SecuriTricks - gobrat

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023…

gobrat

edge devices

Published: May 23, 2025

Linked vulnerabilities : CVE-2023-20118, CVE-2021-32030

Downloadable IOCs: 15

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

Mandiant discovered China-nexus espionage group UNC3886 deploying custom backdoors on Juniper Networks' Junos OS routers in mid-2024. The actor used TINYSHELL-based backdoors with various capabilities, including active and passive functions and log disabling. UNC3886 demonstrated advanced system kn…

network infrastructure

Published: April 11, 2025

Linked vulnerabilities : CVE-2025-21590 (CVSS 4.4), CVE-2022-41328, CVE-2025-22457 (CVSS 9.0)

Downloadable IOCs: 14

2024 Malicious Infrastructure Insights: Key Trends and Threats

The report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's domi…

malicious infrastructure

remote access trojans

2025-02-28

traffic distribution systems

mozi botnet

state-sponsored groups

command-and-control servers

solarmarker rat

offensive security tools

Published: February 28, 2025

Downloadable IOCs: 0

Bulbature, beneath the waves of GobRAT

This report examines an infrastructure used to control compromised edge devices transformed into Operational Relay Boxes for launching cyber attacks. The infrastructure, consisting of 63 identified servers, uses GobRAT and Bulbature malware to compromise devices and create a botnet. Features includ…

Published: October 4, 2024

Linked vulnerabilities : CVE-2019-13956, CVE-2019-9082, CVE-2017-5638

Downloadable IOCs: 120

Tag: gobrat

Attack reports

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

2024 Malicious Infrastructure Insights: Key Trends and Threats

Bulbature, beneath the waves of GobRAT