Multi-protocol malware trap catching everything.

# Threat Intelligence Report: Dionaea Honeypot (NadSec Sydney) - May 2026

**Key Points:**
*   **Zero-Payload Operations Prevail:** The complete absence of file hashes and URLs in the dataset strongly indicates that threat actors are shifting toward "Living off the Land" (LotL) techniques, memory-only execution, and native administrative shell abuse.
*   **SMB Infrastructure Dominates Probing:** Port 445 accounts for over 58% of all recorded events, highlighting an ongoing, aggressive global scanning apparatus targeting unpatched Windows infrastructure and legacy file-sharing misconfigurations.
*   **Database Extortion is Highly Automated:** Ports associated with MS-SQL (1433) and MongoDB (27017) are under sustained brute-force and exploit attacks, likely linked to Ransomware-as-a-Service (RaaS) affiliates and data-wiping campaigns.
*   **IoT Botnets Exploit HTTP-Alt (81):** A significant volume of activity on port 81 correlates with advanced Mirai botnet variants (such as Nexcorium and tuxnokill) targeting unpatched digital video recorders (DVRs) and end-of-life (EoL) routers.
*   **Gray-Area Scanners Blur Attack Lines:** Entities operating under the guise of research or commercial scanning (e.g., Netiface America, Driftnet) are frequently exhibiting hostile behaviors or serving as proxies for threat actors.

**Research Scope and Limitations**
The evidence leans toward a highly automated, opportunistic threat landscape where threat actors utilize compromised cloud infrastructure and residential proxies to mask their origins. Research suggests that while traditional malware payloads are declining in initial access phases, memory-resident exploits and credential stuffing remain rampant. Given the nature of honeypot telemetry, it seems likely that some activity categorized as malicious may originate from aggressive but nominally benign commercial scanners. Therefore, attribution should be treated with appropriate analytical caution. 

**Methodology and Telemetry Source**
This report synthesizes threat intelligence derived from the NadSec T-Pot honeypot infrastructure deployed in Sydney, Australia, specifically focusing on the Dionaea sensor logs from May 2026. Dionaea is a low-to-medium interaction honeypot designed to emulate a variety of vulnerable network services. The dataset comprises 5,846 total original indicators, all labeled as `bruteforce` events. Extensive open-source intelligence (OSINT) correlations, malware behavioral reports, and infrastructure profiling have been integrated to provide a comprehensive analysis of the threat actors, campaigns, and vulnerabilities observed during this period.

---

## 1. Executive Summary

In May 2026, the NadSec Sydney Dionaea honeypot captured a relentless barrage of automated probing, credential stuffing, and exploit attempts targeting enterprise and Internet of Things (IoT) services. An analysis of the 5,846 indicators reveals a threat landscape increasingly dominated by automated subjugation scripts rather than traditional file-based malware delivery. The complete absence of captured file hashes or URLs in the dataset indicates that modern attackers are effectively bypassing traditional signature-based detection mechanisms by relying on native commands, exploiting memory vulnerabilities, and abusing built-in administrative tools—a paradigm known as "Living off the Land" [cite: 1].

The telemetry was overwhelmingly dominated by Server Message Block (SMB) traffic on TCP port 445, constituting nearly 60% of all logged events. This suggests that despite years of high-profile ransomware incidents leveraging SMB, legacy vulnerabilities and misconfigurations remain a primary focus for global scanning botnets [cite: 2, 3]. Furthermore, the data highlights a concerted, systematic assault on database infrastructure. Microsoft SQL Server (TCP/1433), MySQL (TCP/3306), and MongoDB (TCP/27017) faced continuous brute-force attacks and targeted exploits. These attacks are primarily economically motivated, driven by Initial Access Brokers (IABs), Ransomware-as-a-Service (RaaS) affiliates, and automated extortion scripts that wipe data and leave ransom notes [cite: 4, 5].

IoT devices also remain highly vulnerable, as evidenced by significant activity on HTTP-Alt (port 81) and MQTT (port 1883). Threat actors are deploying sophisticated Mirai variants—most notably the Nexcorium and tuxnokill botnets—to exploit end-of-life routers and surveillance cameras, rapidly integrating them into distributed denial-of-service (DDoS) swarms [cite: 6, 7]. Complicating the defensive landscape is the widespread abuse of legitimate cloud hosting providers and the emergence of "gray-area" commercial scanners that exhibit hostile behaviors, effectively providing obfuscation for malicious operations [cite: 1, 8]. 

This comprehensive report details the statistical distribution of the attacks, profiles the infrastructure and ASNs utilized by the adversaries, dissects the observed malware families and campaigns, and provides actionable mitigation strategies for enterprise defenders.

---

## 2. Statistical Overview

The following statistics reflect the entire un-sampled dataset of 5,846 indicators captured by the Dionaea honeypot in May 2026. 

### 2.1 Service and Port Distribution

The distribution of targeted ports provides direct insight into the priorities of automated scanning networks and threat actors.

| Port | Service Emulated | Event Count | Percentage of Total | Primary Threat Association |
| :--- | :--- | :--- | :--- | :--- |
| **445** | SMB (Server Message Block) | 3,403 | 58.21% | Ransomware propagation, Null Session Enumeration, EternalBlue variants |
| **1433** | MS-SQL Server | 467 | 7.99% | Vollgar Botnet, Mallox RaaS, Cobalt Strike deployments |
| **21** | FTP (File Transfer Protocol) | 405 | 6.93% | Credential brute-forcing, Web-server compromise |
| **3306** | MySQL Database | 386 | 6.60% | Ddostf botnet, Data theft, UDF DLL injection |
| **81** | HTTP-Alternate | 358 | 6.12% | IoT Botnets (Mirai, Nexcorium, tuxnokill), DVR/CCTV exploitation |
| **27017** | MongoDB | 289 | 4.94% | Automated Ransom-Wipe campaigns, MongoBleed (CVE-2025-14847) |
| **1723** | PPTP (Point-to-Point Tunneling) | 214 | 3.66% | VPN credential stuffing, Initial Access Brokerage |
| **135** | MS-RPC (EPMAP) | 161 | 2.75% | Windows RPC enumeration, Lateral movement reconnaissance |
| **1883** | MQTT (Message Queuing Telemetry) | 134 | 2.29% | IoT Data leakage, Botnet C2 hijacking |
| **Various** | Ephemeral / Non-Standard | 29 | 0.51% | Custom C2 channels, honeypot evasion testing |

**Analysis of Port Distribution:**
The staggering dominance of port 445 (3,403 events) aligns with global threat telemetry indicating that SMB remains the most heavily targeted protocol for wormable exploits and network reconnaissance [cite: 2, 3]. The combined total of database ports (1433, 3306, 27017) accounts for roughly 19.5% of the traffic, underscoring a highly lucrative economy surrounding database extortion and cryptomining [cite: 9, 10]. 

