears primarily built for traffic acquisition and monetization using legitimate ad-tech, but downstream redirect chains repeatedly led selected users to malware delivery infrastructure. The observed payloads include SessionGate (a multi-stage loader with heavy obfuscation delivering potentially unwanted applications), RemusStealer (an infostealer targeting over 20 browsers and hundreds of extensions), and AnimateClipper (a cryptocurrency clipper supporting 20+ blockchain ecosystems). Over 5,000 VirusTotal submissions indicate substantial reach across the ...

Pulse ID: 6a20679f5ade869dcb4bf6b5
Pulse Link: https://otx.alienvault.com/pulse/6a206 79f5ade869dcb4bf6b5
Pulse Author: AlienVault
Created: 2026-06-03 17:42:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Cloud #CyberSecurity #DNS #InfoSec #InfoStealer #Java #JavaScript #Malware #Nim #OTX #OpenThreatExchange #RAT #RCE #Rust #VPN #VirusTotal #bot #cryptocurrency #AlienVault

# orderedItems[].object.ephemeral.metadata[].description
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.content
Inside DesckVB Rat Analysis: From Malspam to In-Memory RAT

DesckVB RAT emerged in February 2026 through a sophisticated malspam campaign utilizing a dynamic delivery kit that personalizes lures on-the-fly by extracting victim email addresses and pulling company logos in real-time. The attack chain routes through Google's DoubleClick domain to evade email gateways before delivering a five-stage infection: HTML redirect, JScript loader, PowerShell dropper, .NET loader, and finally the RAT itself. The malware employs extensive anti-analysis techniques including sandbox detection, forced reboots upon detection, and in-memory execution via .NET reflection. Once established, it patches AMSI and ETW at the native API level, injects into legitimate Microsoft-signed binaries like InstallUtil.exe and MSBuild.exe, and establishes persistence through registry keys and scheduled tasks. The RAT communicates with DDNS-based C2 infrastructure on non-standard ports, performs system reconnaissance including GPU enumeration possibly for crypto mining, and can deliver additional payl...

Pulse ID: 6a20299eb75a686b68713273
Pulse Link: https://otx.alienvault.com/pulse/6a202 99eb75a686b68713273
Pulse Author: AlienVault
Created: 2026-06-03 13:18:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #CyberSecurity #DNS #DoubleClick #ELF #Email #Google #HTML #InfoSec #MSBuild #MalSpam #Malware #Microsoft #NET #OTX #OpenThreatExchange #PowerShell #RAT #RCE #Spam #bot #AlienVault

# orderedItems[].object.ephemeral.metadata[].description
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.content
PowerDNS Authoritative Server 5.1.0 Released

https://blog.powerdns.com/2026/06/03/p owerdns-authoritative-server-5.1.0-released

#dns #dnssec

# orderedItems[].object.ephemeral.metadata[].twitterTitle
PowerDNS Authoritative Server 5.1.0 Released

# orderedItems[].object.ephemeral.metadata[].description
This is the release of Authoritative Server 5.1.0.

# orderedItems[].object.ephemeral.metadata[].ogDescription
This is the release of Authoritative Server 5.1.0.

# orderedItems[].object.ephemeral.metadata[].ogTitle
PowerDNS Authoritative Server 5.1.0 Released

# orderedItems[].object.ephemeral.metadata[].twitterDescription
This is the release of Authoritative Server 5.1.0.

# orderedItems[].object.content
@kistel maintains #Netiscope. Not to be confused with Netskope. 😁
https://github.com/robert-kisteleki/ne tiscope

It's a small #OpenSource tool for checking network connectivity from the #CLI or through an optional local #GUI. It runs checks for local interfaces, #DNS resolvers, open resolvers, root DNS servers, port filtering, #DoH, #SSH host keys and #IPv6 path MTU.

# orderedItems[].object.ephemeral.metadata[].twitterTitle
GitHub - robert-kisteleki/netiscope: Command line tool to check network connectivity

# orderedItems[].object.ephemeral.metadata[].description
Command line tool to check network connectivity. Contribute to robert-kisteleki/netiscope development by creating an account on GitHub.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Command line tool to check network connectivity. Contribute to robert-kisteleki/netiscope development by creating an account on GitHub.

# orderedItems[].object.ephemeral.metadata[].ogTitle
GitHub - robert-kisteleki/netiscope: Command line tool to check network connectivity

# orderedItems[].object.ephemeral.metadata[].twitterDescription
Command line tool to check network connectivity. Contribute to robert-kisteleki/netiscope development by creating an account on GitHub.

# orderedItems[].object.content
More IDN homograph detection research today. This screenshot is a bit horrifying considering how nearly identical many of the invalid entries visually match the valid entry (top).

#DNS #homograph #cybersecurity

# orderedItems[].object.content
Screenshot from my custom (Rust) DNS filtering-forwarder with new experimental runtime IDN homograph detection against a predefined protected domain list.

