/ Internet intelligence research from the Censys team. en-us Fri, 06 Nov 2026 19:02:55 +0000 /post/what-refrigerator-hacks-reveal-about-ics-exposure/ /post/what-refrigerator-hacks-reveal-about-ics-exposure/ Fri, 06 Nov 2026 19:02:55 +0000 Kate Lake Waves of cyberattacks on refrigerators across Europe remind us that OT and ICS remain perpetually exposed. Here are a four reasons why. /post/artex-agentic-asbestos/ /post/artex-agentic-asbestos/ Thu, 05 Nov 2026 21:38:21 +0000 Silas Cutler Censys detects 1,465 hosts running exposed instances of ARTEX, an open-source, LLM-driven autonomous pentesting framework that has been linked to malicious activity from multiple threat groups. /post/european-refrigeration-controller-exposure-sitrep/ /post/european-refrigeration-controller-exposure-sitrep/ Thu, 05 Nov 2026 20:49:31 +0000 Kate Lake Censys tracks a decline in Internet exposed refrigerator controllers named in CERT-FR emergency alert CERTFR-2026-ALE-012. Learn more. /post/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/ /post/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/ Mon, 02 Nov 2026 19:12:29 +0000 The Censys ARC Research Team In the early hours of Monday, November 2, stores in at least seven major supermarket chains, butchers, and small grocers across Europe suffered cyber attacks targeting their commercial refrigeration controllers, mirroring similar incidents observed in France three weeks ago. This time, grocers in Belgium, Estonia, Ireland, Luxembourg, The Netherlands, and Sweden have […] /post/thoughts-on-the-vulnpocalypse-php2shell/ /post/thoughts-on-the-vulnpocalypse-php2shell/ Mon, 02 Nov 2026 18:03:11 +0000 Himaja Motheram After "Black October," ARC researcher Himaja Motheram reflects on how well we're protecting aging software in the face of emerging AI threats. /post/introducing-censys-starter-subscriptions/ /post/introducing-censys-starter-subscriptions/ Fri, 30 Oct 2026 17:44:23 +0000 Kate Lake Censys Starter is now a subscription with flat one-credit-per-action pricing and five free searches a day for every user. /post/same-vulnerability-different-numbers/ /post/same-vulnerability-different-numbers/ Thu, 29 Oct 2026 15:01:17 +0000 Alex Gartner Get details of how PHP2Shell unfolded, why counts differ, and how Censys builds its map of Internet threats and vulnerabilities. /post/censys-ai-agents-automate-investigations-and-amplify-your-threat-intel/ /post/censys-ai-agents-automate-investigations-and-amplify-your-threat-intel/ Tue, 27 Oct 2026 18:20:10 +0000 Alex Gartner Learn how Censys Investigator works, example use cases, and how you can use it to build repeatable workflows in your environment. /post/web-scanning-in-censys-asm-just-got-deeper/ /post/web-scanning-in-censys-asm-just-got-deeper/ Fri, 16 Oct 2026 18:36:14 +0000 Julie Rockett See what’s really running on your website. Censys ASM’s web scanning surfaces hidden risks across your attack surface, automatically. /post/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report/ /post/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report/ Wed, 14 Oct 2026 19:39:35 +0000 Mark Ellzey A review of the attacks targeting refrigerators in France via Danfoss controllers, resulting in spoiled food and, in some cases, fires. /post/state-of-the-internet-report-2026/ /post/state-of-the-internet-report-2026/ Wed, 14 Oct 2026 13:00:00 +0000 Kate Lake New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about the Internet and its threats. /post/the-ultimate-guide-to-brand-protection-with-censys/ /post/the-ultimate-guide-to-brand-protection-with-censys/ Fri, 09 Oct 2026 19:21:32 +0000 Alex Gartner Detect typosquatting, phishing domains, and fake logins. A hands-on Censys guide to brand protection, fraud prevention, and takedowns. /post/new-on-the-map-september-2026-22-protocol-and-endpoint-scanners/ /post/new-on-the-map-september-2026-22-protocol-and-endpoint-scanners/ Thu, 08 Oct 2026 14:56:22 +0000 Raj Sivasankar CISA-flagged Cisco SD-WAN flaws, ransomware-linked STOMP brokers, and exposed Hikvision cameras: see what scanners we added this month. /post/darksword-coruna-open-directory-finding-report/ /post/darksword-coruna-open-directory-finding-report/ Wed, 07 Oct 2026 16:03:01 +0000 Aidan Holland Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […] /post/introducing-censys-cli-skills/ /post/introducing-censys-cli-skills/ Thu, 24 Sep 2026 17:00:00 +0000 Alex Gartner At 2 a.m., a workstation makes an outbound TLS connection to a VPS on port 7443. The EDR flags it. A Tier 1 analyst on her third night shift (and her third cup of coffee) pulls up the IP: DigitalOcean, Linux, a self-signed certificate, nothing in the usual reputation feeds. She writes “no further action” […] /post/mythic-c2/ /post/mythic-c2/ Tue, 15 Sep 2026 19:16:40 +0000 Andrew Northern Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it. /post/no-one-inside-the-machine/ /post/no-one-inside-the-machine/ Fri, 11 Sep 2026 17:00:35 +0000 Alex Gartner Censys analyzes vibe-coded AI apps that target students and children. Unprotected and not yet detectable with conventional threat detection. /post/new-on-the-map-august-2026-14-protocol-scanners/ /post/new-on-the-map-august-2026-14-protocol-scanners/ Wed, 09 Sep 2026 16:51:42 +0000 Raj Sivasankar CISA-flagged KNX systems, exposed Redshift clusters, and camera botnets: See what scanners we’ve added this month and how to check your exposure. /post/2026-state-of-the-internet-ics/ /post/2026-state-of-the-internet-ics/ Tue, 08 Sep 2026 17:15:38 +0000 Kate Lake New data from Censys' upcoming State of the Internet Report reveals a major blind spot in Internet-exposed industrial control systems (ICS). /post/nps-proxy-server/ /post/nps-proxy-server/ Fri, 04 Sep 2026 17:07:21 +0000 Silas Cutler Most deployments of the NPS tunneling tool are benign. Some are not. Censys ARC shares signals for distinguishing the benign from the malicious. /post/so-your-cfos-phone-has-been-pwned-a-dfir-journey/ /post/so-your-cfos-phone-has-been-pwned-a-dfir-journey/ Mon, 31 Aug 2026 20:37:38 +0000 Alex Gartner Learn how to pivot from an IOC to a full DFIR history with two real-world examples that draw on recent Censys ARC research. /post/fake-mp4-file-carries-malicious-payload/ /post/fake-mp4-file-carries-malicious-payload/ Fri, 28 Aug 2026 20:26:37 +0000 Andrew Northern Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works. /post/open-directory-exposes-moobot-source-code-and-activity/ /post/open-directory-exposes-moobot-source-code-and-activity/ Thu, 27 Aug 2026 19:58:23 +0000 Silas Cutler New Censys ARC research examines an exposed server containing Moobot botnet source code, active attack records, DoS tooling, and a fraudulent identity verification service. /post/ermac-source-leak-hookbot/ /post/ermac-source-leak-hookbot/ Tue, 25 Aug 2026 13:00:00 +0000 Aidan Holland ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […] /post/mirai-and-its-heirs-a-decade-of-structural-neglect-in-iot-security/ /post/mirai-and-its-heirs-a-decade-of-structural-neglect-in-iot-security/ Fri, 07 Aug 2026 21:41:37 +0000 Allyson Martinez A deep look at how Mirai and its descendents have evolved over the past decade — and why the botnet's methodology still works today. /post/introducing-censys-ioc-investigator/ /post/introducing-censys-ioc-investigator/ Fri, 31 Jul 2026 19:24:59 +0000 Alex Gartner Learn about Censys' new IOC Investigator: an AI-powered threat investigation feature that automates pivoting, infrastructure mapping, and host profiling. /post/darkswords-panel-sprawl/ /post/darkswords-panel-sprawl/ Fri, 31 Jul 2026 17:20:47 +0000 Aidan Holland Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat. /post/cisa-alert-water-tower-plc-targeting/ /post/cisa-alert-water-tower-plc-targeting/ Fri, 31 Jul 2026 00:40:17 +0000 Alex Gartner CISA alert: Threat actors targeting PLCs in Water and Wastewater Systems. This report includes current Censys-observed internet exposure for each named vendor. /post/cl0p-targets-windchill/ /post/cl0p-targets-windchill/ Thu, 30 Jul 2026 21:01:33 +0000 Emily Austin Cl0p's recent targeting of Windchill shows that Internet-exposed enterprise back office software remains a high value target for threat actors. /post/you-cant-out-patch-ai/ /post/you-cant-out-patch-ai/ Tue, 28 Jul 2026 19:54:15 +0000 Zakir Durumeric AI makes vulnerability discovery and exploitation faster than defenders can patch. Learn why attack surface reduction—not faster patching—is the path forward, and how Censys ASM helps. /post/triage-investigate-hunt-defend/ /post/triage-investigate-hunt-defend/ Fri, 24 Jul 2026 19:10:06 +0000 Kate Lake Censys delivers Internet intelligence as a foundational layer to all security operations: triage, investigate, hunt, and defend. /post/state-of-the-internet-2026-preview/ /post/state-of-the-internet-2026-preview/ Thu, 23 Jul 2026 12:02:00 +0000 Kate Lake Get an early look at Censys' 2026 State of the Internet Report, including Internet-exposed AI infrastructure and shifting global trends in ICS exposures. /post/record-first-half-2026-growth/ /post/record-first-half-2026-growth/ Wed, 22 Jul 2026 13:05:00 +0000 Kate Lake ANN ARBOR, Mich. – July 22, 2026 – Censys, the authority in Internet intelligence and insights, today announced record first half 2026 growth, reflecting growing enterprise adoption of Internet intelligence as organizations accelerate security modernization and deploy AI-enabled security workflows. Key first half 2026 