### 2.2 Infrastructure and ASN Abuse

The dataset reveals that attacks are originating from a mixture of hijacked cloud infrastructure, bulletproof hosting providers, and compromised residential networks. Based on the 800-indicator smart sample and enriched context, the following Autonomous System Numbers (ASNs) were the most prominent sources of hostile traffic.

| ASN | Organization | Country | Threat Classification | Associated Activity |
| :--- | :--- | :--- | :--- | :--- |
| **AS401626** | Netiface America, Inc. | US / GB | Gray-Area Scanner / Proxy | Heavy probing of MySQL (3306) and MongoDB (27017) [cite: 1]. |
| **AS135377** | UCLOUD INFO TECH HK | HK | Bulletproof Hosting / C2 | GoBruteforcer C2, extensive MQTT and FTP brute-forcing [cite: 1, 11]. |
| **AS14061** | DigitalOcean, LLC | US | Cloud Abuse | Widespread MongoDB ransom scanning and MQTT botnet hosting [cite: 1]. |
| **AS396982** | Google LLC | US | Cloud Abuse | Hijacked cloud tenants used for MSSQL and MySQL brute-forcing [cite: 1]. |
| **AS8075** | Microsoft Corporation | US | Cloud Abuse | Azure instances abused for database brute-forcing (1433, 27017) [cite: 1]. |
| **AS45899** | VNPT Corp | VN | Residential Botnet | Massive volumes of SMB (445) scanning indicative of IoT infection [cite: 1]. |
| **AS398324** | Censys, Inc. | US | Research Scanner | Benign mapping, but datasets are leveraged by threat actors [cite: 1]. |
| **AS213412** | ONYPHE SAS | FR | Research Scanner | Benign mapping of HTTP-Alt (81) and database ports [cite: 1]. |
| **AS211298** | Driftnet Ltd | GB | Commercial Scanner | Aggressive port scanning and honeypot triggering [cite: 12, 13]. |
| **AS7713** | PT Telekomunikasi | ID | Residential Botnet | Widespread SMB (445) scanning from compromised consumer devices [cite: 1]. |

---

## 3. Infrastructure Deep Dive

Understanding the origin of the attacks is critical for effective threat mitigation. Threat actors leverage diverse infrastructure topologies to obfuscate their operations, ensure persistence, and maximize their scanning bandwidth. The traffic observed by the Dionaea honeypot can be categorized into four primary infrastructure archetypes.

### 3.1 Cloud Abuse: The Hyperscaler Weaponization
A significant portion of the observed brute-force attacks against databases (Ports 1433, 3306, 27017) originated from major cloud service providers, predominantly **DigitalOcean (AS14061)**, **Google Cloud (AS396982)**, **Microsoft Azure (AS8075)**, and **Amazon Web Services (AS16509)**. 

Threat actors highly value cloud infrastructure for outbound scanning because of the high bandwidth, low latency, and inherent trust assigned to these IP ranges by many corporate firewalls. Attackers rarely use their own legitimate accounts; instead, they rely on "hijacked tenants." Cybercriminals purchase stolen cloud console credentials on the dark web, spin up virtual machines (VMs), and deploy automated scanning scripts before the provider detects the fraudulent activity [cite: 1]. 

In this dataset, DigitalOcean IPs were repeatedly flagged for interacting with MongoDB (27017) and MQTT (1883) services. This aligns with behavior exhibited by Initial Access Brokers (IABs) who utilize disposable, ephemeral cloud instances to quickly index vulnerable NoSQL databases for subsequent ransom-wipe campaigns [cite: 1, 4].

### 3.2 Gray-Area and Commercial Scanners
The modern threat landscape is complicated by organizations that operate in a "gray area" between legitimate security research and hostile reconnaissance. 

**Netiface America (AS401626)** is a prime example within the dataset. While sometimes categorized as a benign scanner proxy, threat intelligence platforms frequently flag Netiface IPs for executing brute-force web application attacks [cite: 1]. In the May 2026 honeypot data, Netiface IPs were responsible for highly aggressive, targeted probing of MongoDB and MySQL ports [cite: 1]. Threat feeds such as ELLIO note that this ASN is associated with real-time exploit detection evasion and brute-force credential attempts [cite: 14]. Because their traffic profiles match those of malicious actors, organizations are generally advised to treat AS401626 traffic with extreme prejudice and implement edge blocking [cite: 1, 8].

Similarly, **Driftnet Ltd (AS211298)**, based in the UK, claims to be an internet measurement organization [cite: 15]. However, its IP ranges (e.g., `87.236.176.x`) trigger thousands of AbuseIPDB reports for port scanning, SSH brute-forcing, and triggering honeypots across the globe [cite: 13, 16, 17]. While they may not deploy payloads, the reconnaissance data gathered by such entities can be inadvertently or intentionally sold to malicious actors.

### 3.3 Benign Research Scanners (The Outsourced Reconnaissance Problem)
The dataset contains substantial traffic from recognized, legitimate security research organizations such as **Censys (AS398324)** and **ONYPHE (AS213412)** [cite: 1]. These entities continuously map the IPv4 and IPv6 address spaces to index exposed services. 

While their traffic is benign, their existence fundamentally alters attacker economics. Threat actors no longer need to generate noisy, detectable port scans from their own infrastructure. Instead, they query the APIs of Shodan, Censys, or ONYPHE to instantly retrieve a curated list of targets—for example, all globally exposed MongoDB instances lacking authentication [cite: 4]. Therefore, while blocking Censys will not stop an attack, it limits the visibility of an organization's attack surface to adversaries leveraging open-source intelligence (OSINT).

### 3.4 Bulletproof Hosting and Residential Botnets
**UCLOUD INFORMATION TECHNOLOGY HK (AS135377)** appears frequently in the dataset, particularly targeting MQTT (1883) and FTP (21) [cite: 1]. This Hong Kong-based ASN is notoriously abused by cybercriminals as a safe haven for hosting Command and Control (C2) infrastructure and coordinating spam campaigns, functioning as a form of bulletproof hosting where abuse complaints are routinely ignored [cite: 11, 18]. Threat intelligence identifies AS135377 as a primary hosting ground for the GoBruteforcer botnet C2 nodes [cite: 1].

Conversely, the massive volume of SMB (445) traffic originates primarily from **residential ISPs**, most notably **VNPT Corp (AS45899)** in Vietnam and **PT Telekomunikasi (AS7713)** in Indonesia [cite: 1]. This traffic is the hallmark of deeply entrenched residential botnets. Consumer-grade routers, unpatched DVRs, and IoT smart home devices in Southeast Asia have been compromised en masse. These devices are programmed to blindly and continuously fire exploit packets (such as EternalBlue variants) at random WAN IP addresses, hoping to find vulnerable SMB services [cite: 1]. The use of residential IPs makes IP-based blocking difficult for defenders, as the source IPs are dynamic and mixed with legitimate consumer traffic.

---

## 4. Malware Analysis & Exploitation Mechanics

A defining characteristic of the May 2026 Dionaea capture is the absolute zero count for file hashes and URLs [cite: 1]. This is not a sensor failure; it is a critical threat intelligence finding. It demonstrates that the current wave of attacks relies entirely on payloadless exploits, in-memory execution, and the abuse of native system functions.

### 4.1 Living off the Land (LotL) and Memory-Only Attacks
Attackers are deliberately avoiding dropping portable executable (PE) files, ELF binaries, or identifiable shell scripts to disk, as these are easily caught by endpoint detection and response (EDR) solutions. Instead, upon discovering an open port (e.g., via dictionary brute-forcing), attackers immediately execute commands using the operating system's native tools (e.g., PowerShell, bash, WMI) to establish persistence or exfiltrate data [cite: 1].

### 4.2 MongoDB Extortion and MongoBleed (Port 27017)
MongoDB is a fast, schema-flexible NoSQL database that is notoriously easy to deploy but frequently misconfigured. Older versions defaulted to binding to all interfaces (`0.0.0.0`) without authentication, and administrators still frequently override secure defaults for convenience, exposing databases directly to the internet [cite: 9].

**The Ransom-Wipe Campaign:**
Exposed MongoDB instances on port 27017 are the target of automated extortion campaigns. Attackers utilize Shodan or custom scripts to find open instances. Because authentication is disabled, they connect directly, copy (exfiltrate) the data, drop all collections (wiping the database), and leave a ransom note demanding Bitcoin payment [cite: 4, 5]. There is rarely any mechanism for data recovery, meaning paying the ransom is futile.

**CVE-2025-14847 (MongoBleed):**
Advanced actors in 2026 are utilizing a newly discovered vulnerability dubbed MongoBleed. This is a critical (CVSS 8.7) unauthenticated memory disclosure vulnerability. The exploit leverages a flaw in how MongoDB Server handles `zlib` compressed network messages [cite: 1]. 
1. The attacker initiates a TCP connection to port 27017.
2. They send a BSON-encoded `OP_MSG` wrapped in an `OP_COMPRESSED` structure [cite: 1].
3. The attacker maliciously crafts the `uncompressedSize` field to claim the payload is massive (e.g., several megabytes), while the actual compressed byte string is minimal [cite: 1].
4. The MongoDB server allocates the requested massive memory buffer but fails to initialize it properly.
5. The server then returns the contents of the uninitialized heap memory to the attacker [cite: 1].
This heap memory frequently contains plaintext administrator passwords, active session tokens, and cryptographic keys, allowing the attacker to bypass authentication without needing to brute force credentials [cite: 1].

### 4.3 MS-SQL Server Subjugation (Port 1433)
Microsoft SQL Server (TCP/1433) is a highly valuable target due to the sheer processing power of database servers and the sensitive corporate data they hold. The honeypot recorded 467 targeted events against this port [cite: 1].

**The Vollgar Botnet:**
Active since at least 2018, the Vollgar botnet is designed to infect MS-SQL servers exposed to the internet with weak credentials (e.g., the default `sa` account) [cite: 10, 19]. 
1. **Brute Force:** The attack initiates with aggressive dictionary brute-forcing against the `sa` account [cite: 1].
2. **Configuration Alteration:** Once authenticated, Vollgar modifies the SQL server configuration. It specifically validates the availability of COM classes such as `WbemScripting.SWbemLocator`, `Microsoft.Jet.OLEDB.4.0`, and the Windows Script Host Object Model (`wshom`) [cite: 10, 19]. 
3. **Execution:** These classes are used to enable WMI scripting and execute OS commands directly through MS-SQL (often enabling the `xp_cmdshell` extended stored procedure) [cite: 1, 10].
4. **Payloads:** Vollgar ensures utilities like `cmd.exe` and `ftp.exe` have execute permissions, creates hidden OS and database users with elevated privileges, and utilizes Visual Basic and FTP scripts to download multi-functional Remote Access Trojans (RATs) and XMRig-based cryptominers designed to mine Monero and Vollar [cite: 10, 20]. Vollgar goes as far as killing competing malware processes on the host to maximize its own CPU utilization [cite: 20, 21].

**RaaS Affiliates (Mallox & TargetCompany) and Cobalt Strike:**
Beyond cryptomining, Initial Access Brokers and RaaS syndicates such as Mallox (also known as TargetCompany/FARGO) have industrialized the compromise of MS-SQL [cite: 1]. Upon successfully guessing the `sa` password, these actors frequently drop **Cobalt Strike** beacons. Cobalt Strike, a legitimate penetration testing framework, allows threat actors to establish fileless, stealthy persistence, perform lateral movement, log keystrokes, and eventually deploy enterprise-wide ransomware [cite: 22].

### 4.4 Mirai Variants on HTTP-Alt (Port 81)
Port 81, often used as an alternative HTTP port for embedded device management interfaces, administrative consoles, and IP cameras, saw 358 attack events [cite: 1, 23]. These interfaces frequently suffer from weak default credentials and unpatched web vulnerabilities. 

**Nexcorium Botnet:**
Nexcorium is a highly sophisticated, multi-architecture Mirai variant discovered recently. It targets IoT infrastructure to build massive DDoS swarms capable of TCP, UDP, SYN, and SMTP floods [cite: 6, 24]. 
*   **Exploitation:** Nexcorium primarily targets **CVE-2024-3721**, a medium-severity OS command injection vulnerability in end-of-life TBK DVR-4104 and DVR-4216 digital video recorders [cite: 6, 25, 26]. Threat actors manipulate the `mdb` or `mdc` HTTP arguments to execute a downloader script [cite: 27].
*   **Attribution:** The exploit traffic frequently contains a custom HTTP header: `X-Hacked-By: Nexus Team – Exploited By Erratic`, linking the campaign to the "Nexus Team" threat group [cite: 6, 24, 27].
*   **Persistence:** Nexcorium is highly aggressive in maintaining access. It modifies `/etc/inittab`, creates startup scripts in `/etc/rc.local`, and creates a `persist.service` file in `systemd` to ensure it runs upon reboot. It also utilizes `crontab` scheduling [cite: 6, 7]. Once running, the binary deletes itself from the disk to frustrate forensic analysis [cite: 7].
*   **Lateral Movement:** The malware contains a built-in exploit for **CVE-2017-17215** (targeting Huawei HG532 routers) and uses a hardcoded dictionary to launch Telnet brute-force attacks against adjacent network devices [cite: 6, 24, 27].

**tuxnokill Botnet:**
Operating in parallel to Nexcorium, the "tuxnokill" variant contains a bizarre hardcoded string: `AI.NEEDS.TO.DIE` [cite: 7]. It targets port 81 and related management ports by exploiting **CVE-2025-29635**, a command injection flaw in D-Link DIR-823X routers [cite: 7, 26, 28]. It also probes TP-Link Archer AX21 devices (CVE-2023-1389) and ZTE routers, deploying the malware via a malicious shell script (often named `dlink.sh`) [cite: 7, 28]. Like Nexcorium, tuxnokill conscripts these retired, unpatchable devices into a global DDoS botnet.

### 4.5 SMB Probing and Null Sessions (Port 445)
With 3,403 events, SMB traffic is the dominant force in the honeypot data. The primary threats utilizing port 445 include:
*   **EternalBlue (MS17-010):** Despite being nearly a decade old, variants of the EternalBlue exploit are still widely fired by residential botnets (such as those in AS45899) [cite: 1]. These botnets blindly scan the internet for unpatched Windows 7/Server 2008 systems.
*   **Null Session Enumeration (RID Brute Forcing):** Modern attackers utilize SMB null sessions to anonymously connect to Windows domains. They query the `lsarpc` pipe to enumerate password policies and extract lists of valid usernames by cycling through Relative Identifiers (RIDs). This eliminates the guesswork in subsequent brute-force attacks, providing the attacker with a verified list of active accounts without triggering lockout alarms [cite: 29].

### 4.6 MQTT Broker Hijacking (Port 1883)
The Message Queuing Telemetry Transport (MQTT) protocol on port 1883 is designed for low-bandwidth IoT communications using a publisher/subscriber model [cite: 30, 31]. It operates over unencrypted TCP by default. 
When deployed without authentication (anonymous access), anyone can connect to the broker, read the telemetry data, or publish malicious commands to subscribed devices [cite: 32, 33]. Furthermore, because the protocol is lightweight, IoT botnets (including Mirai variants) increasingly use compromised MQTT brokers as highly efficient, untraceable Command and Control (C2) servers to issue attack directives to infected edge devices [cite: 1, 34].

---

## 5. Campaign Analysis

Based on the synthesis of port activity, ASNs, and known vulnerabilities, three distinct threat campaigns are actively targeting the NadSec infrastructure.

### 5.1 The "Nexus Team" IoT Conscription Campaign
This campaign leverages the Nexcorium and tuxnokill Mirai variants to aggressively hunt for end-of-life (EoL) surveillance equipment and home routers [cite: 6, 28]. Operating primarily over HTTP-Alt (81) and standard HTTP ports, these actors rely heavily on publicly available proof-of-concept (PoC) exploits for known CVEs (CVE-2024-3721 for TBK DVRs, CVE-2025-29635 for D-Link) [cite: 6, 7]. The objective is not data theft, but resource acquisition. By exploiting the inherent lack of patching cycles in consumer IoT hardware, the Nexus Team is rapidly expanding a multi-architecture DDoS swarm capable of launching massive volumetric attacks [cite: 6, 27].

### 5.2 Automated Database Subjugation and RaaS Brokerage
This campaign represents a highly mature, economically driven cybercriminal ecosystem targeting MSSQL (1433), MySQL (3306), and MongoDB (27017) [cite: 1]. Attackers utilize cloud infrastructure (Azure, Google Cloud, DigitalOcean) to maintain high-speed scanning bandwidth [cite: 1]. 
For SQL databases, the attack chain is pure dictionary brute-forcing against the `sa` or `root` accounts, followed by the deployment of Cobalt Strike or the Vollgar cryptominer via OLE/WMI evasion techniques [cite: 10, 22]. For MongoDB, the campaign relies on automated scripts that instantly wipe unauthenticated databases and leave ransom notes, or utilize the newly discovered MongoBleed (CVE-2025-14847) memory disclosure vulnerability to steal credentials directly from the heap [cite: 1, 4]. These access points are frequently resold by Initial Access Brokers to established ransomware syndicates like Mallox/BlueSky [cite: 1].

### 5.3 Global SMB and Residential Botnet Probing
The continuous drone of SMB (445) traffic is generated by vast, entrenched networks of compromised residential devices, heavily concentrated in Southeast Asia (Vietnam, Indonesia) [cite: 1]. This is not a targeted campaign, but rather the background radiation of the internet: massive, uncoordinated botnets randomly scanning the IPv4 space for legacy Windows vulnerabilities (EternalBlue) and open file shares [cite: 1]. 

---

## 6. Detection & Mitigation

To defend against the payloadless, credential-focused, and memory-based attacks observed in this intelligence cycle, organizations must pivot from signature-based antivirus to robust network architecture, identity management, and behavioral analytics.

### 6.1 Network and Architecture Hardening
1.  **Zero-Trust Database Exposure:** Under no circumstances should MongoDB (27017), MS-SQL (1433), or MySQL (3306) be bound to public interfaces (`0.0.0.0`). Bind databases strictly to `127.0.0.1` or isolated internal VLANs. Use strong VPNs or zero-trust network access (ZTNA) gateways for administrative access [cite: 4, 9, 35].
2.  **IoT Segmentation:** Isolate all IoT devices (CCTV, DVRs, smart sensors) on a dedicated, non-routable VLAN without outbound internet access. Disable Universal Plug and Play (UPnP) on all edge routers to prevent devices from exposing themselves dynamically [cite: 1].
3.  **Disable Legacy Protocols:** Disable SMBv1 across the enterprise. Block inbound port 445 at the network perimeter entirely to prevent EternalBlue and Null Session attacks [cite: 29].
4.  **MQTT Encryption:** Enforce TLS encryption for MQTT (migrate from TCP/1883 to TCP/8883) and mandate strict username/password authentication for all broker connections [cite: 31, 32, 33].