Screenshot results reflect these punycodes:
xn--ggle-55da.com google.com BLOCK
xn--pypl-53dc.com paypal.com BLOCK
xn--pple-43d.com apple.com BLOCK
xn--fiq228c5hs.cn chinese ALLOW

#DNS #homograph #cybersecurity

# orderedItems[].object.content
This month, Berkeley Internet Name Domain better known as BIND celebrates its 40th anniversary! It was first released with BSD 4.3 in June 1986 🥳🎂🎉

#DNS #BIND

# orderedItems[].object.content
Today I fell down the rabbit hole of detecting and blocking IDN homograph attacks at the DNS level. Some of the homograph domains are clever!

#DNS #homograph #cybersecurity

# orderedItems[].object.anyOf[].name
Recursively resolve from root servers directly.

# orderedItems[].object.content
If you run your own local DNS servers at home, do you: (select all that apply)

Comment with your preferred DNS stack and privacy friendly DNS providers.

#FreeBSD #Linux #selfHosting #DNS

# orderedItems[].object.content
Weekend Reads

* Centrality in the DNS
https://www. potaroo.net/ispcol/2026-05/dns-centrality.html
* RPKI RP fuzzing analysis
https://arxiv.org/abs/2605.26651
* Iran Internet partial restoration
https://blog.cloudflare.com/iran-inter net-partially-restored-may-2026/
* Enterprise security for the AI era
https://arxiv.org/abs/2605.22985
* Characterizing Starlink queuing configuration
https://arxiv.org/abs/2605.27717

#DNS #RPKI #Iran #AI #Starlink

# orderedItems[].object.ephemeral.metadata[].twitterTitle
Batch Me If You Can: Coverage-guided RPKI Fuzzing at Scale

# orderedItems[].object.ephemeral.metadata[].description
Abstract page for arXiv paper 2605.26651: Batch Me If You Can: Coverage-guided RPKI Fuzzing at Scale

# orderedItems[].object.ephemeral.metadata[].ogDescription
The Resource Public Key Infrastructure (RPKI) has become essential to secure inter-domain routing. Despite its critical role, RPKI software remains largely untested beyond shallow parsing. Existing fuzzers, like AFL++ or libFuzzer, do not work well for RPKI as they assume a single, self-contained input per execution, while RPKI repositories contain hundreds of interdependent cryptographically linked objects. Existing fuzzers fail to handle this complexity and lack the ability for precise coverage attribution in multi-object repositories, breaking feedback-based exploration and thereby missing most severe vulnerabilities in RPKI validation. In this paper, we overcome these limitations through novel fuzzing techniques, including continuous sampling and using functions as side-channels for per-object coverage attribution in large input repositories. We further show how parsing inputs to a labeled tree allows structural and semantic mutations while preserving cryptographic validity in mutated repositories. We implement our new techniques into a powerful fuzzing tool called CAT, combining non-sequential fuzzing with our template-agnostic ASN.1 mutation engine to achieve 66x throughput improvement over sequential fuzzing and exploring 24 - 47% more unique code paths compared to libFuzzer and previous work. Evaluating CAT on RPKI validators uncovered 21 previously unknown vulnerabilities with 8 CVEs already assigned (CVSS 7.5 - 9.8). These include a buffer overflow, Denial-of-Service (DoS), and exploitable repository-poisoning logic flaws. We open-source CAT to enable reproducibility, further research, and adaptation of our methods to other complex cryptography-based protocols such as DNSSEC and TLS.

# orderedItems[].object.ephemeral.metadata[].ogTitle
Batch Me If You Can: Coverage-guided RPKI Fuzzing at Scale

# orderedItems[].object.ephemeral.metadata[].twitterDescription
The Resource Public Key Infrastructure (RPKI) has become essential to secure inter-domain routing. Despite its critical role, RPKI software remains largely untested beyond shallow parsing....

# orderedItems[].object.ephemeral.metadata[].twitterTitle
Iran's Internet is partially restored, Cloudflare Radar data shows

# orderedItems[].object.ephemeral.metadata[].description
Cloudflare Radar data confirms early indications of a partial Internet restoration in Iran, nearly three months after the shutdown began. Traffic spikes and DNS queries have risen, but network activity is currently just 40% of pre-shutdown levels.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Cloudflare Radar data confirms early indications of a partial Internet restoration in Iran, nearly three months after the shutdown began. Traffic spikes and DNS queries have risen, but network activity is currently just 40% of pre-shutdown levels.

# orderedItems[].object.ephemeral.metadata[].ogTitle
Iran's Internet is partially restored, Cloudflare Radar data shows

# orderedItems[].object.ephemeral.metadata[].twitterDescription
Cloudflare Radar data confirms early indications of a partial Internet restoration in Iran, nearly three months after the shutdown began. Traffic spikes and DNS queries have risen, but network activity is currently just 40% of pre-shutdown levels.

