ARTEX: Agentic Asbestos
Censys detects 1,465 hosts running exposed instances of ARTEX, an open-source, LLM-driven autonomous pentesting framework that has been linked to malicious activity from multiple threat groups.
Topic
Threat Intelligence
89 posts
Frostbitten in France: A Danfoss StoreView Internet Exposure Report
A review of the attacks targeting refrigerators in France via Danfoss controllers, resulting in spoiled food and, in some cases, fires.
DarkSword/Coruna Open Directory Finding Report
Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […]
Mythic C2 Activity at Internet Scale
Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it.
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet
Most deployments of the NPS tunneling tool are benign. Some are not. Censys ARC shares signals for distinguishing the benign from the malicious.
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
New Censys ARC research examines an exposed server containing Moobot botnet source code, active attack records, DoS tooling, and a fraudulent identity verification service.
What the ERMAC Source Leak Says About HookBot
ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […]
Mirai and Its Heirs: A Decade of Structural Neglect in IoT Security
A deep look at how Mirai and its descendents have evolved over the past decade — and why the botnet's methodology still works today.
DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster
Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.
CISA Alert: Water Sector PLC Targeting
CISA alert: Threat actors targeting PLCs in Water and Wastewater Systems. This report includes current Censys-observed internet exposure for each named vendor.
A Chill in the Air: Cl0p Targets Windchill, Another Enterprise Software Product
Cl0p's recent targeting of Windchill shows that Internet-exposed enterprise back office software remains a high value target for threat actors.
The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift
Get an early look at Censys' 2026 State of the Internet Report, including Internet-exposed AI infrastructure and shifting global trends in ICS exposures.
Inside Russia’s Camera-Hacking Espionage Campaign
Censys ARC investigates the Russian camera-hacking espionage campaign against countries in the EU, NATO, and Ukraine.
AsyncRAT Family Threat Overview
New Censys ARC research identifies more than a dozen live C2 infrastructure instances as descendants of AsyncRAT.
UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign
New Censys ARC research discovers that UNC1151's phishing email to a Belarusian politician is linked to a much broader campaign.
AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale
Censys ARC found 412 web properties across 236 hosts running AdaptixC2, an open-source post-exploit framework. Get the IOCs + full breakdown.
REDCap on the Internet: An Exposure Analysis
Censys ARC's perspective on UNC6508's REDCap server exploitation in a long-term research espionage campaign, as reported by Google Threat Intelligence Group.
The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data
It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful link to fix it. This one pointed at: Believe it or not, xupqnqz[.]one is not USPS (United States […]
Iran-Linked Operators Suspected in ATG Breaches
Censys finds 6,502 ATG services on 6,057 hosts reachable on the public internet today. Every ATG service indexed in Censys is reachable without authentication.
The cPanel Situation Is…
CVE-2026-41940: Critical cPanel/WHM pre-auth bypass exploited within 24hrs. Censys research reveals Mirai variants, ".sorry" ransomware & mass automated attacks.
Oluomo: Microsoft OAuth AiTM Phishing Using a Naturalization-Form Lure
Censys uncovers OLUOMO, a sophisticated AiTM phishing cluster harvesting Microsoft credentials via fake document portals, Azure proxies, and compromised sites.
Rhadamanthys and the Limits of Private Sector Operations
Explore the limits of private-sector threat intelligence through a 2022 Rhadamanthys infostealer case study. SANS CTI Summit research on harm reduction without law enforcement support.
Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs
FBI & CISA alert: 5,219 Rockwell PLCs exposed to Iranian APT exploitation. Censys threat intelligence reveals U.S. attack surface, IOC analysis & key findings from AA26-097A.
Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet
Discover how attackers exploit exposed ComfyUI instances for RCE, cryptomining, and proxy botnets. Censys ARC reveals 1,000+ vulnerable targets and advanced malware tactics.
Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware
**Discover how technique-based HTTP body hunting on Censys surfaced a live ClickFix campaign delivering XWorm V5.6 via PhantomVAI loader—reducing the web to 42 actionable results.**
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Censys discovers "CTRL," an undocumented Russian remote access toolkit combining credential phishing, keylogging, RDP hijacking & reverse tunneling. Read the full threat intelligence analysis.
Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker
Handala's wiper cyberattack destroyed Stryker Corporation's global Windows environment via suspected Microsoft Intune compromise. Explore the Iran-linked threat intelligence and key defenses.
NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure
Censys sees 25 exposed NetSupport Manager Gateways across global infrastructure. Get the technical overview of NetSupport Manager.
Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do
Discover how Censys identifies Internet-exposed IP cameras in Iran using threat intelligence, CVE data, and advanced search queries.
ResidentBat: Belarusian KGB Android Spyware at Internet Scale
Discover how ResidentBat, a Belarusian KGB Android spyware, targets journalists. Explore its C2 infrastructure, capabilities, and threat intelligence findings.
Vshell: A Chinese-Language Alternative to Cobalt Strike
A Go-based C2 tool used in threat operations. Learn about its Cobalt Strike parallels, evolution, and threat intelligence insights.**
Odyssey Stealer: Inside a macOS Crypto-Stealing Operation
Discover how Odyssey Stealer targets macOS users to steal crypto wallets via a MaaS affiliate model. Expert threat intelligence on its C2 infrastructure and tactics.
Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access
Censys researchers uncover 86 fake voicemail sites deploying Remotely RMM malware via German-language lures and BAT files. Explore the full attack chain analysis.
OpenClaw in the Wild: Mapping the Public Exposure of a Viral AI Assistant
Discover how OpenClaw, the open-source AI assistant, surged to 21,000+ exposed instances in one week. Silas Cutler analyzes the security risks and threat intelligence behind this rapid adoption.
AsyncRAT C2 Activity at Internet Scale
Discover Censys research on AsyncRAT—tracking 57+ active C2 servers via self-signed TLS certificates. Explore threat intelligence on this open-source RAT's infrastructure and capabilities.
A Tiny Peek Into Unauthenticated SOCKS Proxies
Discover how SOCKS proxies can be abused as open proxies. Censys research reveals how many of 3.4M+ SOCKS servers are truly exploitable—and the real threat they pose.
Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface
Discover how Fake Captcha and ClickFix lures exploit trusted web infrastructure to deliver malware. New research reveals fragmented delivery models behind visually uniform campaigns.
ErrTraffic: Inside a GlitchFix Attack Panel
Discover how ErrTraffic powers ClickFix campaigns with fake error pages & malware delivery. Censys research reveals source code, C2 infrastructure & threat intelligence insights.
Recap of a Suspicious Surge in Cobalt Strike
Censys research reveals a massive burst of Cobalt Strike servers across AS138415 and AS133199 in December 2025, linked to suspicious infrastructure and shell companies. Read the full threat intelligence analysis.
Investigating the Infrastructure Behind DDoSia's Attacks
Discover Censys research on DDoSia, the pro-Russian hacktivist DDoS tool by NoName057(16) targeting Ukraine and NATO. Threat intelligence on infrastructure, tactics, and tracking.
Using Cobalt Strike to Find (More) Cobalt Strike
Discover techniques to uncover hidden Cobalt Strike C2 servers by pivoting from known infrastructure using TLS certificates, Censys scan data, and threat intelligence methods.
EtherHiding: Fake CAPTCHAs, Click-Fix Lures, and Blockchain-Backed Payload Delivery
**Discover how EtherHiding uses blockchain smart contracts to deliver malware via fake CAPTCHAs. Explore the attack chain, threat intelligence, and defense insights.**
Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale
Discover how Remcos RAT operates, persists, and communicates with C2 servers. Threat intelligence research reveals 150+ active servers, key hosting patterns, and detection insights.
From Evasion to Evidence: Exploiting the Funneling Behavior of Injects
Discover how SmartApe threat intelligence exposes malware delivery chains. Learn to leverage TDS chokepoints, redirect analysis & Censys data to detect evasive URL-based attacks.
Unpacking the Oracle EBS Debacle: Industries, Geography, and MOVEit Comparisons
Cl0p exploits Oracle E-Business Suite zero-day (CVE-2025-61882) in extortion campaign. Censys research reveals exposed instances across industries and compares tactics to 2023 MOVEit attack.
Disallow: /security-research? Crypto Phishing Sites' Failed Attempt to Block Investigators
Censys uncovers 60+ crypto phishing pages impersonating Trezor and Ledger wallets. Learn how robots.txt analysis exposed this campaign and its unusual tactics.
