ARTEX: Agentic Asbestos
Censys detects 1,465 hosts running exposed instances of ARTEX, an open-source, LLM-driven autonomous pentesting framework that has been linked to malicious activity from multiple threat groups.
Topic
Research
149 posts
European Refrigeration Controller Exposure: A Second Attack Wave
Censys tracks a decline in Internet exposed refrigerator controllers named in CERT-FR emergency alert CERTFR-2026-ALE-012. Learn more.
European refrigerator controller redux: A new wave of refrigeration attacks
In the early hours of Monday, November 2, stores in at least seven major supermarket chains, butchers, and small grocers across Europe suffered cyber attacks targeting their commercial refrigeration controllers, mirroring similar incidents observed in France three weeks ago. This time, grocers in Belgium, Estonia, Ireland, Luxembourg, The Netherlands, and Sweden have […]
Thoughts on Vulnerability Response in the Era of the Vulnpocalypse and PHP2Shell
After "Black October," ARC researcher Himaja Motheram reflects on how well we're protecting aging software in the face of emerging AI threats.
Frostbitten in France: A Danfoss StoreView Internet Exposure Report
A review of the attacks targeting refrigerators in France via Danfoss controllers, resulting in spoiled food and, in some cases, fires.
DarkSword/Coruna Open Directory Finding Report
Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […]
Mythic C2 Activity at Internet Scale
Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it.
2026 State of the Internet: The Exposure Notification Gap in ICS Devices
New data from Censys' upcoming State of the Internet Report reveals a major blind spot in Internet-exposed industrial control systems (ICS).
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet
Most deployments of the NPS tunneling tool are benign. Some are not. Censys ARC shares signals for distinguishing the benign from the malicious.
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
New Censys ARC research examines an exposed server containing Moobot botnet source code, active attack records, DoS tooling, and a fraudulent identity verification service.
What the ERMAC Source Leak Says About HookBot
ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […]
Mirai and Its Heirs: A Decade of Structural Neglect in IoT Security
A deep look at how Mirai and its descendents have evolved over the past decade — and why the botnet's methodology still works today.
DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster
Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.
CISA Alert: Water Sector PLC Targeting
CISA alert: Threat actors targeting PLCs in Water and Wastewater Systems. This report includes current Censys-observed internet exposure for each named vendor.
A Chill in the Air: Cl0p Targets Windchill, Another Enterprise Software Product
Cl0p's recent targeting of Windchill shows that Internet-exposed enterprise back office software remains a high value target for threat actors.
The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift
Get an early look at Censys' 2026 State of the Internet Report, including Internet-exposed AI infrastructure and shifting global trends in ICS exposures.
Inside Russia’s Camera-Hacking Espionage Campaign
Censys ARC investigates the Russian camera-hacking espionage campaign against countries in the EU, NATO, and Ukraine.
Why Are WordPress Sites Still Running EOL PHP?
Over 70% of publicly visible WordPress sites are running outdated PHP. See Censys data on EOL software risks across the WordPress ecosystem.
AsyncRAT Family Threat Overview
New Censys ARC research identifies more than a dozen live C2 infrastructure instances as descendants of AsyncRAT.
UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign
New Censys ARC research discovers that UNC1151's phishing email to a Belarusian politician is linked to a much broader campaign.
AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale
Censys ARC found 412 web properties across 236 hosts running AdaptixC2, an open-source post-exploit framework. Get the IOCs + full breakdown.
REDCap on the Internet: An Exposure Analysis
Censys ARC's perspective on UNC6508's REDCap server exploitation in a long-term research espionage campaign, as reported by Google Threat Intelligence Group.
The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data
It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful link to fix it. This one pointed at: Believe it or not, xupqnqz[.]one is not USPS (United States […]
MCP Servers on the Internet
Exposed MCP servers present significant risks. Censys ARC identified 12,520 Internet-accessible MCP services. Get the full analysis.
Iran-Linked Operators Suspected in ATG Breaches
Censys finds 6,502 ATG services on 6,057 hosts reachable on the public internet today. Every ATG service indexed in Censys is reachable without authentication.
Password Manager Infrastructure in the Wild: Surveying Prevalence, Internet Footprint, and Exposure
Censys research reveals 31,000+ password manager instances exposed online. Discover which tools are most common, vulnerability risks, and key security findings across Vaultwarden, Bitwarden & more.
The cPanel Situation Is…
CVE-2026-41940: Critical cPanel/WHM pre-auth bypass exploited within 24hrs. Censys research reveals Mirai variants, ".sorry" ransomware & mass automated attacks.
Oluomo: Microsoft OAuth AiTM Phishing Using a Naturalization-Form Lure
Censys uncovers OLUOMO, a sophisticated AiTM phishing cluster harvesting Microsoft credentials via fake document portals, Azure proxies, and compromised sites.
