A Mirai botnet variant has been found exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the goal of conducting distributed denial-of-service (DDoS) attacks.

The botnet maintains approximately 15,000 daily active IP addresses, with the infections primarily scattered across China, Iran, Russia, Turkey, and the United States.

Exploiting an arsenal of over 20 known security vulnerabilities and weak Telnet credentials for initial access, the malware is known to have been active since February 2024. The botnet has been dubbed “gayfemboy” in reference to the offensive term present in the source code.

NonEuclid RAT: C# malware offering remote access, antivirus bypass, and ransomware, active since November 2024.

Chinese hackers exploited BeyondTrust API keys in a major Treasury cyberattack; CISA confirms no wider federal impact.

PLAYFULGHOST malware mimics Gh0st RAT with advanced spyware features, targeting users via phishing and SEO poisoning techniques.

U.S. sanctions Integrity Technology Group for aiding Flax Typhoon’s state-sponsored hacks, targeting U.S. systems since 2021.