Rhadamanthys and the Limits of Private Sector Operations
Explore the limits of private-sector threat intelligence through a 2022 Rhadamanthys infostealer case study. SANS CTI Summit research on harm reduction without law enforcement support.
FTP Exposure Brief: Examining the 55-Year-Old Protocol Used by Millions
Censys reveals nearly 6M FTP hosts still online in 2026, with 2.45M showing no encryption. Explore FTP exposure risks, TLS adoption gaps, and why legacy defaults remain a security concern.
The Internet’s Best Map Is Now Its Clearest Risk Signal
Censys Reputation Score: a 0–100 host-level risk rating that helps SOC analysts triage faster with transparent evidence. Reduce alert fatigue and scale security judgment.
Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs
FBI & CISA alert: 5,219 Rockwell PLCs exposed to Iranian APT exploitation. Censys threat intelligence reveals U.S. attack surface, IOC analysis & key findings from AA26-097A.
Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet
Discover how attackers exploit exposed ComfyUI instances for RCE, cryptomining, and proxy botnets. Censys ARC reveals 1,000+ vulnerable targets and advanced malware tactics.
Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware
**Discover how technique-based HTTP body hunting on Censys surfaced a live ClickFix campaign delivering XWorm V5.6 via PhantomVAI loader—reducing the web to 42 actionable results.**
[April Fools] BrewJack: Censys Researchers Uncover First Malware Campaign Targeting IP over Avian Carriers
Censys ARC uncovers Pigeon Forge APT using RFC 2549 (IP over Avian Carriers) for C2 communication. Discover the BrewJack campaign in this April Fools research.
[April Fools] Introducing the Censys Host Feelings Score™
Censys introduces the Host Feelings Score™—a humorous metric measuring how emotionally vulnerable internet hosts appear. Happy April Fools' from the ARC Research Team!
ICS & Iran, Part 2: Revisiting Exposure of Previously Targeted Devices
Tracking Internet exposure of ICS devices targeted by Iranian threat actors. Research covers Unitronics PLCs, Orpak SiteOmat, Red Lion & Tridium Niagara trends.
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Censys discovers "CTRL," an undocumented Russian remote access toolkit combining credential phishing, keylogging, RDP hijacking & reverse tunneling. Read the full threat intelligence analysis.
Attack Surface Mapping: Know What You Own
Learn about attack surface mapping and analysis and and why they're critical to modern security operations.
Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker
Handala's wiper cyberattack destroyed Stryker Corporation's global Windows environment via suspected Microsoft Intune compromise. Explore the Iran-linked threat intelligence and key defenses.
What AI Is Missing in the Modern SOC
Discover why AI SOC modernization stalls without ground-truth Internet intelligence. Learn how Censys helps SOC teams build reliable, context-rich workflows for smarter automation.
NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure
Censys sees 25 exposed NetSupport Manager Gateways across global infrastructure. Get the technical overview of NetSupport Manager.
Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do
Discover how Censys identifies Internet-exposed IP cameras in Iran using threat intelligence, CVE data, and advanced search queries.
The SOC Workflow Tax Hiding in Plain Sight
Discover how Censys helps SOC teams reduce manual enrichment workflows with first-party Internet data, faster triage, and evidence-based investigations. Optimize your SOC today.
New Protocol Scanners: Shining a Light on Remote Access Tools, ICS Controllers, and More
Censys announces 8 new protocol scanners including Cisco NSI, Adobe Flash Socket Policy, MikroTik RouterOS, RustDesk & more. Discover exposed services and hidden infrastructure risks.
Everything You Need to Know About the Deprecation of Legacy Search
Censys Legacy Search is deprecating Sept 2026. Learn about migrating to Censys Platform—featuring MFA, AI assistant, audit logs & a streamlined experience.
ResidentBat: Belarusian KGB Android Spyware at Internet Scale
Discover how ResidentBat, a Belarusian KGB Android spyware, targets journalists. Explore its C2 infrastructure, capabilities, and threat intelligence findings.
Vshell: A Chinese-Language Alternative to Cobalt Strike
A Go-based C2 tool used in threat operations. Learn about its Cobalt Strike parallels, evolution, and threat intelligence insights.**