Rhadamanthys and the Limits of Private Sector Operations
Explore the limits of private-sector threat intelligence through a 2022 Rhadamanthys infostealer case study. SANS CTI Summit research on harm reduction without law enforcement support.
FTP Exposure Brief: Examining the 55-Year-Old Protocol Used by Millions
Censys reveals nearly 6M FTP hosts still online in 2026, with 2.45M showing no encryption. Explore FTP exposure risks, TLS adoption gaps, and why legacy defaults remain a security concern.
Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs
FBI & CISA alert: 5,219 Rockwell PLCs exposed to Iranian APT exploitation. Censys threat intelligence reveals U.S. attack surface, IOC analysis & key findings from AA26-097A.
Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet
Discover how attackers exploit exposed ComfyUI instances for RCE, cryptomining, and proxy botnets. Censys ARC reveals 1,000+ vulnerable targets and advanced malware tactics.
Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware
**Discover how technique-based HTTP body hunting on Censys surfaced a live ClickFix campaign delivering XWorm V5.6 via PhantomVAI loader—reducing the web to 42 actionable results.**
[April Fools] BrewJack: Censys Researchers Uncover First Malware Campaign Targeting IP over Avian Carriers
Censys ARC uncovers Pigeon Forge APT using RFC 2549 (IP over Avian Carriers) for C2 communication. Discover the BrewJack campaign in this April Fools research.
[April Fools] Introducing the Censys Host Feelings Score™
Censys introduces the Host Feelings Score™—a humorous metric measuring how emotionally vulnerable internet hosts appear. Happy April Fools' from the ARC Research Team!
ICS & Iran, Part 2: Revisiting Exposure of Previously Targeted Devices
Tracking Internet exposure of ICS devices targeted by Iranian threat actors. Research covers Unitronics PLCs, Orpak SiteOmat, Red Lion & Tridium Niagara trends.
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Censys discovers "CTRL," an undocumented Russian remote access toolkit combining credential phishing, keylogging, RDP hijacking & reverse tunneling. Read the full threat intelligence analysis.
Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker
Handala's wiper cyberattack destroyed Stryker Corporation's global Windows environment via suspected Microsoft Intune compromise. Explore the Iran-linked threat intelligence and key defenses.
NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure
Censys sees 25 exposed NetSupport Manager Gateways across global infrastructure. Get the technical overview of NetSupport Manager.
Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do
Discover how Censys identifies Internet-exposed IP cameras in Iran using threat intelligence, CVE data, and advanced search queries.
ResidentBat: Belarusian KGB Android Spyware at Internet Scale
Discover how ResidentBat, a Belarusian KGB Android spyware, targets journalists. Explore its C2 infrastructure, capabilities, and threat intelligence findings.
Vshell: A Chinese-Language Alternative to Cobalt Strike
A Go-based C2 tool used in threat operations. Learn about its Cobalt Strike parallels, evolution, and threat intelligence insights.**
Odyssey Stealer: Inside a macOS Crypto-Stealing Operation
Discover how Odyssey Stealer targets macOS users to steal crypto wallets via a MaaS affiliate model. Expert threat intelligence on its C2 infrastructure and tactics.
Malicious Notepad++ Network Infrastructure
# SEO-Optimized Meta Description **Censys ARC Research Team tracks Lotus Blossom APT infrastructure behind the Notepad++ supply chain compromise, analyzing Chrysalis backdoor C2 hosts via network scan data and TLS certificate pivots.** *Character count: 158* This meta description works because it: - **Includes high-value keywords**: "Lotus Blossom APT," "Notepad++ supply chain compromise," "Chrysalis backdoor," "C2," "TLS certificate" - **Establishes authority**: References the Censys ARC Research Team and their analytical methodology - **Creates click appeal**: Implies unique, original infrastructure tracking research not found elsewhere - **Targets the right audience**: Threat intelligence analysts, security researchers, and SOC teams searching for IOCs and APT tracking content - **Stays under 160 characters**:
Hiding in Plain Sight: Tracking Bulletproof Hosting and Abused RDP Infrastructure
Discover how bulletproof hosting fuels cybercrime and how RDP certificate artifacts enable threat detection at scale. Research by Censys on tracking abuse-tolerant infrastructure.
Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access
Censys researchers uncover 86 fake voicemail sites deploying Remotely RMM malware via German-language lures and BAT files. Explore the full attack chain analysis.
OpenClaw in the Wild: Mapping the Public Exposure of a Viral AI Assistant
Discover how OpenClaw, the open-source AI assistant, surged to 21,000+ exposed instances in one week. Silas Cutler analyzes the security risks and threat intelligence behind this rapid adoption.
AsyncRAT C2 Activity at Internet Scale
Discover Censys research on AsyncRAT—tracking 57+ active C2 servers via self-signed TLS certificates. Explore threat intelligence on this open-source RAT's infrastructure and capabilities.
A Tiny Peek Into Unauthenticated SOCKS Proxies
Discover how SOCKS proxies can be abused as open proxies. Censys research reveals how many of 3.4M+ SOCKS servers are truly exploitable—and the real threat they pose.
Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface
Discover how Fake Captcha and ClickFix lures exploit trusted web infrastructure to deliver malware. New research reveals fragmented delivery models behind visually uniform campaigns.
ErrTraffic: Inside a GlitchFix Attack Panel
Discover how ErrTraffic powers ClickFix campaigns with fake error pages & malware delivery. Censys research reveals source code, C2 infrastructure & threat intelligence insights.
Unauthenticated Message Queues are a Problem
Discover how MQTT, ZeroMQ, and NATS messaging protocols are unintentionally exposed online, leaking sensitive data. Censys research reveals hidden pub/sub security risks.
Recap of a Suspicious Surge in Cobalt Strike
Censys research reveals a massive burst of Cobalt Strike servers across AS138415 and AS133199 in December 2025, linked to suspicious infrastructure and shell companies. Read the full threat intelligence analysis.
Investigating the Infrastructure Behind DDoSia's Attacks
Discover Censys research on DDoSia, the pro-Russian hacktivist DDoS tool by NoName057(16) targeting Ukraine and NATO. Threat intelligence on infrastructure, tactics, and tracking.
Using Cobalt Strike to Find (More) Cobalt Strike
Discover techniques to uncover hidden Cobalt Strike C2 servers by pivoting from known infrastructure using TLS certificates, Censys scan data, and threat intelligence methods.
EtherHiding: Fake CAPTCHAs, Click-Fix Lures, and Blockchain-Backed Payload Delivery
**Discover how EtherHiding uses blockchain smart contracts to deliver malware via fake CAPTCHAs. Explore the attack chain, threat intelligence, and defense insights.**
Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale
Discover how Remcos RAT operates, persists, and communicates with C2 servers. Threat intelligence research reveals 150+ active servers, key hosting patterns, and detection insights.
From Evasion to Evidence: Exploiting the Funneling Behavior of Injects
Discover how SmartApe threat intelligence exposes malware delivery chains. Learn to leverage TDS chokepoints, redirect analysis & Censys data to detect evasive URL-based attacks.
Unpacking the Oracle EBS Debacle: Industries, Geography, and MOVEit Comparisons
Cl0p exploits Oracle E-Business Suite zero-day (CVE-2025-61882) in extortion campaign. Censys research reveals exposed instances across industries and compares tactics to 2023 MOVEit attack.
Disallow: /security-research? Crypto Phishing Sites' Failed Attempt to Block Investigators
Censys uncovers 60+ crypto phishing pages impersonating Trezor and Ledger wallets. Learn how robots.txt analysis exposed this campaign and its unusual tactics.
Ollama Drama: Investigating the Prevalence of Ollama Open Instances with Censys
Censys research reveals 10.6K exposed Ollama LLM instances online—many publicly promptable. Discover the threat intelligence behind unsecured AI deployments.
A Look at PolarEdge Adjacent Infrastructure
PolarEdge Botnet Infrastructure & Residential Proxy Analysis** `Censys ARC team explores PolarEdge botnet infrastructure, residential proxy networks, and a connect-back proxy system found on 2,400+ hosts. Updated threat intelligence included.`
Internet Archaeology: A Decade of Defaced Routers?
Over 330 Ubiquiti devices still display "HACKED-ROUTER" defacement banners dating back to 2016. Censys research reveals compromised infrastructure lingering for nearly a decade.
Pondering my ORB - A look at PolarEdge Adjacent Infrastructure
Censys ARC Team updates PolarEdge threat intelligence research with key clarifications on Mbed TLS certificates and attacker infrastructure. Read the corrected analysis.
2025 State of the Internet Report: Summary and Conclusions
Discover Censys' 2025 State of the Internet Report: key findings on C2 takedowns, DPRK malware, residential proxy threats, and malicious infrastructure trends. Read the full series.
2025 State of the Internet Report: Open Directories Time to Live
Discover how open directories are used for malicious purposes. Research reveals 50% vanish within a day. Learn why real-time threat intelligence is critical.
2025 State of the Internet: Digging into Residential Proxy Infrastructure
Censys ARC Team updates PolarEdge research with key clarifications on Mbed TLS certificates and residential proxy infrastructure. Read our corrected 2025 State of the Internet findings.
2025 State of the Internet: Malware Investigations
**Discover how Censys Research uncovered BeaverTail, Wainscot malware & Secret Blizzard APT infrastructure. Key findings from the 2025 State of the Internet Report.**
2025 State of the Internet: Notable Incidents
Explore Censys' 2025 State of the Internet Report: deep analysis of Cl0p ransomware, Cleo file transfer vulnerabilities (CVE-2024-55956), and key 2024 threat intelligence findings.
ICS and Iran: Exposure of Previously Targeted Devices
**Discover research on Internet-exposed critical infrastructure devices targeted by Iranian threat actors, including Unitronics PLCs and more. Learn key risks and exposure trends.**
Iran's Internet: A Censys Perspective
Iran's internet blackout since June 18, 2025: Censys research tracks host visibility, ASN recovery rates, and TIC transit bottlenecks across Iranian networks.
Poking at the Flodrix Botnet
Flodrix botnet exposed: How a C2 server misconfiguration revealed 745 compromised hosts exploiting CVE-2025-3248 in Langflow AI. Threat intelligence analysis.
Unmasking the Infrastructure of a Spearphishing Campaign
Discover how 16 open directories with obfuscated VBS files deploy RATs like Remcos, AsyncRAT, DCRat & LimeRAT via a 3-stage dropper system linked to APT-C-36.
Turning Off the (Information) Flow: Working With the EPA to Secure Hundreds of Exposed Water HMIs
Censys researchers found 400 exposed water facility HMIs online—40 fully unauthenticated. Learn how critical infrastructure risks were discovered and remediated.
TikTok and Malware
Uncovering hidden IOCs behind TikTok malware campaigns using AI-generated videos. Deep dive into Vidar & StealC info-stealers, malicious domains & PowerShell scripts.
Scouting a Threat Actor
Censys uncovers "SCOUT PROJECT," a novel C2 server exploiting CVE-2025-30208, CVE-2025-3248 & CVE-2025-29927. Discover the threat actor's infrastructure, backdoor toolkit, and attack methods.
The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices
Track Salt Typhoon's attack surface: Censys research reveals 6-month exposure trends for Cisco, Sophos, Ivanti & Fortinet devices targeted by this Chinese state-sponsored threat actor.
Lucid Phishing Platform Drives Toll Scam Campaigns
Discover how the Lucid phishing-as-a-service platform powers massive SMS toll scam campaigns using device farms, thousands of domains, and infrastructure traced to China.
IngressNightmare: Kubernaughty Kubernetes
Around 5,000 hosts expose Kubernetes NGINX ingress controllers to the internet. Censys researchers analyze the critical RCE vulnerability and its real-world impact.
On the Internet, Everything Old is Exploitable Again
New data reveals attackers are massively exploiting old, known vulnerabilities—many 5+ years old. Learn why legacy CVEs remain top targets and how to defend against them.
Investigating the Vast World of ICS Coverage: Part 2
**Discover how Censys ARC's "port tweaking" method uncovered 200+ hidden ICS protocols on non-standard ports, plus insights from full 65K port scans for Modbus, Fox & more.**
Investigating the Vast World of ICS Coverage: Part 1
Discover how Censys scans non-standard ports to uncover hidden ICS protocols like Modbus, ATG & more. Learn how targeted research boosted protocol coverage by up to 2.8x.
Baicells: A Retrospective
Censys ARC team reveals analysis of internet-exposed Baicells telecom devices, CVE-2023-24508 & CVE-2023-0776 vulnerabilities, and findings supporting the Reuters FBI investigation.
Pivoting for Nosviak
Censys uncovers a Nosviak botnet network powering DDoS-as-a-Service operations across 150+ hosts. Explore our threat intelligence research into this C2 ecosystem.
Massive FortiGate Config Leak: Assessing the Impact
Over 15,000 Fortinet FortiGate firewall configs and plaintext credentials leaked. Check if your devices are exposed. Analysis of the Belsen Group data leak.
Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs
**Discover how Censys analyzed Fox Kitten IOCs from the FBI/CISA advisory, uncovering hidden infrastructure patterns and active threats. Expert research on Iran-based cyber actors.**
Censeye: Gadgets!
Discover Censeye Gadgets – a new plugin system for extending threat intelligence research. Learn how query generator and data labeling gadgets help uncover adversary infrastructure.
Global ICS Exposures: What Our 2024 State of the Internet Report Reveals About Critical Infrastructure Security
Over 145,000 ICS services exposed globally. Censys research reveals critical HMI vulnerabilities in industrial control systems, with key risks to water infrastructure. Read the findings.
The Global State of Internet of Healthcare Things (IoHT) Exposures on Public-Facing Networks
Censys research reveals 14,004 exposed healthcare devices online, risking patient data breaches. Learn how DICOM, EMR/EHR exposures threaten security and what to do.
The DigiCert DCV Bug: Implications and Industry Impact
DigiCert's DCV bug impacted 83,267 certificates. Censys research reveals 26,373 still in use, top industries affected, and key takeaways for certificate management.
Stumbling Upon XehookStealer C2 Instances
Discover how Censys Search uncovered XehookStealer's link to Agniane Stealer through C2 fingerprinting, favicon pivoting, and adversary infrastructure analysis.
How the removal of Entrust from Chrome’s Root Store will Affect the Internet
Discover how HTTPS, SSL/TLS certificates, and Certificate Authorities secure the internet. Learn about Google's decision to remove Entrust and what it means for online trust.
Leveraging Censys Data: From the Classroom to Improving an Internet Monitoring Public Service
Discover how Georgia Tech researchers compare Censys and ANT Internet Census datasets to improve IODA's Internet outage detection using advanced measurement techniques.
July 2: Polyfill.io Supply Chain Attack - Digging into the Web of Compromised Domains
Polyfill.io supply chain attack exposes 384K+ hosts to malware. Learn how Censys detected compromised domains, affected sites like Hulu & Mercedes-Benz, and how to protect your website.
MOVEit Transfer: Auth bypass and a look at exposure
New critical MOVEit Transfer CVEs (CVE-2024-5806, CVE-2024-5805) discovered. Censys tracks 2,700 exposed instances. Learn about authentication bypass risks and exposure insights.
Analysis of ArcaneDoor Threat Infrastructure Suggests Potential Ties to Chinese-based Actor
Discover how Censys researchers analyzed the ArcaneDoor campaign exploiting Cisco firewall zero-days, uncovering threat actor infrastructure and potential China links.
CrushFTP CVE-2024-4040: Crushed Expectations
CrushFTP CVE-2024-4040 zero-day vulnerability: Censys reveals ~5,700 exposed instances. Learn about active exploitation risks, remediation insights, and attack surface findings.
Sisense: A Look at Industry and Geography
# SEO-Optimized Meta Description **Sisense Data Breach 2024: Censys research reveals 500+ exposed instances across industries including Finance, Healthcare & Sales. Learn the scope and impact of this critical security incident.** *Character count: 158* This meta description works because it: - **Includes high-value keywords**: "Sisense data breach 2024," "Censys research," "exposed instances," "security incident" - **Creates urgency and curiosity** with specific data points ("500+ exposed instances") - **Mentions affected industries** to attract relevant searchers - **Uses a clear call-to-action** ("Learn the scope and impact") - **Stays under the 160-character limit** to avoid truncation in search results
New Research Demonstrates Censys' Unmatched Internet Intelligence
**Discover how Censys benchmarks its internet scanning engine against competitors using honeypots. Learn why real-time, accurate internet intelligence matters for security teams.**
Ivanti Connect (in)Secure - Revisited
Censys reveals 24,590 exposed Ivanti Connect Secure gateways, with 24.7% vulnerable to critical CVEs. Discover trends, CISA guidance impacts, and suspicious fake hosts on AWS.
Water ICS Exposures Highlight Vulnerabilities in Critical Infrastructure Security
Censys research reveals exposed industrial control systems (ICS) threatening U.S. critical infrastructure. Discover vulnerable water, wastewater & energy devices at risk from state-backed hackers.
Fuzzy Matching to Find Phishy Domains
Discover how to use Censys data, BigQuery, and Levenshtein Distance fuzzy matching to proactively detect and block spoofed domains and brand impersonators. Protect your organization faster.
GoAnywhere MFT vulnerabilities are Going Nowhere for Now
Critical GoAnywhere MFT auth bypass (CVE-2024-0204) PoC released. Censys finds ~170 exposed admin interfaces at risk. Learn the vulnerability details and how to patch now.
The Mass Exploitation of Ivanti Connect Secure
Censys tracks 26,000+ exposed Ivanti Connect Secure hosts and 412 compromised IPs. Learn about CVE-2023-46805 & CVE-2024-21887 exploitation and mitigations.
Tracking Vidar Infrastructure with Censys
Stealers are trojans that collect credentials, notable files, and tokens from an infected computer and upload the data back to attacker-controlled infrastructure. Today, we will discuss one of the more advanced stealers: Vidar. Vidar is a piece of malware originating from the Arkei Stealer but uses new methods to find and direct traffic to […]
Discovery of NTC Vulkan Infrastructure
In March 2023, various media outlets published details from documents received in February of 2022 from a former NTC Vulkan employee who opposed Russia’s invasion of Ukraine. Moscow-based NTC Vulkan, the outlets reported, was contracted by Russian intelligence to create the following offensive cyber tools: In this investigation, Censys researchers discovered six hosts […]
Cisco IOS XE: Ten days later
Last week, we shared information about an ongoing event with Cisco devices and a backdoor installed on tens of thousands of Cisco hosts. And in our last update, we noted a significant drop in the number of infections. And would you believe that number has dropped to zero? Well, sort of… Since then, […]
HTTP/Who? CVE-2023-44487
Looking Closer at the Attack Mechanics On October 10, Google and Cloudflare released reports concerning abuse of a specific feature in the HTTP/2 protocol, leading to increased load and a potential denial-of-service on servers that cannot keep up with many concurrent requests. Their reports go into detail about a scenario where an actor […]
Unmasking Deception: Navigating Red Herrings and Honeypots
