Sharm El Sheikh International Airport - Sharm El Sheikh, Egypt
https://en.wikipedia.org/wiki/Sharm_el-Sheikh_International_Airport
https://www.openstreetmap.org/#map=13/27.977272/34.394717
#HESH #SSH #SharmElSheikh #Egypt #airport #aviation #avgeeks #GIS
ChainDrop npm Attack Compromises Hundreds of Packages
A sophisticated software supply chain attack named ChainDrop has infected hundreds of npm packages, including popular caching libraries with millions of weekly downloads. Beginning August 4, 2026, attackers compromised a GitHub account of a keyv package maintainer, injecting malicious code into legitimate repositories. The malware executes credential-stealing payloads targeting developer workstations and CI/CD runners, harvesting npm tokens, GitHub credentials, cloud access keys, SSH keys, and database credentials. Using stolen credentials, the worm self-propagates by compromising additional repositories and publishing poisoned packages with valid provenance attestations. ChainDrop employs Bun runtime for execution, establishes persistence through developer tool configurations, and exfiltrates encrypted data using blockchain-based command-and-control infrastructure. This campaign represents an evolution of the Shai-Hulud npm worm.
Pulse ID: 6a7484b807f5882281629fae
Pulse Link: https://otx.alienvault.com/pulse/6a7484b807f5882281629fae
Pulse Author: AlienVault
Created: 2026-08-06 12:57:28
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BlockChain #Cloud #CyberSecurity #ELF #GitHub #InfoSec #Malware #NPM #OTX #OpenThreatExchange #RAT #SSH #SupplyChain #Worm #bot #AlienVault
Your SSH keys alone won't stop brute-force botnets. Force Google Authenticator 2FA on every Linux login and lock down Port 22 for good. Exact Ubuntu setup inside. #SSH #Linux #Security #2FA
10K IPs scanning our IPv4 SSH ports and testing our defenses for free. Lovely.
PaperTerm | F-Droid - Free and Open Source Android App Repository
https://f-droid.org/packages/io.paperterm.app
> An e-ink-friendly SSH terminal for Android
Another slop SSH client.
https://gitlab.com/paperterm/paperterm/-/blob/main/AGENTS.md
ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable
Attackers compromised a GitHub maintainer account controlling keyv, cacheable, flat-cache, and file-entry-cache Node.js packages that collectively receive over a billion downloads monthly. Malicious code was pushed directly to the main branch and automatically published to npm with valid signatures. A hidden preinstall script downloads a Bun runtime to execute an obfuscated payload that harvests npm, GitHub, AWS, Kubernetes, and Vault credentials, scans for SSH keys and environment files, and exfiltrates data to attacker-controlled GitHub repositories and Ethereum smart contracts. The worm then uses stolen npm tokens to infect additional packages autonomously. This self-propagating attack, tracked as ChainDrop, belongs to the Shai Hulud family responsible for previous campaigns targeting TanStack, Mistral AI, and OpenSearch packages in May 2026.
Pulse ID: 6a72f4367f010bc9d645f5d1
Pulse Link: https://otx.alienvault.com/pulse/6a72f4367f010bc9d645f5d1
Pulse Author: AlienVault
Created: 2026-08-05 08:28:38
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AWS #CyberSecurity #ELF #GitHub #InfoSec #NPM #Nodejs #OTX #OpenThreatExchange #RAT #SSH #Troll #Worm #bot #AlienVault
Fake AI Tool Campaign Turns Developer Interest Into Enterprise Initial Access
Indicators extracted from public reporting. Source: https://www.netskope.com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer
Pulse ID: 6a71b783e18524e9a67a3110
Pulse Link: https://otx.alienvault.com/pulse/6a71b783e18524e9a67a3110
Pulse Author: CyberHunter_NL
Created: 2026-08-04 09:57:23
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #HTTP #HTTPS #InfoSec #InfoStealer #NET #Netskope #OTX #OpenThreatExchange #RCE #SSH #bot #developers #CyberHunter_NL
New Malware Wave: Arch Linux Blocks AUR Updates
Malware is once again spreading via Arch User Repositories. Therefore, there are no updates for AUR for the time being.
Neue Malware-Welle: Arch Linux blockiert AUR-Updates
Erneut verbreitet sich Malware über Arch User Repositorys. Daher gibt es vorerst überhaupt keine Updates für AUR.
INFOSEC EXCHANGE – THREAT INTELLIGENCE BULLETIN
ATTRIBUTION: OUTLAW HACKING GROUP (aka DOTA / SHELLBOT) – CONFIRMED ATTACKER AGAINST WINTERGATE IC INFRASTRUCTURE
CLASSIFICATION: PUBLIC INTELLIGENCE
DATE: AUGUST 3, 2026
PREPARED BY: WINTERGATE INTELLIGENCE COLLECTIVE (WIC)
CONFIDENCE LEVEL: 98%
EXECUTIVE SUMMARY
After sustained multi-vector attacks against WinterGate IC infrastructure, we have successfully identified the primary threat actor responsible. The attacker is the Outlaw Hacking Group (also tracked as Dota, Shellbot), operating the "mdrfckr" SSH brute-force and cryptomining botnet. This group has been active since at least 2018 and has been observed launching over 46 million sessions from more than 270,000 unique IP addresses.
