Research from the front line of cybercrime.
Aqua Nautilus research, plus Flare and Cyera work by Assaf Morag.
2026 (33)
- Flare · 2026-10-08 · Malware and botnets, Threat actors and cybercrimeHealthcare: Cybercrime's Highest-Value TargetRansomware gangs hit healthcare hard, and US victims make up most of the attacks tracked on underground Telegram channels.
- Flare · 2026-10-06 · Malware and botnetsCrocoRat Adds a New Twist to ClickFix with DNS Payload DeliveryA new RAT and crypto stealer that uses ClickFix lures and DNS queries to deliver payloads matched to each victim's host.
- Flare · 2026-10-01 · Threat actors and cybercrimeSpanish Carding Tutorial: How Fraudsters ThinkA 2026 Spanish-language carding tutorial on a fraud marketplace shows a beginner's playbook for stealing card data in Spain.
- Cyera · 2026-09-30 · Threat actors and cybercrime, Identity and SaaSAuthorization Abuse: The Reality of SaaS PhishingHow attackers abuse legitimate SaaS authorization to phish users.
- Flare · 2026-09-29 · Threat actors and cybercrimeHacker-for-Hire Economy: Inside Cyber MercenariesCyber mercenaries sell offensive services on the dark web with posted prices, customer reviews and escrow, much like any online store.
- Malanta · 2026-09-28 · Malware and botnets, Threat actors and cybercrimeTwo malware domains. Twenty-one hosts behind them.Malanta researchers traced two ClickFix malware domains to 21 hosts behind a cloaker-gated delivery chain in a Russian-speaking cybercrime cluster.
- Cyera · 2026-09-24 · Threat actors and cybercrime, AI and agentsShinyHunters at Scale: A Case Study in AI-Assisted CybercrimeA case study of AI-assisted cybercrime at scale, built around the ShinyHunters group.
- Cyera · 2026-09-22 · Threat actors and cybercrime, Identity and SaaSWhy a Hacker's Stolen Directory Data Claims Matter More Than You ThinkClaims that a hacker stole directory data can matter more than they first seem, and this piece explains why.
- Flare · 2026-08-24 · Threat actors and cybercrimeWhat Is EvilTokens? Inside the PhaaS PlatformEvilTokens changes the phishing-as-a-service model by selling the stage after the victim logs in, not only the phishing page.
- Cyera · 2026-08-13 · AI and agentsThe Hidden Attack Surface of Agentic AI: Securing AI Agent Integration PlatformsHow AI agent integration platforms can widen the attack surface, and how to secure them.
- Flare · 2026-08-07 · Malware and botnets, Threat actors and cybercrimeFirewallFalcon Manager: Backdoor in Underground VPN ToolsA fake open-source Linux VPN manager carries a layered backdoor aimed at VPN resellers and the servers they rent out.
- Cyera · 2026-08-07 · Vulnerabilities and misconfigurations, AI and agentsLocal AI Security Fragility: Vulnerabilities Inside the Engine Running Your Local ModelsVulnerabilities found inside the engine that runs local AI models on a user's own machine.
- Flare · 2026-07-27 · Threat actors and cybercrime, Supply chain and secrets, Identity and SaaSKali365: The Phishing-as-a-Service Operation Expanding Beyond Microsoft 365A phishing service that tricks victims into finishing a real Microsoft login and MFA, so the attacker gets the session tokens.
- Flare · 2026-07-23 · Malware and botnets, Threat actors and cybercrime, Supply chain and secretsImpact Analysis of Ransomware Attacks on EMEA HealthcareRansomware gangs now go after the whole healthcare supply chain in EMEA, not just hospitals.
- Flare · 2026-07-07 · Malware and botnets, AI and agentsMycelium Framework: AI-as-a-Service BotnetMycelium turns a botnet of compromised machines into a rentable AI compute service, a shift from older botnet monetization.
- Flare · 2026-07-06 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, Supply chain and secrets15,000+ Leaked Healthcare Secrets Found: Code Blue in the Server RoomOver 15,000 publicly visible items exposed healthcare secrets, including live production credentials and cloud admin keys.