Here at Censys, our mission is to craft the ultimate blueprint of the web, map all the strange anomalies, and unearth where the wild things roam. We scan the internet indiscriminately and do an excellent job, too. And when you look at this data all day, like us, you tend to become accustomed to […]
Managed File Transfer (MFT) Exposure
Attackers Targeting MFT Tools Are On The Rise There is a constant war of convenience vs security being waged and moving files across networks is one of those battles being fought right now. While many of these tools are designed to only be accessed behind a firewall, they are often incorrectly configured to be accessed […]
Identifying CISA BOD 23-02 Internet-Exposed Networked Management Interfaces with Censys
UPDATE 2023-06-28: A section of the second paragraph of this article describing the FCEB hosts we examined for this analysis was edited for clarity. Executive Summary On June 13, CISA released BOD 23-02 with the objective of mitigating the risks associated with remotely accessible management interfaces that might allow configuration or control of federal agency […]
MOVEit: an Industry Analysis
Note: As Censys is an internet scanner, we cannot determine if these devices are vulnerable; these are the MOVEit services we found running exposed on the internet. Introduction Recently, Managed File Transfer (MFT) services have been gaining considerable attention in the realm of security. Although MFT may not be a regular discussion topic, it is […]
Revisiting the State of the Internet
It’s been about two months since we released our 2023 State of the Internet Report. With access to the most comprehensive internet-wide scan data available, narrowing our focus for the report to a specific area or set of technologies on the internet was a formidable challenge. Ultimately, we decided to focus on the web, […]
MOVEit Transfer Vulnerability
UPDATES: SUMMARY: Another day, another MFT (Managed File Transfer) product getting pwned. On the heels of the GoAnywhere MFT 0-day, this time, it’s a vendor called Progress Software Corporation and their product, “MOVEit Transfer,” that facilitates the transfer of files between business partners and their customers using a variety of protocols such as SSH and […]
Zyxel Vulnerabilities
Zyxel has had an interesting run the last few weeks, with three new vulnerabilities: CVE-2023-33009, CVE-2023-33010, and the most critical, CVE-2023-28771. The Mirai botnet is currently exploiting CVE-2023-28771. Censys found 24,457 potentially vulnerable Zyxel ATP, USG, and VPN products exposed to the internet. 86.72% of these hosts run the IKE protocol required for successful CVE-2023-28771 […]
Internet Footprint of SOHO Devices Exploited by Volt Typhoon
On May 24, 2023, Microsoft announced that they’d discovered “stealthy and targeted malicious activity” focused on communications critical infrastructure of the US and Guam. The attacks are attributed to a Chinese state-sponsored actor dubbed Volt Typhoon, who has been active since mid-2021. One of Volt Typhoon’s primary techniques is living off the land, which […]
Months after first GoAnywhere MFT zero-day attacks, Censys still sees ~180 public admin panels
GoAnywhere MFT Breaches by high-profile ransomware groups have now affected 8 confirmed organizations (and counting) Executive Summary: Timeline: The Internet’s Response: We observe a slow and steady patch response to this actively exploited vulnerability. Since this zero-day was first disclosed, Censys has seen an approximate 46% decrease in the number of exposed GoAnywhere Admin Panels […]
Virtual Ghosts
These servers should not exist! Now Generally Available for all Censys customers is a new asset type, Web Entities. A “Web Entity” in Censys allows users to treat their web-based assets as a single high-level commodity, grouping hosts and services as part of an organization’s web service ecosystem. In addition to introducing this new data […]
SoftEther VPN: Identifying VPN Software Across the Internet
SoftEther VPN is a free, open-source VPN client created by researchers in Japan and used for commercial and non-commercial use. The United States, Japan, and China are the top three countries where Censys observed the highest number of SoftEther hosts. Censys also found that four of the top ten autonomous systems where SoftEther […]
Four Oh Four: A Look at Our Favorite Status Code
Happy 404 day from Censys! Here are some fun stats involving our favorite “resource not found” HTTP status code! We’ve all experienced it: you’re leisurely browsing the web, surfing along, and suddenly come across this: 404 Page Not Found. When a user encounters a 404 error, it could mean that the user incorrectly entered the […]
Potential Chinese Influence on African IT Infrastructure
Between 10-21 February 2023, Censys discovered over 46,000 commercial devices associated with four U.S. blacklisted Chinese tech manufacturers in Kenya, Zambia, South Africa, and Mauritius. Huawei, ZTE, Hikvision, and Dahua were blacklisted by the U.S. government in November of 2022 and the importation or sale of their equipment was banned in the U.S. […]
ESXiArgs: History, Variants, and SLP!
Last week, we discovered two potential early victims of ESXiArgs (Host-A, Host-B) after noticing that they were the only two hosts with the ransom note on February 1 and January 31, 2023. Manually searching our data, we determined that they’d had a variant of the ransom note since mid-October 2022, but we were […]
Censys in the News: ESXiArgs Ransomware Coverage
The Censys research team has been closely monitoring the spread of ESXiArgs ransomware since it was first detected in early February. The team has used Censys internet scanning data to track infected hosts across countries, to monitor how the hacker group has since responded, and to develop a dashboard with Censys data that researchers […]
RCE Zero Day in GoAnywhere MFT [CVE-2023-0669]
The list of organizations who have come forward as victims of a GoAnywhere breach has grown long: Community Health Systems, Hatch Bank, Hitachi Energy, Rubrik, the City of Toronto, Procter & Gamble, Saks Fifth Avenue, and Crown Resorts. update 2023-03-17 Hitachi Energy has become the 3rd organization to report a data breach in its GoAnywhere […]
The Evolution of ESXiArgs Ransomware
Mark Ellzey & Emily Austin Please see our new post, ESXiArgs: History, Variants, and SLP! for the latest updates. Executive Summary Over the last few days, Censys has observed just over 500 hosts newly infected with ESXiArgs ransomware, most of which are in France, Germany, the Netherlands, and the UK. During analysis, we discovered two […]
Follow-up on Russian “Host F”
(As reported in “Russian Ransomware C2 Network Discovered in Censys Data”) Executive summary In late January 2023 Censys analysts reviewed Host F (95.213.145.99), which was previously identified in Censys reporting as a Russia-based, probably malicious host running a Command and Control (C2) ransomware kit with callbacks to an associated Bitcoin wallet. Upon return to the […]
ESXWhy: A Look at ESXiArgs Ransomware
Emily Austin & Mark Ellzey UPDATE 2023-02-15 Please see our new post, The Evolution of ESXiArgs Ransomware, for further updates. UPDATE 2023-02-13 Over the weekend (2023-02-09 through 2023-02-11), we’ve seen a slight increase in the number of infected hosts, where at the time of writing, there were 1,994 hosts found in our search engine. We […]
Tracking a SugarCRM Zero-Day
Update January 17th, 2023: SugarCRM had a third-party forensics firm validate that there was no intrusion to their cloud-based products due to this vulnerability. More information on that can be found here. Update January 11th, 2023: This issue is now being tracked as CVE-2023-22952 / Updated compromised tallies Update January 10th, 2023: SugarCRM is aware of […]
Using Censys to Find Misconfigured S3
Findings In under an hour using Censys data, we found 7,640 potential S3 buckets, 49 completely open (World Read + Write), 16 buckets with anonymous write, 1,235 with anonymous read access, and more. Finding S3 Targets With Censys Amazon S3 (Amazon Simple Storage Service) is a product that provides object storage over the web […]
‘Tis the Season: ???? A Look Back at the Critical Log4j Vulnerability
It’s been just over a year since the infamous log4j vulnerability was publicly disclosed, sending security teams into a patching frenzy as holidays loomed ahead. The vulnerability, dubbed Log4Shell, is a critical remote code execution (RCE) vulnerability in the Apache log4j logging library. It allows a threat actor to send a request with a […]
Pulse Connect Secure: A View from the Internet
Pulse Connect Secure is a low-cost and widely-deployed SSL VPN solution for remote and mobile users. Over the years, researchers have found several significant vulnerabilities in the server software, some even resulting in the active exploitation of critical infrastructure by malicious threat actors. In April of 2021, CISA released a report detailing some of […]
Critical Vulnerability (CVE-2021-35587) in Oracle Fusion Middleware Now Exploited!
On Monday, November 28, 2022, the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2021-35587 and CVE-2022-4135 to its Known Exploited Vulnerabilities Catalog and provided an update based on evidence of active exploitation. CVE-2021-35587 is associated with Oracle Fusion Middleware Access Management, which is an enterprise level Single Sign-on (SSO) solution. CVE-2021-35587 allows for Pre-auth Remote Code […]
Critical Vulnerability in OpenSSL!