Ollama Drama: Investigating the Prevalence of Ollama Open Instances with Censys
Censys research reveals 10.6K exposed Ollama LLM instances online—many publicly promptable. Discover the threat intelligence behind unsecured AI deployments.
A Look at PolarEdge Adjacent Infrastructure
PolarEdge Botnet Infrastructure & Residential Proxy Analysis** `Censys ARC team explores PolarEdge botnet infrastructure, residential proxy networks, and a connect-back proxy system found on 2,400+ hosts. Updated threat intelligence included.`
Internet Archaeology: A Decade of Defaced Routers?
Over 330 Ubiquiti devices still display "HACKED-ROUTER" defacement banners dating back to 2016. Censys research reveals compromised infrastructure lingering for nearly a decade.
Pondering my ORB - A look at PolarEdge Adjacent Infrastructure
Censys ARC Team updates PolarEdge threat intelligence research with key clarifications on Mbed TLS certificates and attacker infrastructure. Read the corrected analysis.
2025 State of the Internet Report: Summary and Conclusions
Discover Censys' 2025 State of the Internet Report: key findings on C2 takedowns, DPRK malware, residential proxy threats, and malicious infrastructure trends. Read the full series.
2025 State of the Internet Report: Open Directories Time to Live
Discover how open directories are used for malicious purposes. Research reveals 50% vanish within a day. Learn why real-time threat intelligence is critical.
2025 State of the Internet: C2 Time to Live
Discover how long Cobalt Strike and Viper C2 servers survive online. Censys threat intelligence reveals TTL lifespans, port trends, and key insights for defenders.
2025 State of the Internet: Malware Investigations
**Discover how Censys Research uncovered BeaverTail, Wainscot malware & Secret Blizzard APT infrastructure. Key findings from the 2025 State of the Internet Report.**
2025 State of the Internet: Notable Incidents
Explore Censys' 2025 State of the Internet Report: deep analysis of Cl0p ransomware, Cleo file transfer vulnerabilities (CVE-2024-55956), and key 2024 threat intelligence findings.
Poking at the Flodrix Botnet
Flodrix botnet exposed: How a C2 server misconfiguration revealed 745 compromised hosts exploiting CVE-2025-3248 in Langflow AI. Threat intelligence analysis.
Unmasking the Infrastructure of a Spearphishing Campaign
Discover how 16 open directories with obfuscated VBS files deploy RATs like Remcos, AsyncRAT, DCRat & LimeRAT via a 3-stage dropper system linked to APT-C-36.
From Detection to Disruption: Censys Supports Global Government Threat Hunting
Discover how the Censys Threat Hunting Module empowers government teams to detect adversary infrastructure before attacks. Proactive threat intelligence for national security.
Google Data Shows Fewer Zero Days in 2024, But More Targeting of Enterprises
Google data reveals 2024 zero-day trends: 75 vulnerabilities found, with 44% targeting enterprise security and networking products. Learn which vendors are most at risk.
Lucid Phishing Platform Drives Toll Scam Campaigns
Discover how the Lucid phishing-as-a-service platform powers massive SMS toll scam campaigns using device farms, thousands of domains, and infrastructure traced to China.
Pivoting for Nosviak
Censys uncovers a Nosviak botnet network powering DDoS-as-a-Service operations across 150+ hosts. Explore our threat intelligence research into this C2 ecosystem.
Cybersecurity Predictions for 2025: Navigating AI, Threat Profiling, and Industry Transformation
Discover top cybersecurity trends for 2025: healthcare breaches, AI threats, skills gap challenges & expert predictions. Learn what security leaders see ahead.
Censeye: Gadgets!
Discover Censeye Gadgets – a new plugin system for extending threat intelligence research. Learn how query generator and data labeling gadgets help uncover adversary infrastructure.
July 2: Polyfill.io Supply Chain Attack - Digging into the Web of Compromised Domains
Polyfill.io supply chain attack exposes 384K+ hosts to malware. Learn how Censys detected compromised domains, affected sites like Hulu & Mercedes-Benz, and how to protect your website.
Back to the Future: How Historical Data Can Enhance Your Cyber Defenses
Discover why historical internet intelligence is essential for threat hunting. Learn how Censys helps security teams track adversary infrastructure, build timelines, and anticipate future cyberattacks.
Boost Your Threat Hunting Skills with These 5 Informative Webinars
Watch 5 on-demand threat hunting webinars featuring Censys Search experts. Learn to track adversary infrastructure, uncover emerging threats, and level up your threat intelligence skills.
Analysis of ArcaneDoor Threat Infrastructure Suggests Potential Ties to Chinese-based Actor
Discover how Censys researchers analyzed the ArcaneDoor campaign exploiting Cisco firewall zero-days, uncovering threat actor infrastructure and potential China links.
7 Resources to Inform Your Next Hunt for Malicious Infrastructure
Discover 7 expert resources for hunting malicious infrastructure using Censys Search. Learn to track C2 networks, phishing sites, and adversary infrastructure with threat intelligence tips.
Continuous Threat Exposure Management (CTEM)
Discover how Continuous Threat Exposure Management (CTEM) transforms threat detection with proactive adversary infrastructure monitoring.
Actionable Threat Intelligence
Discover how actionable threat intelligence reduces cyber risk. Learn about adversary infrastructure, threat detection, and the Censys Platform's role in proactive security.
Superior Internet Intelligence for Advanced Cyber Threat Intelligence Services
Enhance cyber defense with Censys Search — the industry's most comprehensive internet intelligence platform. Empower threat hunters with advanced threat detection and vulnerability insights.
Top Ransomware Attack Vectors: How to Defend Against Them
# SEO Meta Description **Ransomware attacks surged 70% in 2023. Learn top attack vectors, prevention strategies, and how proactive threat intelligence can strengthen your ransomware defense.** *(158 characters)* This meta description works because it: - **Leads with a compelling statistic** (70% surge) to grab attention - **Includes key search terms**: ransomware attacks, attack vectors, prevention strategies, threat intelligence, ransomware defense - **Creates urgency** with the data point about the surge - **Promises actionable value** ("Learn...strategies") - **Stays under 160 characters** for full display in search results
24 Questions to Ask About Your Data in 2024
# SEO-Optimized Meta Description **Option 1 (Best):** Discover 24 critical questions to evaluate your internet intelligence and threat data. Improve adversary infrastructure detection with better internet scan data from Censys Search. **Character count:** 158 **Option 2:** Is your threat intelligence data holding you back? Explore 24 questions to assess your internet intelligence and strengthen your cybersecurity strategy in 2024. **Character count:** 155 --- ## Why This Works: - **Keywords included:** "internet intelligence," "threat intelligence," "adversary infrastructure," "Censys Search," "internet scan data" - **Compelling hook:** The numbered list ("24 questions") creates curiosity and implies actionable, structured content - **Action-oriented language:** "Discover," "Improve," "Evaluate" encourage clicks - **Value proposition clear:** Readers
Discovery of NTC Vulkan Infrastructure
In March 2023, various media outlets published details from documents received in February of 2022 from a former NTC Vulkan employee who opposed Russia’s invasion of Ukraine. Moscow-based NTC Vulkan, the outlets reported, was contracted by Russian intelligence to create the following offensive cyber tools: In this investigation, Censys researchers discovered six hosts […]
Unleash the Power of Censys Search: A Quick Guide to Queries
April 2026 Update: Censys has come a long way: an entire platform complete with pivoting, dashboards, rapid response queries by Censys ARC, investigation tools, and MCP support. Access sample queries within the free platform, and happy hunting! Whether you’re brand new to Censys Search and are looking for tips to get started, or are […]
Raising the Bar on Internet Coverage: Predictive Scanning Takes The Censys Internet Map to the Next Level
At Censys, our goal is to be the one place to understand everything on the internet – for more effective threat hunting and exposure management. With the rapid proliferation of cloud providers, software, web properties, remote devices, and more, it is becoming more challenging for security teams to identify threats or exposures and take action. […]
Mission Critical Intelligence: Why This Government Agency Partners with Censys to Understand the Threat Landscape
When ZMap, the world’s first global, open-source internet scanner, was released in 2012, it immediately attracted tens of thousands of users from leading government agencies who conducted critical searches to understand the emerging digital threat landscape. Today, Censys’ proprietary Internet Map is the most comprehensive, up-to-date collection of global internet infrastructure enriched with critical context […]
ESXiArgs: History, Variants, and SLP!
Last week, we discovered two potential early victims of ESXiArgs (Host-A, Host-B) after noticing that they were the only two hosts with the ransom note on February 1 and January 31, 2023. Manually searching our data, we determined that they’d had a variant of the ransom note since mid-October 2022, but we were […]
The Evolution of ESXiArgs Ransomware
Mark Ellzey & Emily Austin Please see our new post, ESXiArgs: History, Variants, and SLP! for the latest updates. Executive Summary Over the last few days, Censys has observed just over 500 hosts newly infected with ESXiArgs ransomware, most of which are in France, Germany, the Netherlands, and the UK. During analysis, we discovered two […]
Follow-up on Russian “Host F”
(As reported in “Russian Ransomware C2 Network Discovered in Censys Data”) Executive summary In late January 2023 Censys analysts reviewed Host F (95.213.145.99), which was previously identified in Censys reporting as a Russia-based, probably malicious host running a Command and Control (C2) ransomware kit with callbacks to an associated Bitcoin wallet. Upon return to the […]
ESXWhy: A Look at ESXiArgs Ransomware
Emily Austin & Mark Ellzey UPDATE 2023-02-15 Please see our new post, The Evolution of ESXiArgs Ransomware, for further updates. UPDATE 2023-02-13 Over the weekend (2023-02-09 through 2023-02-11), we’ve seen a slight increase in the number of infected hosts, where at the time of writing, there were 1,994 hosts found in our search engine. We […]
6 Steps Threat Profilers Can Follow to Uncover Ransomware (and Other Nefarious Activity)
Ransomware attacks have dominated headlines in recent years, as attackers take aim at an increasing variety of targets, from school districts to critical infrastructure networks. Ransomware accounted for 25% of all breaches in 2022, according to the Verizon Data Breach Investigations Report, and in early 2022, CISA reported that it had observed incidents of ransomware […]
Tracking a SugarCRM Zero-Day
Update January 17th, 2023: SugarCRM had a third-party forensics firm validate that there was no intrusion to their cloud-based products due to this vulnerability. More information on that can be found here. Update January 11th, 2023: This issue is now being tracked as CVE-2023-22952 / Updated compromised tallies Update January 10th, 2023: SugarCRM is aware of […]
ProxyNotShell Proof Of Concept Now Public
Last week, a security researcher known as “Janggggg” published a proof of concept (PoC) exploit for the latest “ProxyNotShell” vulnerabilities in Microsoft Exchange that were discovered in September. ProxyNotShell is already confirmed to be actively exploited by a Chinese nation-state threat actor at the time of the vulnerability announcement by Microsoft. The attack was initially […]
C2: When Attackers Use Our Weapons Against Us
Super embarrassing when you’re hosting C2 infrastructure as a respectable enterprise, right? Or when the Red Team beats the Blue Team? Thanks to the popularization of Threat Intelligence, most organizations are aware of needing to block external connections to C2 infrastructure, but what happens when you’re the one hosting it? Sure, you can wait […]
Tracking Deadbolt Ransomware Across the Globe
Deadbolt, the ransomware attack that just won’t end, appears to be back for a third round. Our Rapid Response Team has been monitoring the QNAP vulnerability since it first appeared in late January 2022. A quick refresh on QNAP Deadbolt ransomware QNAP is a manufacturer of network-attached storage (NAS) devices. In January of this year, […]
GoCD Unauthenticated Takeover
On October 27, an engineer at SonarSource found that a change made in 2018 to the GoCD Continuous Integration system code completely removed the authentication logic for incoming requests destined to the service’s addon’s directory. It also seems that several addons, which are installed and enabled by default, had some bugs of their own. […]
VMware CVE-2021-22005 Technical & Impact analysis
Update 2 (2021-09-28) @wvuuuuuuuuuuuuu disclosed how to get execution using this API endpoint. The method simply requires writing to /etc/cron.d. Both the /dataapp and /hyper/send handler RCE PoCs are now fully public. Update 1 (2021-09-23, shortly after publishing) @testanull on Twitter claims that CEIP is not a requirement for execution, which implies there are multiple […]