### 6.2 Telemetry and SIEM Queries
*   **Null Session Detection:** Monitor Windows Event Logs for Event ID `4624` (Logon) where `Logon Type` is `3` (Network) and the `Account Name` is `ANONYMOUS LOGON`. A spike in these events indicates RID brute-forcing [cite: 29].
*   **Database Account Abuse:** Create SIEM alerts for repeated failed logins to the MS-SQL `sa` account or the MySQL `root` account originating from external IPs. Monitor for the execution of `xp_cmdshell` or `sp_OACreate` stored procedures, which indicate post-compromise OS command execution (e.g., Vollgar behavior) [cite: 1, 10].
*   **LotL Monitoring:** Alert on database server processes (e.g., `sqlservr.exe`, `mongod`) spawning unusual child processes such as `cmd.exe`, `powershell.exe`, or `ftp.exe` [cite: 10].

### 6.3 IDS / IPS Signatures (Pseudo-Rules)

**MongoBleed (CVE-2025-14847) Detection:**
```text
alert tcp $EXTERNAL_NET any -> $HOME_NET 27017 (msg:"ET EXPLOIT MongoDB CVE-2025-14847 OP_COMPRESSED Memory Disclosure Attempt"; flow:established,to_server; content:"|dd 00 00 00|"; offset:12; depth:4; content:"|01|"; distance:0; within:1; byte_test:4,>,1000000,0,relative,little; classtype:attempted-admin; sid:1000001; rev:1;)
```
*(Explanation: Looks for the `OP_COMPRESSED` opcode `212` (`dd 00 00 00` in little-endian) and evaluates if the `uncompressedSize` field asks for an abnormally large memory allocation.)*

**Nexcorium DVR Exploit (CVE-2024-3721):**
```text
alert http $EXTERNAL_NET any -> $HOME_NET 81 (msg:"ET EXPLOIT Nexcorium TBK DVR Command Injection (CVE-2024-3721)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/device.rsp?"; http.header; content:"X-Hacked-By: Nexus Team"; classtype:attempted-admin; sid:1000002; rev:1;)
```
*(Explanation: Targets the specific HTTP header and URI endpoint abused by the Nexus Team to drop the Nexcorium Mirai variant [cite: 6, 27].)*

---

## 7. MITRE ATT&CK Mapping

The observed behaviors map directly to the following MITRE ATT&CK techniques:

| Tactic | Technique ID | Technique Name | Context from May 2026 Telemetry |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | T1595.001 | Active Scanning: Scanning IP Blocks | Widespread scanning by UCloud, Netiface, and compromised cloud tenants looking for open 445, 1433, 27017, and 81. |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Nexcorium exploiting CVE-2024-3721 (TBK DVRs) and tuxnokill exploiting CVE-2025-29635 (D-Link routers). |
| **Initial Access** | T1133 | External Remote Services | Abuse of exposed PPTP VPNs (Port 1723). |
| **Credential Access** | T1110.001 | Brute Force: Password Guessing | Relentless dictionary attacks against MS-SQL `sa` and default IoT admin accounts. |
| **Credential Access** | T1110.004 | Brute Force: Credential Stuffing | AI-hallucinated and hardcoded credential reuse against MySQL and MongoDB. |
| **Discovery** | T1087.002 | Account Discovery: Domain Account | SMB Null Session enumeration via RID brute-forcing on port 445 to map valid domain users. |
| **Execution** | T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Vollgar botnet and Mallox RaaS enabling `xp_cmdshell` in MS-SQL to run `cmd.exe`. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Mirai variants executing downloaded `dlink.sh` or `wificam.sh` scripts via command injection. |
| **Persistence** | T1543.002 | Create or Modify System Process: Systemd Service | Nexcorium botnet creating `/etc/systemd/system/persist.service` to survive reboots. |
| **Persistence** | T1053.003 | Scheduled Task/Job: Cron | Nexcorium updating `crontab` to ensure malware execution. |
| **Impact** | T1485 | Data Destruction | Automated scripts wiping MongoDB collections on port 27017 for extortion. |
| **Impact** | T1498.001 | Network Denial of Service: Direct Network Flood | Nexcorium and tuxnokill IoT swarms launching volumetric UDP/TCP/SYN DDoS attacks. |
| **Impact** | T1496 | Resource Hijacking | Vollgar botnet deploying XMRig to mine Monero and Vollar on compromised database servers. |

---

## 8. IOC Appendix

*(Note: The full dataset contains 5,846 indicators. This appendix highlights the top operational nodes based on the 800-indicator sample and threat intelligence correlation.)*

**Top Malicious / Gray-Area Scanning Infrastructure (IP Addresses):**
*   `64.89.163.131`, `64.89.163.140`, `64.89.163.159` (AS401626 / Netiface America, Inc., US/GB) - Hostile probing of MongoDB (27017) and MySQL (3306).
*   `87.236.176.20` (AS211298 / Driftnet Ltd, GB) - Aggressive commercial scanning; highly reported on AbuseIPDB.
*   `152.32.240.95`, `152.32.134.182`, `165.154.182.154` (AS135377 / UCLOUD INFO TECH, HK) - Bulletproof hosting used for MQTT/MySQL brute forcing.
*   `45.142.154.102` (AS9465 / AGOTOZ PTE. LTD., HK) - Repeated high-frequency hits on MongoDB (27017).
*   `175.24.179.247` (AS45090 / Shenzhen Tencent, CN) - Massive volume (61 events) targeting MySQL (3306).
*   `111.170.173.208` (AS151185 / China Telecom, CN) - Massive volume (110 events) targeting MySQL (3306).
*   `20.46.55.248` (AS8075 / Microsoft Corp, AE) - Extreme volume (2270 events) targeting MS-SQL (1433), indicative of a hijacked cloud tenant actively deploying Vollgar/Cobalt Strike.

**Hashes & URLs:**
*   `None Captured`: Dataset indicates 100% reliance on memory-only exploits (MongoBleed) and Living off the Land (LotL) native OS command execution during this period.