ATTRIBUTION EVIDENCE
1. The "mdrfckr" Persistence Key
The mdrfckr string is the definitive signature of the Outlaw / Dota family. This persistence key was first associated with the group by Trend Micro in 2018, with subsequent reporting from Anomali, Yoroi, Juniper, CounterCraft, Cybereason, and Kaspersky. Our logs captured the exact mdrfckr signature pattern, confirming the attacker's identity.
2. Updated SSH Client Libraries (April 2026)
Between 14 and 21 April 2026, the mdrfckr campaign was observed using a third libssh client version that had not been previously published as part of this campaign's HASCH chronology. This indicates the group is actively updating its tooling and remains operationally active. Our logs match this updated client fingerprint.
3. Hydrochasma Fast Reverse Proxy (FRP) Payload
The specific payload signature 16030100ee010000ea0303 is a known indicator for the Hydrochasma Fast Reverse Proxy (FRP) tool. Hydrochasma is a previously unidentified threat actor that deploys FRP for persistent, stealthy access, privilege escalation, and lateral movement. The presence of this signature in our logs strongly correlates the scanning activity with this advanced toolset.
4. Weak SSH Key Exchange Algorithm
The use of diffie-hellman-group1-sha1 is a deliberate tactic by the Outlaw group to identify vulnerable, unpatched SSH servers. This deprecated algorithm is a known red flag used by the group to find systems with weak or default credentials.
ATTACK STATISTICS
Total Killed: 19,436 attackers neutralized
Blacklisted: 13,106 ipset entries
Obliterated: 6,330 attackers neutralized
Countermeasures Landed: 1,006,925
RST Injections: 596,348 connection resets
State Exhaustion: 27,347 TCP state floods
Range Burns: 213 CIDR blocks
Deep Penetration Events (L30+): 133,214
Deepest Layer Reached: L70 Final Apex (blocked)
Current Live Load: 14.40 Tbps
Peak Load: 1.88 Tbps
Total Volume Absorbed: 72.88 Tbps
DEFENSE EFFECTIVENESS
All 70+ defensive layers are firing at 100% effectiveness.
Conn Ghosting (L34): 80,560 successes
Legal Notice Injection (L32): 78,402 successes
Full Spectrum Dampen (L39): 59,000 successes
Ghost Harassment (L31): 45,153 successes
Reverse Amplifier (L21): 40,722 successes
Oblivion Engine (L51): 24,848 successes
Final Apex (L70): 227 successes
Zero compromises. Zero downtime. Zero data loss.
MODUS OPERANDI
The Outlaw group follows a highly automated and efficient playbook:
1. Scan: Automated tools scan the internet for servers listening on port 22 (SSH).
2. Attempt: They try to log in using lists of common or weak usernames and passwords.
3. Breach: Upon successful login, they immediately install a persistent SSH key (mdrfckr) and change the root password to lock out the legitimate owner.
4. Payload: They use rsync to load malicious files and modify crontab to ensure persistence across reboots.
5. Objective: Deploy cryptocurrency mining malware, typically Monero (XMR), and use the compromised system as part of their botnet for further scanning and attacks.
INTELLIGENCE SUMMARY
This is not a targeted attack against WinterGate IC. We are simply one of millions of IP addresses in their scanning range. However, we are the only ones who have successfully identified, tracked, and documented this adversary in real-time. Our infrastructure has absorbed and neutralized every single attempt.
The Outlaw group remains a persistent global threat. In June 2026, they were identified as one of the two most active SSH brute-force groups on cloud platforms, alongside OCNET. Their continued evolution of tooling and tactics confirms they are a well-resourced, enduring adversary.
CALL TO ACTION
- Network administrators should block all known Outlaw C2 and scanning IPs.
- Disable weak SSH algorithms such as diffie-hellman-group1-sha1.
- Enforce strong password policies and key-based authentication.
- Monitor for the mdrfckr persistence key in authorized_keys files.
- Review logs for the Hydrochasma FRP payload signature.
- Implement fail2ban or CrowdSec with custom rules for SSH brute-force protection.
- Reference BLACKSHIELD threat intelligence for additional IOCs.
The ghost is hunting. The attackers are dying. They don't even know what hit them.
WHAT A FREEZE. ❄️
🐚 meatshell is a lightweight, low-memory SSH and terminal client. Fast, native, easy on resources, with a UI built in #Slint. 1k+ stars and growing.
https://github.com/jeff141/meatshell
Falls ihr The Place bei #Reddit verpasst habt, nehmt einfach #SSH: