Cryptojacking Threat Intelligence
Cryptojacking is the unauthorized use of computing resources to mine cryptocurrency, typically deployed through compromised web servers, cloud instances, or container environments. defend.network monitors cryptojacking campaigns that affect enterprise infrastructure and cloud environments.
Threat Briefings
Barracuda chained RCE, cPGuard backdoor supply chain, LLMjacking cloud fraud surge
Barracuda disclosed two critical chained vulnerabilities enabling root access; cPGuard's update infrastructure compromised to deploy backdoors; LLMjacking attacks costing enterprises up to $1M in fraudulent cloud charges.
Linux kernel, PHP, Cisco, GitLab critical flaws under active exploitation
Linux kernel TCP flaw (CVSS 9.8) exploitable via AI-generated payloads; PHP RCE impacting 70% of websites under active attack; Cisco firewalls, GitLab servers targeted via CISA KEV additions with Nov 1 federal deadline.
WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits
Rank Math PRO WordPress plugin compromised in supply-chain attack; Plex Media Server exploit chain actively weaponized for cryptominers and backdoors; Microsoft patches 1,400+ vulnerabilities.
Critical unpatched flaws in AhsayCBS, BIND, Apache Struts actively exploited
AhsayCBS backup platform flaws (CVE-2026-105133, CVE-2026-105134) exploited for webshell deployment and crypto mining; CISA adds five actively-exploited legacy vulnerabilities to KEV catalog. Anthropic restricts Claude internet access after injection attack discovery.
SonicWall CVSS 10.0 flaw; Google domains hijacked via ccTLD compromise; PoeLLM malware targets AI servers
SonicWall SMA1000 pre-auth SSRF (CVSS 10.0) requires immediate patching, country-code TLD registries compromised to obtain unauthorized Google domain certificates, PoeLLM cryptomining malware infects 3, 400+ exposed AI servers
MikroTik routers, Magento zero-day, and Chromium V8 actively exploited
MikroTik routers hijacked without authentication; Magento/Adobe Commerce zero-day in active exploitation; REVSTEALER disables Defender to mine crypto; Chromium V8 in CISA KEV.