RSS Parrot

Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria

https://blog.xlab.qianxin.com/botnet-rising-star-the-evolution-and-in-depth-technical-analysis-of-dysphoria/

Published: July 29, 2026 02:09

This report is jointly published by the CNCERT and XLAB. Since Q1 2026, XLab has been continuously tracking an emerging botnet family named Dysphoria whose bot population exceeds 200,000. Within just a few months this family has gone through frequent…

僵尸网络新秀：Dysphoria 演进与深度技术分析

https://blog.xlab.qianxin.com/dysphoria/

Published: July 25, 2026 10:31

本报告由国家互联网应急中心（CNCERT）与奇安信网神信息技术(北京)股份有限公司共同发布 自 2026 年第一季度以来，XLAB持

NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era

https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era-en/

Published: July 17, 2026 08:14

Overview In early July 2026 we observed a Go-based botnet pushing bot samples onto the internet at scale. It folds scanning, exploitation, and credential/AI-service intelligence harvesting into a single autonomous platform. Because its controller calls…

NadMesh僵尸网络分析：AI服务时代的产品级威胁

https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era/

Published: July 17, 2026 04:27

本文由中国联通与奇安信共同成立的CU-Xlab联合实验室共同发布 概述 2026 年 7 月初，我们注意到一个用 Go 语言编写的僵尸

RustDuck: An In-Depth Analysis of a Two-Stage Botnet

https://blog.xlab.qianxin.com/rustduck-en/

Published: June 30, 2026 13:17

Overview Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants,…

RustDuck: 双阶段僵尸网络深度剖析

https://blog.xlab.qianxin.com/rustduck/

Published: June 30, 2026 03:26

概述 自 2026 年 2 月起，XLAB大网威胁感知系统监测到一种新型的、采用 Loader + Core（双阶段加载） 架构的恶意软件家族活跃于

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers

https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-legacy-routers-for-global-attacks-en/

Published: June 17, 2026 13:43

Background On May 20, 2026, the Ministry of State Security's WeChat official account published an article "Your internet is slow, and the culprit turns out to be this!", highlighting that outdated routers are becoming a key entry point for threat actors to…

隐形毒刺：超4000台老旧路由器遭AryStinger入侵，沦为黑客全球攻击跳板

https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-legacy-routers-for-global-attacks/

Published: June 17, 2026 05:47

背景 "境外间谍情报机关利用我国境内老旧、过保的路由器作为网络攻击的“跳板”，向特定目标（如重点单位工

Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks

https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/

Published: May 21, 2026 12:26

Background On May 7, 2026, XLab detected a poisoning incident targeting Ghost CMS belonging to one of important clients. The attacker exploited the high-risk SQL injection vulnerability CVE-2026-26980 in Ghost CMS to obtain the target site's Admin API Key…

黑客利用 CVE-2026-26980 攻陷 Ghost CMS，大量站点沦为 ClickFix 攻击帮凶

https://blog.xlab.qianxin.com/ghost-cms-page-poisoning-cve-2026-26980/

Published: May 21, 2026 04:09

背景介绍 2026年5月7日，XLab监测到一起针对重要客户Ghost CMS的投毒事件。攻击者利用Ghost CMS高危SQL注入漏洞CVE-2026-26980，未授权

Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment

https://blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-critical-cpanel-flaws-for-backdoor-deployment/

Published: May 11, 2026 12:49

Background CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as…

秘密活动6年的神秘黑客组织Mr_Rot13正在利用cPanel高危漏洞部署后门木马

https://blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-critical-cpanel-flaws-for-backdoor-deployment_cn/

Published: May 11, 2026 06:28

背景 CVE-2026-41940 是一个影响 cPanel & WHM 的高危未授权认证绕过漏洞。该产品广泛应用于 Linux 服务器运维与虚拟主机管理。漏洞 CVSS 评

Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks

https://blog.xlab.qianxin.com/funnull-resurfaces-exposing-ringh23-arsenal-and-maccms-supply-chain-attacks/

Published: March 2, 2026 13:18

Background Funnull (Funnull Technology Inc.), also known as Fangneng CDN, is a Philippines-registered company that publicly claims to provide CDN services. In reality, it has long operated as a key infrastructure provider for Southeast Asia’s cybercriminal…

围剿FUNNULL黑产：深度揭秘RingH23与MacCMS投毒攻击链

https://blog.xlab.qianxin.com/exposing-funnull-how-ringh23-maccms-are-poisoning-the-web/

Published: February 27, 2026 04:26

背景介绍 Funnull（全称 Funnull Technology Inc.，中文又称方能CDN或方能科技）是一家注册在菲律宾的公司，表面上看是一家提供CDN（内

针对飞牛 NAS 的僵尸网络Netdragon 快速分析

https://blog.xlab.qianxin.com/netdragon/

Published: February 12, 2026 03:29

背景 近期，飞牛（fnOS）网络附加存储设备（NAS）曝出大规模遭入侵并感染恶意软件的安全事件。攻击者疑似利用飞