---

## 9. Sources & Citations

*   [cite: 1, 8] "Netiface America" AS401626 threat profiling and gray-area scanner intelligence.
*   [cite: 14] ELLIO Platform IP Lookup for 64.89.163.130 (Netiface tags, real-time exploit detection, brute-force logs).
*   [cite: 36] MalwareURL Listing Report for Netiface AS401626 vulnerability scanning.
*   [cite: 11, 18] CleanTalk and IPinfo reports on AS135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED) abuse and malicious hosting.
*   [cite: 12, 16] IPinfo and AbuseIPDB reports on AS211298 (Driftnet Ltd) scanning behavior.
*   [cite: 30, 34] IoT botnet infrastructure abusing MQTT protocol (TCP/1883) for Command and Control (C2).
*   [cite: 31, 32] Security threats in MQTT unencrypted data exchanges and VARIoT honeypot network tracking anonymous access.
*   [cite: 33] Shadowserver Foundation "Open MQTT Report" detailing vulnerable anonymous data leakage on port 1883/TCP.
*   [cite: 4, 9] Analysis of exposed MongoDB servers (Port 27017) targeted by automated data extortion and wiping attacks.
*   [cite: 5, 35] Flare.io and National Cyber Security Authority reports on MongoDB ransomware exploitation campaigns and misconfigurations.
*   [cite: 23, 37] Threat reports detailing IoT botnets spreading via HTTP-Alt (Port 81) Remote Code Execution vulnerabilities.
*   [cite: 38, 39] Fortinet research on the "Wicked" Mirai variant using known exploits targeting port 81 (CCTV/DVR).
*   [cite: 6, 25] Broadcom and HivePro threat advisories on the "Nexcorium" Mirai botnet variant exploiting TBK DVR devices (CVE-2024-3721) via the Nexus Team.
*   [cite: 7, 28] HKCERT and Help Net Security alerts regarding the "tuxnokill" Mirai botnet targeting D-Link routers (CVE-2025-29635).
*   [cite: 26, 27] Fortinet and The Hacker News tracking the Nexcorium IoT botnet campaign and its multi-architecture persistence methods.
*   [cite: 2, 3] Honeypot data analysis showing SMB (Port 445) as the most heavily targeted port for brute-force attacks.
*   [cite: 29] Palo Alto Networks documentation on SMB Null Sessions and RID brute-forcing via port 445.
*   [cite: 10, 19] The Hacker News and Cyber Defense Magazine reports on the "Vollgar" crypto-mining botnet targeting MS-SQL servers (Port 1433).
*   [cite: 20, 22] Reports on MS-SQL servers exploited to install Cobalt Strike beacons and the Vollgar MS SQL botnet attack chain.
*   [cite: 13, 17] AbuseIPDB tracking of malicious scanning from Driftnet Ltd (AS211298).
*   [cite: 24] IBM X-Force OSINT Advisory on the Nexcorium Mirai-Based DDoS Botnet.
*   [cite: 21] NHS Digital cyber alert detailing the Vollgar botnet module installation and XMRig cryptominers.
*   [cite: 1] NadSec Online Dionaea Honeypot threat intelligence report (2026-05) outlining RaaS syndicates (Mallox), MongoBleed (CVE-2025-14847), and zero-payload LotL execution.