highlights include: As AI-enabled attacks accelerate, organizations require comprehensive, accurate, and […] /post/censys-is-the-omnifeed-crunch-your-own-threat-intelligence/ /post/censys-is-the-omnifeed-crunch-your-own-threat-intelligence/ Tue, 21 Jul 2026 14:52:06 +0000 Alex Gartner Learn how to operationalize Censys intelligence by building custom feeds with the Collections API and pushing to OpenCTI. /post/russia-camera-hacking-espionage-campaign/ /post/russia-camera-hacking-espionage-campaign/ Thu, 16 Jul 2026 20:41:33 +0000 Martijn Grooten Censys ARC investigates the Russian camera-hacking espionage campaign against countries in the EU, NATO, and Ukraine. /post/unlimited-enrichment/ /post/unlimited-enrichment/ Wed, 15 Jul 2026 18:12:43 +0000 Alex Gartner Censys is introducing Unlimited Enrichment, a host enrichment API that doesn’t draw down your credit balance. Here's how it works. /post/nist-dns-security/ /post/nist-dns-security/ Fri, 10 Jul 2026 18:21:56 +0000 Kate Lake Learn how Censys Active DNS supports NIST CSF 2.0 by connecting domain names to live Internet infrastructure for faster investigation and threat response. /post/roblox-minecraft-and-the-insidious-internet-for-children/ /post/roblox-minecraft-and-the-insidious-internet-for-children/ Thu, 02 Jul 2026 19:44:55 +0000 Alex Gartner An exploration of Roblox and Minecraft offerwalls and phishing lures — infrastructure that isn’t well covered by conventional threat intelligence. /post/wordpress-eol-php/ /post/wordpress-eol-php/ Wed, 01 Jul 2026 15:04:32 +0000 Allyson Martinez Over 70% of publicly visible WordPress sites are running outdated PHP. See Censys data on EOL software risks across the WordPress ecosystem. /post/dlp-blind-spot/ /post/dlp-blind-spot/ Mon, 29 Jun 2026 16:37:32 +0000 Kate Lake DLP monitors movement. Censys discovers exposure. You need both; this blog shows you how to find the second one, with queries you can run today. /post/asyncrat-family-threat-overview/ /post/asyncrat-family-threat-overview/ Fri, 26 Jun 2026 17:44:12 +0000 Kate Lake New Censys ARC research identifies more than a dozen live C2 infrastructure instances as descendants of AsyncRAT. /post/unc1151-phishing-email-campaign/ /post/unc1151-phishing-email-campaign/ Fri, 26 Jun 2026 14:01:02 +0000 Martijn Grooten New Censys ARC research discovers that UNC1151's phishing email to a Belarusian politician is linked to a much broader campaign. /post/adaptixc2-open-source-c2-framework/ /post/adaptixc2-open-source-c2-framework/ Wed, 17 Jun 2026 16:31:14 +0000 Aidan Holland Censys ARC found 412 web properties across 236 hosts running AdaptixC2, an open-source post-exploit framework. Get the IOCs + full breakdown. /post/redcap-exposure-analysis/ /post/redcap-exposure-analysis/ Tue, 16 Jun 2026 19:01:09 +0000 The Censys ARC Research Team Censys ARC's perspective on UNC6508's REDCap server exploitation in a long-term research espionage campaign, as reported by Google Threat Intelligence Group. /post/ai-soc-censys-internet-intelligence-google-secops/ /post/ai-soc-censys-internet-intelligence-google-secops/ Tue, 16 Jun 2026 16:27:56 +0000 Oliver Wai Censys enriches Google SecOps with real-time Internet intelligence for faster triage, threat hunting, and incident response for the AI SOC. /post/following-a-usps-smishing-kit-through-censys-dns-data/ /post/following-a-usps-smishing-kit-through-censys-dns-data/ Fri, 12 Jun 2026 19:35:28 +0000 Andrew Northern It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful link to fix it. This one pointed at: Believe it or not, xupqnqz[.]one is not USPS (United States […] /post/dangling-dns-subdomain-takeover/ /post/dangling-dns-subdomain-takeover/ Fri, 05 Jun 2026 20:26:26 +0000 Kate Lake Dangling DNS records can expose organizations to subdomain takeover. Learn how attackers exploit them and how to stop it. /post/smarter-security-tools-internet-intelligence/ /post/smarter-security-tools-internet-intelligence/ Thu, 04 Jun 2026 14:52:12 +0000 Todd Rosenberry Here's why alert context is critical and how to strike the right balance of contextual information without information overload in your SOC. /post/mythos-exposure-management-censys/ /post/mythos-exposure-management-censys/ Wed, 03 Jun 2026 20:07:59 +0000 Kate Lake AI models like Claude Mythos are compressing the exposure timeline. Learn how Censys ASM and Censys Platform help teams discover, prioritize, and operationalize internet-facing risk. /post/internet-intelligence-foundation-exposure-management-ctem/ /post/internet-intelligence-foundation-exposure-management-ctem/ Fri, 29 May 2026 19:04:53 +0000 Kate Lake Learn why complete Internet visibility is critical to CTEM and exposure management programs, and how to achieve it with Censys.