Quick Links Censys Search Query for OpenSSL >=3.0.0 Censys ASM Inventory Query for OpenSSL >= 3.0.0 OpenSSL vendor vulnerability announcement. **Updates** 2022-11-01 Details of two high-severity vulnerabilities patched in OpenSSL version 3.0.7 are now available (CVE-2022-3786, CVE-2022-3602). Both are buffer overflows in the X.509 certificate verification process, “specifically in name constraint checking.” The first, CVE-2022-3786, […]
The Top 5 Censys-Visible Risks on the Internet
The Internet offers no shortage of risks – but which might your organization be most vulnerable to? To help answer this question, the Censys Research team sampled more than 2 million hosts as part of our 2022 State of the Internet Report. The team chose two dates six months apart and ran risks observed […]
GreyNoise Research Finds Censys Scan Data Is Fastest, Most Comprehensive
Cybersecurity firm GreyNoise Intelligence recently published “A Week In the Life of a GreyNoise Censor: A Benign View.” I’m incredibly excited about this blog because anytime an organization outside of yours conducts research that reinforces statements you make on a daily basis, it’s a wonderful thing. There’s even still some additional nuance to be explored, […]
Databases. EXPOSED! (Redis)
Published on 09.19.2022 Part 1: Redis Takeaways There are 39,405 unauthenticated Redis services out of 350,675 total Redis services on the public internet. Almost 50% of unauthenticated Redis services on the internet show signs of an attempted compromise. Preface In this new series of posts, we decided to answer the question: “What is the state […]
The Neverending Story of Deadbolt
Published on 09.10.2022 Introduction Deadbolt, a ransomware campaign haunting QNAP NAS customers for the last few months, has seen a consistent number of infections on a fairly regular cadence. But recently, Censys has observed a massive uptick in Deadbolt-infected QNAP devices. The Deadbolt crew is ramping up their operations, and the victim count is growing […]
Finding Hacked Web Servers with Censys Search
According to the 2022 Verizon Data Breach Investigations Report, web servers are the top asset most commonly impacted in breaches. This is not surprising – after all, web servers often make up the bulk of an organization’s Internet-facing infrastructure, and therefore are more likely to be exposed than other types of digital assets. Finding hacked […]
Where the Weird Things Are Investigating Unusual Internet Artifacts with Censys Search Data
The other day, I found something weird on the Internet. A cluster of hosts was running an unrecognized service – all on port 55555, all on one autonomous system, and all with the same cryptic two-character service banner. A strange combination of characteristics This is unusual – particularly because of this unique banner message […]
Tracking Deadbolt Ransomware Across the Globe
Deadbolt, the ransomware attack that just won’t end, appears to be back for a third round. Our Rapid Response Team has been monitoring the QNAP vulnerability since it first appeared in late January 2022. A quick refresh on QNAP Deadbolt ransomware QNAP is a manufacturer of network-attached storage (NAS) devices. In January of this year, […]
GoCD Unauthenticated Takeover
On October 27, an engineer at SonarSource found that a change made in 2018 to the GoCD Continuous Integration system code completely removed the authentication logic for incoming requests destined to the service’s addon’s directory. It also seems that several addons, which are installed and enabled by default, had some bugs of their own. […]
VMware CVE-2021-22005 Technical & Impact analysis
Update 2 (2021-09-28) @wvuuuuuuuuuuuuu disclosed how to get execution using this API endpoint. The method simply requires writing to /etc/cron.d. Both the /dataapp and /hyper/send handler RCE PoCs are now fully public. Update 1 (2021-09-23, shortly after publishing) @testanull on Twitter claims that CEIP is not a requirement for execution, which implies there are multiple […]
Understanding the impact of OMIGOD (CVE-2021-38647)
Cloud security company wiz.io recently announced a series of vulnerabilities related to a component that is installed automatically on many Azure Linux virtual machines: The Microsoft Open Management Infrastructure (OMI) agent. One of these vulnerabilities is critical in nature, having a 9.6 CVSS score. The root cause of the vulnerability is a missing check […]
Hurricane Ida and Louisiana Infrastructure
By Derek Abdine and Mark Ellzey Introduction On August 29, a category four hurricane named Ida made landfall in Louisiana, where several news organizations reported winds of more than 150 miles per hour (241 km/h). Hurricanes can do tremendous damage to utility infrastructures, such as power, cable, DSL/telephony, and fiber networking, creating catastrophic failures that […]
More Critical RCE’s, Assessing the Impact of F5 Vulnerabilities
What is the issue? On March 10, 2021, a security advisory was released by F5 including 7 vulnerabilities, 4 of which are critical remote code execution vulnerabilities impacting all BIG-IP modules and a significant number of BIG-IQ products. On March 10, 2021, Censys identified 440,882 distinct hosts running BIG-IP products around the globe, indicating significant […]
Assessing VMware vCenter RCE Impact across the Globe
What’s the issue? Three vulnerabilities were recently released by VMware’s security advisory and impact vCenter Server or ESXi — CVE-2021-21972, CVE-2021-21973, CVE-2021-21974. Impacted Versions of vCenter: Impacted Versions of ESXi: However, CVE-2021-21972 is a critical remote code execution vulnerability according to Tenable. Using the data that powers our ASM Platform, the Censys team found 6,868 […]
Assessing Internet-wide Exposure to the SolarWinds Compromise
This blog post was last updated on: February 1, 2021 This will be the last blog update summarizing our visibility of Internet-facing Orion hosts from mid-December through January 2021. Censys has continued to update this blog with the purpose of understanding global trends and impact around Internet-facing Orion hosts. As of January 31, 2021, Censys […]
Probing the Xiongmai/HiSilicon SoC Vulnerability
News broke this week about a critical vulnerability in the firmware of certain HiSilicon-based devices running software from Xiongmai, including network video recorders, IP enabled cameras, and digital video recorders. HiSilicon is a “system on a chip” (or SoC) manufacturer, and some of its products are intended for use in IP-enabled video equipment. The vulnerability was uncovered by Vladislav […]