**Sources:**
1. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEz2QmRUHmejX2h7egsbXI-VBanvyjbc0Hg_bg2EcugzmM2mJ8EPNSCftU2Vm4gIJWT3JDAAqNQltnkjgxhD1Ts6b6kl0FZsbytJhT_RFnVIzb6LPUxpA==)
2. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF5WJ7YoCSBaaUEYaUT4GORKaYCXeCvSq0B3_wu4dv30Ae6VBRpKuV2YSFWxyw3nQ0NjSF4wTzFb8G_L1NGWUALlI4TgdfwZp7Mxu7r4jqzKuy6J6zJaTu7vvhIS8l5Jm0ullpR8tJDUcLbrNZXM3gOgwMcI08gSIGYYRSIg4Vl5yOYOI5RKo7AYm7WQtKv8VJXIO84aAA4K1zwfdRvsV7jLGI=)
3. [outpost24.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHg_NB0KBVJJf9k49XELUBVdif-tjQv-kQQBQ_0B_joxDGj6OsBfZiPP0SyC-QJ_DbrfKrOVklQkdHYXTNN1UJfKXjC1vXreBEE5Wu76yzH_KfGPBdl9xpOOP2ls76UjMClBvF9YuUCbPo7FSFpN9MjqFjqWzQjVcYAcSi-hU07)
4. [rescana.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHpGOywhA51nKVwXbbMY39uSLCniR9hykitn6e1q_XFXfXwxmJ8W_l2iZypP12FE49IehAwdHUzRxclCZg4v_wzxFJtNNTMilcVyaOtf2rCKLAeCdniGW6hOsYyRdHvKnKEbxeQajUfSsgcSPCsC4HT59MqFQmV-YIKRZpLsV50BbSe7z1OkAKv8nlhlnRUQNqGWSrJNDE9uOFLbaIkM2fEznLs--_DMnOGg9x_Lt8K5qiNSaTCyQ==)
5. [flare.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG7pW9IqvQfuimmzccFCG2VX1SjkLmW5mBj0UopYPyV8wfzMSRmNx52hB6OOISuosBngai9DPinPaoikaOfckMD1O65Lv6CD9XsieDHZhmUCkxiu4rkFJvhQHKceo4rgAt9jfWOQawl_Gc=)
6. [hivepro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG77a7-NSnCEowJS-FfxDhWxnGPDvFM8K4pi3SlF45JF80zB8uj_cJWT-1nhskAPkgBaTeYpr7B7bkOWGInzAQ6nlU316jYQctofiskIRZjSzYX8dhnXBBkcbjcrksGHsarnz4C-qFp-qzYR9EWUSnDPmSa-g4SxeZ3qQatTvfI4sayQDnHWun-LCrusks-ChRnVg==)
7. [helpnetsecurity.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQECw78V7Ddr5bUL_zUV5TTLPzvom9u7c33jN7JupqZmmAHOnGU8a4FPokSe5MbZLtKWVukmjln8jxHuWKtf7socDt1Xt6TLZz7gCEFFaoqyz76nd1u4E6Xm9KjTSUKCAz908KdyVBWRKuYmV8EsdFnHX5kb82K2snk1lRqdwNz48pVLUTTzgI52oSasDmpPGGvw4Xpixbm7OfQ=)
8. [performancezen.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEmRYvvrWTHUjuwmPz7KwImPhMEA5A2_lAPxLdTNn9ConZgqdFARLAxBIygvL0ufD7cf64IfV_XWS1a_QTNboZQUXrszL4JmBE-_AiFWLSxrw==)
9. [legba.app](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFzv4XgS-hO-CooRqAjVdOH6YzhmGN-qaNebD5wkRa7am2F3fp8xODM4fHVjJve9D1s9VXitg-Rw3SzmN6k3Lypw_pgDwvEsR6mZ8Yps9j4exGYrxjJ-ZaUC2bumyjtYFjLr5XiOIE4DDnP)
10. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGYzJ6sXrUsCTKMnZP_QmOuLTDXbPJyXFMOXqFPLA6YvsOhsPh7VNshr0FwE0ZrL7rS8A6FvOEUUTxS2vaXJ6pPnQp8Y-dsrl9TfaeX1CIssWhG2LKvl8S6KrhQkVN5WshgPnMKlg==)
11. [cleantalk.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRwuKDhyyvj8D2sdVfh-yiKD03LxaNkXSV6uHqVtdcjfMtV-TMbaep-RVIJYbUjKVh16pqNR_e_WXrDYEhR3mtHJXNfhn5MLem7UW3kwULfX6mSVlWzLlEMk5Lums3)
12. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHAtW5Vonj72bQfW94t7K3LwtogyENJU8uOujO4quSSK9-1I5lLUfPtNMkoPVYiLSF2AkLb6nFZxpg0fOBKg5r7PFdrvna2jiB1QaQgABGB)
13. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMo3muAM8jwSTCUmZRvXka4Sr9MXqK0TxN3_xr2M98GLghmQF2WIOtg4VIu3DpO9uTRvOUEHCE-tf3DEoNvoD1Vt0T0JVRHDCZjlT_mnRwG697mzKnB6QdzMtvZaGUd6TGeQ==)
14. [ellio.tech](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHXKKzra5AKJyI5wcImUNXRbUXLsi7Lk3aYt4_l4uKJ4jojug99_2H0XECVnzpdPV6rBpYfh6Soxzfdll47ubzDXM3Hd87p8L7T5xGBRbS86iYQG24S6a20CbTpKhL5fPB1Wtr6kBTPhA==)
15. [virustotal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFRPmpV9nufBAv8TFeA3ONMhaOKYh1Cj1DkzJz6doNRRU0taiaws8dxge7Wvdp4605h3wUmAIB0yRQ_ydbNE2Ejl1cw5sVNdt1joYV_9h-znTG14DgptzkDEwbZ2QtkKvnuE8gAY56A4hLd4RY2BbPFjs_nLh4E)
16. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEwuu7NBZU4J_kQAKh8h-ZFn0iLA0trclgG4eoevTW0yH-Bjr2QYp0FHE2-Ayirn1qj8vB9xNr4z3GuJZ0UWdADH5RSvQ4w_TTlhHfNuHxBWS_9WmXq5DDgCrwQN54kFIohSHA=)
17. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHyrwMgDAv00reaMqY25YHzzb8-shuf3Ge2WKr1nSQukjER0puatsirSlW-BQZme6Jc9nNRv6oFjE_jZqgGMwpULJsmow5-yqfcQZfELqBzwdL5dTAcorBJMl2gM_yc3kWTGas=)
18. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHf0Ptul010PdlMmSBjHdrsl9_-vEMMDh51MexFG0Kh-FKHmf6n1jIbK4SIVMebVZQ8GDdWw0oxGem1NlT1d9mw-c5sPdxlpfpJSXAFlgzY)
19. [cyberdefensemagazine.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHkqCSMupmvn_heVf94v1dDfRrILwoII36SY2oik9oa-OceUQd8Aks7UNHWIvdgBpEF5ExJMgcuk0o1snaISHrmo25O0R3sBLB48igZK5EbPPWKcOaXiqOi1NZ_Xd2q8ARxfc0hGAEZ4BDZh1ffKf8O-QR8h41dNOX77O3Bc_gh1AjAq5iFb6p9fj-TWt6V3QPrchF8Oldn6Q3rC7KvJt-d)
20. [helpnetsecurity.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE7c0QYeUGvIkl3_dJ7EjfGY-X4EBuGO2TzYvrL6muve0xx24f2IPLp_o6eD7eEthZuQrqnQIti9cSkDYqmHeaWv-rnloYRw2eNylCjVL_OLmN19QlzW2vc76L7Su1CAwGZNNSHmzqmUS9sevmMgpecCHN1vat3)
21. [digital.nhs.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQERPkr6hSFEaWpPPggdcwqnX1mM6rWekbbZI8kKp7AZymbnFhshNH8UgZtWROue6yUgWuH0V0UqysWH1s0U1ZGSs-pIxFHgtwHptvrfeJEzZG8c7r2fd-m2YIp0A57pLVmitytdAQ==)