# orderedItems[].object.ephemeral.metadata[].twitterTitle
Beyond Zero: Enterprise Security for the AI Era

# orderedItems[].object.ephemeral.metadata[].description
Abstract page for arXiv paper 2605.22985: Beyond Zero: Enterprise Security for the AI Era

# orderedItems[].object.ephemeral.metadata[].ogDescription
The rise of autonomous AI agents and the accelerating velocity of corporate data access are stretching the application-centric model of zero trust security to its breaking point. This paper introduces Beyond Zero, a new security paradigm designed for the AI era. The Beyond Zero architecture performs per-resource and method access decisions for humans and agents at machine speed. By shrinking the trust boundary from the application level to the individual action, and by coupling static authorization guarantees with dynamic, AI-driven reasoning, Beyond Zero enables a self-defending enterprise capable of mediating thousands of human and machine decisions per second. This paper outlines Google's vision for the future of this access model as well a call for industry collaboration and standards development.

# orderedItems[].object.ephemeral.metadata[].ogTitle
Beyond Zero: Enterprise Security for the AI Era

# orderedItems[].object.ephemeral.metadata[].twitterDescription
The rise of autonomous AI agents and the accelerating velocity of corporate data access are stretching the application-centric model of zero trust security to its breaking point. This paper...

# orderedItems[].object.ephemeral.metadata[].twitterTitle
Characterizing the Configuration of Starlink Queuing

# orderedItems[].object.ephemeral.metadata[].description
Abstract page for arXiv paper 2605.27717: Characterizing the Configuration of Starlink Queuing

# orderedItems[].object.ephemeral.metadata[].ogDescription
In all networking systems, queuing is important to ensure appropriate resource utilization in the presence of bursty traffic and varying traffic demands. The Starlink access network is additionally also dynamic in terms of the capacity it can provide, and thus queuing plays an even greater role to ensure appropriate communication performance for the end-users while maintaining high resource utilization. However, for Starlink most system design details, along with the setup of the internal queuing, is private information and not publicly available. To address this we have developed a high-precision, burst-pattern controlled, traffic generation approach allowing us to precisely measure the one-way delay for Starlink. By analyzing the delay and loss in conjunction with a queue simulator we find that Starlink does not employ per-flow fair queuing or drop-tail buffers, but it does use drop-front buffer management. While drop-front reduces delay, it may also interfere with the assumptions made by loss-based congestion controls, potentially contributing to throughput degradation.

# orderedItems[].object.ephemeral.metadata[].ogTitle
Characterizing the Configuration of Starlink Queuing

# orderedItems[].object.ephemeral.metadata[].twitterDescription
In all networking systems, queuing is important to ensure appropriate resource utilization in the presence of bursty traffic and varying traffic demands. The Starlink access network is...

# orderedItems[].object.content
A miner with a side of RAT: the unintended gift with your TV show or book

A cybercrime campaign active since at least 2022 has been distributing cryptocurrency miners and RAT malware through illegal streaming sites and digital libraries. Victims are tricked via fake video player plugin updates or browser crash pages into downloading ZIP archives containing legitimate executables and malicious DLLs. The malware employs DLL side-loading, establishes persistence through Windows services, and deploys multiple components including XMRig-based CPU miners, GPU miners, a watchdog module, and a RAT agent with remote control capabilities. The campaign leverages highly popular pirated content sites with monthly traffic reaching up to 40 million visits, significantly expanding the potential victim pool. The malware includes sophisticated anti-detection features, DNS tunneling for command-and-control, and domain generation algorithms based on dates.

Pulse ID: 6a181f75cd4fa08fe38dfc48
Pulse Link: https://otx.alienvault.com/pulse/6a181 f75cd4fa08fe38dfc48
Pulse Author: AlienVault
Created: 2026-05-28 10:56:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberCrime #CyberSecurity #DNS #InfoSec #Malware #OTX #OpenThreatExchange #RAT #WatchDog #Windows #ZIP #bot #cryptocurrency #AlienVault

# orderedItems[].object.ephemeral.metadata[].description
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.ephemeral.metadata[].ogDescription
Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

# orderedItems[].object.content
Yo se que parezco un ladilla con el servidor de correo, pero realmente tener y configurar un servidor de correo en estos días es algo que la mayoria de los sysadmins le rajan. El correo es un bicho tan noble que siempre va a tener prioridad dentro de los servicion de Undernet, pero es un gran desafío por el spam (el cual nosotros mitigamos con amavis+spamassassin con un modelo bayesiano entrenado), entre otros. Con todo el orgullo tengo que decir que nuestro servidor de correo tiene un puntaje casi perfecto, el unico "warning" es que el servidor DNS esta dentdo de la misma subred... chocolate por la noticia, aparte de eso, es perfecto. Mejor que gmail.com, hotmail.com e incluso que disroot.org (aunque por muy poquito, dado que disroot es un muy buen servidor tambien). En la imagen se ve el score de nuestro servidor y otros 2 más #email #correo #undernet #gmail #hotmail #smtp #dns