Major Incidents or Breaches

  • Researchers have disclosed a persistent nine-month campaign by the RondoDox botnet, which has hijacked IoT devices and web applications by exploiting a critical vulnerability (React2Shell). Compromised devices are being enrolled into the botnet for further malicious activity.
  • A new wave of the GlassWorm malware campaign is targeting macOS developers. Attackers are distributing trojanized crypto wallet applications via malicious VSCode/OpenVSX extensions.

Newly Discovered Vulnerabilities

  • The React2Shell vulnerability has been identified as a critical flaw actively exploited by the RondoDox botnet to compromise IoT devices and web servers.

Notable Threat Actor Activity

  • The RondoDox botnet operators have been attributed to a sustained campaign targeting IoT and web infrastructure, leveraging the React2Shell vulnerability for botnet expansion.
  • GlassWorm threat actors are focusing on macOS environments, specifically targeting developers with supply chain attacks through compromised development tools and extensions.

Trends, Tools, or Tactics of Interest

  • There is an observable trend of threat actors leveraging supply chain attacks against developer ecosystems, particularly through malicious extensions for widely used tools such as VSCode and OpenVSX.
  • Botnet operators are increasingly exploiting vulnerabilities in IoT devices and web applications to expand their infrastructure and capabilities.
  • Attackers are using trojanized crypto wallet applications to target users in the cryptocurrency sector, with a focus on macOS platforms.