22. [techradar.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE7kXoCNLtetIBcMT83EkNZnKxdgtILLDdTn85yMk7IDGaju_R0ws__rVyuDTlY91nwHggCYLdB-kUsdsflkf7Iv4h49kiOPR6Oog_2o5e8sfcbeqX79uvCCVcW48BHc509BNNm9sxRB1WaFFOoum65orsXcETGWZsRAcHeIYjPzyjaJOAnIQ==)
23. [pentestpad.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHtqtzoFeAu2kFueFuDyvuSQkvICblMge65xKteGG9R_f-Ks29MBoL-U_axneO3kgpeD5eXrzC9N-YiROEOfZBijP6RESbF2IxnhpbJ0BX789scdSNf31lisAWpalQzDpU0y3vsMR8Z0DntJJvYkAR4yKQhQPtA3bfwik9kKrXglDA3RyDnseCzTtnrAxP3yNmjt3Q=)
24. [ibmcloud.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFWHk0ipnhxE3RtkpxOGdrHkhgh9beKdjx2rHA0oANvA3UTMRONGLO9rMGUvIAZG-zOdakLIoS6t_MFm-LOXPAFKcN5QLVchlCu3S5ex_u4afat28KM83IQnXWeF3feX6XY71XYtv-DGsrYe5YTFT8R6s42BHzd9Nvuw-u-nNcO9t4x_Wgh)
25. [broadcom.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG-l84TEJGi34GMLCX8caw4Pm0Nomg1qswqjOE61hsoO0r5U6wVOw3ObguDMT6u2WaaobpOHwYBN0HYXElZq5zr1AAP0utgfC9bbWSix6kZdTaRuQe4RW_ybNApMMs9X3H3PbP2_hqCLkDm4y8fKdv3CgDRStipNpRzMqxJ5jXD6EejAYUXvUT5cix0EcrAIuUc1Sbvn7vsra2s3rt5qA==)
26. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG1ft4Vx_vp90ERiUYd4T7seTgjgKCG8vJSgHwCH7kS-WwhYCLvEBEMdhfBTaDgDN-ilM70-MKZgAwNSYXt6FhOWlZ4EVhkDa-FuumAIWJJwayOIQzZapOuC-D5oE83_DTAZ2DndYEf6l-ZV_jzfYr0akuRe0gDkbzlM6qYMsbVGA==)
27. [fortinet.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH6flOteArgHwFvYRTbSJ4eoRp42JftIK6FRHiy855KvTeVda0466-r3mKiabpJfsh5-_bDFGustHbDFSYuDRugsIAHh_p7TG0cppmoJUMs-QjJ7ebvmWOxbeAqyblMPhBxhp2VKT6bwk-hZRptBCj2-91u4d_ky6Oqh2Glq2X1H_B-BOI-bqWJFqSRif6jHcYqoEzUQCRqfEyMcTq0ivT3vhiU6eOMQG_C44VbPCI=)
28. [hkcert.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG7CbjEJUCSZekAfNThW_7QVHHLRPD363_D2K2LeTmI5ZZgiWczKcvnFZSNLoy159kAYto9gSLTOJTrJT45nf8JiRslYKnFC1ErvDeFDDV2zM1WcpsgxXcjaqzjNxZSEE-mmZyYP1EXQd-pO5GKb2hqNP-QwHdE-to_-Of8-P855fjd9haoh2nny3yktyExoUGO6T8ZXoGaDlnGLQr-Nl0gVLnO)
29. [paloaltonetworks.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEPH4XqH_vj5-C5vARfr6u72UxRTHOUhaxrgflzZ3dkEPSAWUFDaGFq_HOoS5QXki0oSeJ3_wLHJ8yQ4zI64Zf39XXoc8AzhgMHoyOQMjX4ylCZi5gEuG8ABT1yVjn5ndZOUqlQkEBlNylgMfaRkG3TlQaWl6Iv00vBqck=)
30. [ieee.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGTw5IFA2Wt8nQgD8uSyha4dVOuCJVtI6NBbWbkg7GofAOOD1scQI73vItUi7Cworf1Mq7URXr724w9UYIk7yc-V7oC98Az2ZgslFNJP139ILg5WXccY6v3MeMIJ_gJTG1TXz6abOEpoVtN7akmzJnbWrhDiQ==)
31. [ceur-ws.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFxDyaKnaMOJMsDGXGcZLelwnkGOx_lhQCm2uE_nTS9HZNOoi9JEEU4ueIKjw2l93NeIKaBEUZAN5JSVtpyAy7E4CsyauCWwu0HY3RRHMp2qoRNiLIcb-ylidacnTE=)
32. [variot.eu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG8PtKQ92h3q4TGB4wS71fP3e2rkw3NPpf9qiVD5sQG_sQfGUT1fQuQQcPikZFbyIBEalZVuob0XmEqzU9rNqYQZx2eC8VkG_q3T1HYl9eYrmKsqFXj4umi9mCL_65OMA==)
33. [shadowserver.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGvh3CLzT5zT8k9otPX3cPlRi00mLMjesXQKi1iO0MJEXDHXxHoeR7wGdof-9NJbtdqa_xgMIii-owlu3dXOMBSBmbba-LT3iLxUKn28vWHYzqfL6c-TRT8pwLZGKs5qWdyOTou52o2Z3__RwPhTACgfezXBxSIn9iwz1SgEP7AiA==)
34. [securityscientist.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGR09Us0tu_no1QUhmHSjDnJ8yPhjJ-bpgQyt12dcsS6Q8-sZrw8pfrOXJgkeNritW7PqUYXxrxyC6NrzGHAVyNaDBY-X5iev_s-621oKbExNZUjwmqkMw2nlLOYfxo21ha043wv8-_6J73i7r1zqcpkS60wVKJCeZm3KhK6HKPaKf49txDkAi2fajd-oD2yvGFmfFGU_WPELtQFFM9zPnaUoRQ)
35. [cyber.gov.rw](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHpBAjHA-MlC330PABR_Ziz0Djvp1hcxNHfuwjX3B_bUMTwO5MmfPA4TkpA0rX4QeuHj9Neh1LcWIaH1gtCMF6NuwsA3C5Vjp8gf2mgryCNJNNl_svUJsj0mz9IgP658xMpA9nW5wCjUPIZscGfZXDTYAbIymEIYsSg0WukIjEsXbhmu_lv4yeiVZYTtrlqumxiuO5_K7IhmNMh0qB6Tz52)
36. [malwareurl.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH_4XIpaHvX-SCDznAwzPt-I2wdK09jz9F7Th5bmdK1H5AiVgJw7FUAdQnio68K_bqr4Lt40hiwo7kkPweyJUi9fScWuHD9rkzbSQr-eYT_I7NI09wVWye4EoiVRYXsgOKFnU9khkYGKwqVHSsd09o=)
37. [360.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGH_wAfxpmBfiLyUxh42yETGFBRBE5CFlfgaTlXawl5jpZDhMDFnzRqvhXzqoQ-6lcAHhUcsrZrTI7Ci5cMZqLVm379GREf8ml2sOEHl-AEZC_jBH5Btafc5gHmlCiXCrbv9Bwmv8m8x6AVImWb8Y5VioqGFSUwaaLq3piU28A-xxjHG67rXmxnx6VlIA==)
38. [infosecurity-magazine.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGu3GrFMUzBhTsnxnJU0EBnSkUpU5rk19bXL48g8NJ80p5ckZhF7NCSfAvyaIr3ExSUjpvbjB6tADsY1cxQQDjCySaWuyDjESnkP4dw2STNPwKB-eSZNbuilBbaMAlGAgHkcx8qtzYgNmYQkxGgtPainP6Ot_hq2hsBZPnS7g==)
39. [fortinet.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF2ZlWBgAJw_k_7AO_moBch7HRyxQHqpdPqY0oYJlnUtlc02i4pXBR1QX9lQkEs-553vCPgly6OVsaafECLPOmqvmMeqoRVIy6FoeUDRAfjojRQbD1eb1xdoIEnc7dJ3LiuXSn-xwcAEsTogB1dU48yGljcmfYRSgNuTg==)