CloudSEK Updates

Thousands of routers, surveillance cameras, and enterprise servers are being exploited in a global botnet operation known as Doorway. CloudSEK’s investigation uncovered 41 GB of exposed operational data, revealing 59 exploit modules, automated credential attacks, and sophisticated malware delivery mechanisms. With 11,363 device joins recorded in a single hour, the investigation exposes how cybercriminals systematically compromise devices and build proxy infrastructure at scale.

A new Android malware operation called MR ROBOT is turning banking fraud into a subscription business. CloudSEK’s investigation reveals how cybercriminals rent customised banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. One tracked affiliate intercepted 5,407 SMS messages across 153 infected devices, exposing the scale of this Malware-as-a-Service operation targeting Indian bank customers.

CloudSEK researchers uncovered fake Adobe Acrobat and “View & Sign” pages distributing legitimate, digitally signed ConnectWise ScreenConnect installers configured for unauthorized remote access. The campaign uses Telegram bots to track visitors, profiles devices and networks, and automatically downloads remote-access clients. The findings highlight how attackers can weaponize trusted software to potentially gain persistent access to Windows systems, bypassing traditional security checks based on file signatures.

CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams.

A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. CloudSEK traced 50TB of exposed infrastructure and a live AI-driven attack chain. Read how "Caught in 4K" cracked the operation.

CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months.

CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code.

CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed.

CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions.