Frostbitten in France: A Danfoss StoreView Internet Exposure Report
A review of the attacks targeting refrigerators in France via Danfoss controllers, resulting in spoiled food and, in some cases, fires.
Author
Mark Ellzey
11 posts
MCP Servers on the Internet
Exposed MCP servers present significant risks. Censys ARC identified 12,520 Internet-accessible MCP services. Get the full analysis.
Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet
Discover how attackers exploit exposed ComfyUI instances for RCE, cryptomining, and proxy botnets. Censys ARC reveals 1,000+ vulnerable targets and advanced malware tactics.
Unauthenticated Message Queues are a Problem
Discover how MQTT, ZeroMQ, and NATS messaging protocols are unintentionally exposed online, leaking sensitive data. Censys research reveals hidden pub/sub security risks.
Recap of a Suspicious Surge in Cobalt Strike
Censys research reveals a massive burst of Cobalt Strike servers across AS138415 and AS133199 in December 2025, linked to suspicious infrastructure and shell companies. Read the full threat intelligence analysis.
Using Cobalt Strike to Find (More) Cobalt Strike
Discover techniques to uncover hidden Cobalt Strike C2 servers by pivoting from known infrastructure using TLS certificates, Censys scan data, and threat intelligence methods.
Using the Censys API for Advanced Threat Hunting
Discover Censys's new value-counts API endpoint for faster adversary infrastructure pivoting. Batch multiple queries in one call—replacing Censeye's limitations with efficient threat hunting.
Iran's Internet: A Censys Perspective
Iran's internet blackout since June 18, 2025: Censys research tracks host visibility, ASN recovery rates, and TIC transit bottlenecks across Iranian networks.
Poking at the Flodrix Botnet
Flodrix botnet exposed: How a C2 server misconfiguration revealed 745 compromised hosts exploiting CVE-2025-3248 in Langflow AI. Threat intelligence analysis.
Unmasking the Infrastructure of a Spearphishing Campaign
Discover how 16 open directories with obfuscated VBS files deploy RATs like Remcos, AsyncRAT, DCRat & LimeRAT via a 3-stage dropper system linked to APT-C-36.
TikTok and Malware
Uncovering hidden IOCs behind TikTok malware campaigns using AI-generated videos. Deep dive into Vidar & StealC info-stealers, malicious domains & PowerShell scripts.