- Flare · 2026-06-04 · Threat actors and cybercrimeThe Underground Economy of Illegal 2026 FIFA World Cup StreamingIllegal sports streaming draws fans in, and threat actors use that demand as a way into wider cybercrime operations.
- Flare · 2026-05-28 · Threat actors and cybercrimeChinese-Language Gambling Infrastructure Targets the World CupA large Chinese-language betting network used World Cup and FIFA branding to draw traffic, promote offshore sites and scale fraud.
- Flare · 2026-05-13 · Threat actors and cybercrime7 Red Flags to Avoid a 2026 World Cup Ticket ScamSeven warning signs that help World Cup fans spot ticket scams that copy real resale transactions closely.
- Flare · 2026-05-07 · Malware and botnets, Threat actors and cybercrimePamDOORa: A New Linux PAM-Based Backdoor for Sale on the Dark WebA Linux PAM backdoor for sale on the dark web, built to keep access to servers over OpenSSH after an initial breach.
- Flare · 2026-05-06 · Malware and botnetsHow World Cup Hype Fuels a Global Mobile Malware EcosystemSoccer hype feeds a mobile-first chain of illegal betting apps, fake platforms and malware delivery that reaches fans worldwide.
- Flare · 2026-04-29 · Malware and botnets, Supply chain and secrets, Identity and SaaSTracing the 2026 World Cup Infostealer PipelineIndustrialized credential theft by infostealer malware leaves a growing pool of stolen logins as the World Cup nears.
- Flare · 2026-04-22 · Threat actors and cybercrimeInside the World Cup 2026 Ticket Fraud OperationResale of World Cup tickets sits very close to outright fraud, and fans who search for tickets online can lose thousands.
- Flare · 2026-04-22 · Threat actors and cybercrimeMassive World Cup Consumer Fraud Infrastructure Targets FansA large phishing and fraud network built around World Cup excitement, aimed at everyday consumers.
- Flare · 2026-03-16 · Threat actors and cybercrimeHow Threat Actors Abuse Bench.shAttackers have repeatedly used Bench.sh, an open-source recon script, in real intrusions over several months.
- Flare · 2026-03-12 · Malware and botnets, Threat intelligence methodsWebshells Threat Hunting: A Data-Driven Look Beyond BackdoorsWebshells are often seen as simple backdoors, but the modern landscape is more varied, as this data-driven analysis shows.
- Flare · 2026-03-02 · Threat actors and cybercrimeScams in the Cybercrime Haute Couture Fashion EconomyA look at the cybercrime side of the luxury fashion trade, covering counterfeit goods, money laundering and scams.
- LucidBit Labs · 2026-02-25 · Vulnerabilities and misconfigurationsStrong Cryptography, Weak Assumptions: Breaking Trust in Mobile Crypto WalletsFlaws in a mobile crypto wallet’s app code let attackers get around strong cryptography and put users’ funds at risk.
- Flare · 2026-02-05 · Cloud and Kubernetes, Malware and botnets, Threat actors and cybercrimeThreat Alert: TeamPCP, An Emerging ForceA worm campaign from December 2025 that hit exposed Docker, Kubernetes, Ray and Redis services with ransomware, extortion and mining.
- Flare · 2026-01-26 · Vulnerabilities and misconfigurations, Supply chain and secrets, Threat intelligence methodsMongoDB Ransom Isn't Back: It Never LeftMongoDB ransom attacks never really stopped, and a honeypot of leaked secrets shows what is still reachable online.
- Flare · 2026-01-15 · Threat actors and cybercrime, Threat intelligence methodsThe Phishing Kits Economy in Cybercrime MarketsAnalysis of 8,627 chats about phishing kits shows how the trade grew from basic social engineering into technical operations.
- Flare · 2026-01-08 · Malware and botnets, Threat actors and cybercrimeThe Anatomy of a Modern Golang SSH Brute-Force MalwareA walkthrough of a Golang SSH brute-force malware, showing how attackers scale open-source tools against servers.
- Flare · 2026-01-05 · Malware and botnets, Vulnerabilities and misconfigurations, Threat intelligence methodsSafePay Ransomware: Mapping the Real Victims Behind the Leak SitesLooking at 500 SafePay leak records to map the victims the group has posted.
2025 (9)
- Flare · 2025-12-22 · Cloud and Kubernetes, Malware and botnets, Threat actors and cybercrimeCryptomining Supply-Chain Abuse on Docker HubSeveral cryptomining campaigns used Docker Hub to spread malicious container images at a large scale.
- Flare · 2025-12-10 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, Supply chain and secretsThousands of Exposed Secrets Found on Docker HubOver one month, Docker Hub images leaked live credentials for production systems at more than 100 companies.
- Flare · 2025-12-04 · Threat actors and cybercrime, Vulnerabilities and misconfigurationsSessionReaper (CVE-2025-54236) Cybercrime DiscussionsThe cybercrime chatter around the SessionReaper flaw, CVE-2025-54236, across dark web forums and Telegram.
- Malanta · 2025-12-03 · Malware and botnets, Threat actors and cybercrimeWhat If Indonesia's Gambling Network Is Actually a State-Aligned Cyber Operation?Malanta researchers describe a decade-plus Indonesian gambling cyber-crime ecosystem with APT-like scale, domain hijacking and mobile malware.
- Aqua Security · 2025-09-10 · Malware and botnets, Threat intelligence methodsInvestigate and Respond to Sobolan Malware with Aqua SecurityLearn how to analyze and mitigate Sobolan malware attacks using Aqua's security tools and incident response capabilities.
- Aqua Security · 2025-07-24 · Cloud and Kubernetes, Malware and botnets, Threat actors and cybercrimeAI-Generated Malware in Panda Image Hides Persistent Linux ThreatNew research reveals how threat actors are using AI-generated malware hidden in container images to create persistent backdoors on Linux systems.
- Aqua Security · 2025-04-02 · Threat actors and cybercrime, Vulnerabilities and misconfigurations, Threat intelligence methodsTomcat in the Crosshairs: New Research Reveals Ongoing AttacksApache Tomcat servers are being actively targeted by threat actors in a new campaign that exploits misconfigurations and vulnerabilities.
- Aqua Security · 2025-03-10 · Malware and botnets, Threat actors and cybercrimeStopping Sobolan Malware with Aqua Runtime ProtectionAqua Nautilus researchers have discovered a new attack campaign targeting interactive computing environments such as Jupyter Notebooks.
- Aqua Security · 2025 · Malware and botnets, Threat intelligence methodsInvestigate and Respond to Sobolan MalwareComprehensive guide on how to investigate and respond to Sobolan malware incidents using Aqua Security tools and incident response best practices.
2024 (5)
- Aqua Security · 2024-11-26 · Threat actors and cybercrime, Vulnerabilities and misconfigurations, Threat intelligence methodsMatrix Unleashes A New Widespread DDoS CampaignThreat actors are leveraging misconfigured servers to launch distributed denial-of-service attacks at an unprecedented scale.
- Aqua Security · 2024-11 · Threat actors and cybercrime, Vulnerabilities and misconfigurations, Threat intelligence methodsThreat Actors Hijack Misconfigured Servers for Live Sports StreamingCybercriminals are exploiting misconfigured servers to host illegal live sports streaming services, generating revenue while evading detection.
- Aqua Security · 2024-10 · Cloud and Kubernetes, Threat actors and cybercrime, Threat intelligence methodsTeamTNT's Docker Gatling Gun CampaignThe notorious TeamTNT threat group has launched a new campaign targeting Docker environments with automated attack tools.
- Aqua Security · 2024-06 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, Supply chain and secretsUndetected Secrets Expose Major CorporationsHard-coded secrets in container images and applications are exposing Fortune 500 companies to significant security risks.
- Aqua Security · 2024-03 · Cloud and Kubernetes, Threat actors and cybercrime, Threat intelligence methodsTeamTNT Reemerged with New Aggressive Cloud CampaignThe threat group TeamTNT has returned with a new aggressive campaign targeting cloud-native infrastructure, demonstrating evolved attack techniques.
2023 (12)
- Aqua Security · 2023-11-21 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, Supply chain and secretsThe Ticking Supply Chain Attack Bomb of Exposed Kubernetes SecretsMillions of Kubernetes secrets are exposed through misconfigured registries, creating a massive supply chain attack vector.
- Aqua Security · 2023-06 · Threat intelligence methods2023 Nautilus Cyber Security Report - Insights RevealedComprehensive analysis of cybersecurity threats and trends based on Aqua Nautilus research throughout 2023.
- Aqua Security · 2023-04-24 · Cloud and Kubernetes, Vulnerabilities and misconfigurations250M Artifacts Exposed via Misconfigured RegistriesA comprehensive security research reveals that over 250 million container artifacts are exposed due to misconfigured registries, putting Fortune 500 companies at risk.
- Aqua Security · 2023-02 · Malware and botnetsHeadCrab: A Novel State-of-the-Art Redis MalwareAqua Nautilus discovers a sophisticated Redis backdoor malware that has been operating undetected, compromising servers worldwide.
- Aqua Security · 2023 · Malware and botnetsHeadCrab 2.0: Evolving Threat in Redis Malware LandscapeThe HeadCrab malware has evolved into version 2.0, demonstrating enhanced capabilities and more sophisticated evasion techniques in targeting Redis servers.
- Aqua Security · 2023 · Vulnerabilities and misconfigurationsNew Vulnerability in curl and libcurl Could Lead to Heap Buffer OverflowCritical vulnerability discovered in curl and libcurl that could lead to heap buffer overflow, affecting millions of applications worldwide.
- Aqua Security · 2023 · Malware and botnets, Threat actors and cybercrime, Vulnerabilities and misconfigurationspg_mem: A Malware Hidden in the Postgres ProcessesA campaign targeting internet-facing Postgres databases exploits weak passwords to deploy malware that hides within Postgres processes, evading detection mechanisms.
- Aqua Security · 2023 · Malware and botnets, Vulnerabilities and misconfigurationsKinsing Malware Exploits Novel OpenFire VulnerabilityThe Kinsing malware group is exploiting a newly discovered vulnerability in OpenFire chat servers to gain initial access and deploy cryptomining malware.
- Aqua Security · 2023 · Malware and botnets, Vulnerabilities and misconfigurationsLoony Tunables Vulnerability Exploited by KinsingThe Kinsing malware group is actively exploiting the critical Loony Tunables vulnerability (CVE-2023-4911) to gain root privileges and establish persistent access to compromised systems.
- Aqua Security · 2023 · Cloud and Kubernetes, Malware and botnetsProtect Containers from pg_mem Malware with Aqua Runtime SecurityGuidance on using Aqua Runtime Security to detect and protect against pg_mem malware that hides within Postgres processes.
- Aqua Security · 2023 · Supply chain and secretsGitHub Action tj-actions/changed-files CompromisedSecurity alert: The popular GitHub Action tj-actions/changed-files has been compromised, potentially affecting thousands of repositories.
- Aqua Security · 2023 · Threat actors and cybercrime, Threat intelligence methodsPanamorfi: A New Discord DDoS CampaignDiscovery of Panamorfi, a new DDoS campaign leveraging Discord infrastructure to launch distributed denial-of-service attacks.
2022 (10)
- Aqua Security · 2022-12 · Malware and botnetsAqua Nautilus Discovers Redigo: New Redis Backdoor MalwareSecurity researchers uncover a new Redis backdoor malware variant that demonstrates advanced evasion techniques and persistence mechanisms.
- Aqua Security · 2022-04-13 · Threat intelligence methodsReal-world Cyber Attacks Targeting Data Science ToolsAnalysis of actual cyber attacks targeting data science environments, revealing new attack vectors and mitigation strategies.
- Aqua Security · 2022-03-29 · Malware and botnetsThreat Alert: First Python Ransomware Attack Targeting Jupyter NotebooksSecurity researchers discover the first known ransomware attack specifically designed to target Jupyter Notebook environments.
- Aqua Security · 2022 · Vulnerabilities and misconfigurations300,000 Prometheus Servers and Exporters Exposed to DoS AttacksSecurity research reveals that hundreds of thousands of Prometheus servers and exporters are exposed to denial-of-service attacks due to misconfigurations.
- Aqua Security · 2022 · Vulnerabilities and misconfigurationsCVE-2022-42889 Text4shell Apache Commons VulnerabilityCritical vulnerability in Apache Commons Text (CVE-2022-42889), also known as Text4shell, allows remote code execution.
- Aqua Security · 2022 · Cloud and Kubernetes, Threat actors and cybercrime, Threat intelligence methodsThreat Alert: Anatomy of SilentBob's Cloud AttackDeep dive into SilentBob's sophisticated cloud attack campaign, analyzing their tactics, techniques, and procedures for compromising cloud-native environments.
- Aqua Security · 2022 · Cloud and Kubernetes, Threat actors and cybercrime, Threat intelligence methodsCryptojacking Cloud Network BandwidthResearch reveals how threat actors are hijacking cloud network bandwidth for malicious purposes, including cryptojacking and resource abuse.
- Aqua Security · 2022 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, AI and agentsRisks of Misconfigured Kubernetes Policy Engines: OPA GatekeeperAnalysis of security risks associated with misconfigured Open Policy Agent (OPA) Gatekeeper in Kubernetes environments reveals potential bypass scenarios.
- Aqua Security · 2022 · Threat actors and cybercrimeTracee Rules: Detect Attackers Out of the BoxIntroduction to Tracee's out-of-the-box detection rules that help security teams identify attacker behavior in containerized environments.
- Aqua Security · 2022 · Threat actors and cybercrime, Vulnerabilities and misconfigurations, Threat intelligence methodsThreat Alert: Exploited SSH Servers Offered in the Dark Web as Proxy PoolsResearch reveals how compromised SSH servers are being sold on dark web markets as proxy pools, enabling anonymous access and malicious activities.
2021 (20)
- Aqua Security · 2021-10-27 · Cloud and Kubernetes, Threat actors and cybercrimeThe Great Escape: A Blast Radius Analysis of Container AttacksAnalysis of real-world container attacks to determine their blast radius, revealing how attackers escape container environments to compromise underlying hosts.
- Aqua Security · 2021-08-11 · Cloud and Kubernetes, Threat actors and cybercrime, Supply chain and secretsThreat Alert: Supply Chain Attacks Using Container ImagesAnalysis of how threat actors are leveraging container images to launch sophisticated supply chain attacks against organizations.
- Aqua Security · 2021-03-18 · Cloud and Kubernetes, Vulnerabilities and misconfigurationsJDWP Misconfiguration in Container Images and K8sJava Debug Wire Protocol (JDWP) misconfiguration in container images exposes production environments to remote code execution risks.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat actors and cybercrime, Vulnerabilities and misconfigurationsKubernetes Exposed: Exploiting the Kubelet APISecurity research demonstrates how attackers can exploit misconfigured Kubelet APIs to gain unauthorized access to Kubernetes clusters.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat intelligence methodsAdvanced Persistent Threat Techniques in Container AttacksAnalysis of how advanced persistent threat (APT) groups are adapting their techniques to target containerized environments and cloud-native infrastructure.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat actors and cybercrime, Supply chain and secretsContainer Security Alert: Campaign Abusing GitHub, DockerHub, Travis CI, Circle CIThreat actors are conducting a sophisticated campaign that abuses popular CI/CD platforms and code repositories to distribute malicious container images.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat actors and cybercrime, Vulnerabilities and misconfigurationsKubernetes Exposed: One YAML Away from DisasterResearch reveals how a single misconfigured YAML file can expose entire Kubernetes clusters to attackers.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat actors and cybercrime, Vulnerabilities and misconfigurationsContainer Attacks on Redis ServersAnalysis of attack campaigns specifically targeting Redis servers running in containerized environments reveals new attack vectors and exploitation techniques.
- Aqua Security · 2021 · Cloud and Kubernetes, Vulnerabilities and misconfigurations, Supply chain and secretsGitHub Repos Expose Azure and Red Hat SecretsSecurity research reveals that GitHub repositories are exposing sensitive secrets including Azure credentials and Red Hat access keys.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat intelligence methodsContainer Security: TNT Container AttackAnalysis of TeamTNT's sophisticated container attack techniques reveals their methodology and the evolving threat landscape in containerized environments.
- Aqua Security · 2021 · Vulnerabilities and misconfigurationsCVE-2021-3156: Sudo Vulnerability Allows Root PrivilegesCritical vulnerability in sudo (CVE-2021-3156) allows unprivileged users to gain root access on Linux systems.
- Aqua Security · 2021 · Vulnerabilities and misconfigurationsTravis CI Security: Protecting Your CI/CD PipelineSecurity analysis of Travis CI platform reveals potential vulnerabilities and best practices for securing CI/CD pipelines.
- Aqua Security · 2021 · Cloud and Kubernetes, Threat actors and cybercrime, Vulnerabilities and misconfigurationsKubernetes UI Tools Security ThreatSecurity analysis of popular Kubernetes UI tools reveals potential security risks and attack vectors that could be exploited by threat actors.
- Aqua Security · 2021 · Cloud and Kubernetes, Malware and botnets, Threat actors and cybercrimeNew Malware in the Cloud by TeamTNTThe notorious TeamTNT threat group continues to evolve their malware capabilities, targeting cloud environments with new sophisticated attack techniques.
- Aqua Security · 2021 · Cloud and Kubernetes, Malware and botnets, Vulnerabilities and misconfigurationsGAFGYT Malware Variant Exploits GPU Power and Cloud-Native EnvironmentsA new variant of the GAFGYT malware family has been discovered that specifically targets GPU resources in cloud-native environments.
- Aqua Security · 2021 · Threat actors and cybercrime, Supply chain and secrets, Threat intelligence methodsPhishing as a Service to Ramp Up Supply Chain AttacksThreat actors are increasingly leveraging phishing-as-a-service (PhaaS) platforms to launch sophisticated supply chain attacks against organizations.
- Aqua Security · 2021 · Malware and botnets, Threat actors and cybercrimePerfctl: A Stealthy Malware Targeting Millions of Linux ServersSecurity researchers have discovered Perfctl, a sophisticated malware campaign targeting millions of Linux servers worldwide.
- Aqua Security · 2021 · Cloud and Kubernetes, Malware and botnets, Threat actors and cybercrimeLeveraging Kubernetes RBAC to Backdoor ClustersResearch reveals how attackers exploit Kubernetes RBAC (Role-Based Access Control) misconfigurations to establish persistent backdoors and maintain unauthorized access to clusters.
- Aqua Security · 2021 · Cloud and KubernetesMalicious Container Image: Docker Container HostAnalysis of malicious container images designed to escape containers and compromise the Docker host demonstrates container escape techniques and host-level attacks.
- Aqua Security · 2021 · Malware and botnets, Threat actors and cybercrimeHadooken Malware Targets WebLogic ApplicationsSecurity researchers have discovered a new malware campaign specifically targeting Oracle WebLogic applications.
2020 (2)
- Aqua Security · 2020-12-02 · Cloud and Kubernetes, Malware and botnetsThreat Alert: Fileless Malware Executing in ContainersSecurity researchers have identified a new type of attack where malware executes directly from memory within containers, evading common defenses and static scanning.
- Aqua Security · 2020-11-23 · Cloud and Kubernetes, Threat intelligence methodsThreat Alert: Market-First Container Image Built to Attack Kubernetes ClustersDiscovery of the first container image specifically designed to attack Kubernetes clusters, marking a new era in cloud-native threats.