Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog – Page 3

Get the latest international news and world events from around the world.

Log in for authorized contributors

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone.

Within days, Nokia Deepfield and Comcast’s threat lab documented the operator falling back to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for command-and-control (C2). XLab’s Dysphoria timeline opens with a JackSkid sample captured on March 25, six days after the disruption, that resolves C2 through the same domain.

XLab found that the burrberry[.]eth record encodes distribution-node IPv4 addresses, while 24carnforth2merseyside[.]sol supplies other infrastructure records. The DDoS sample asks a distribution node over HTTP for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers. The design keeps those controllers one step removed from the addresses exposed to bots.

Steam forum ClickFix attacks infect gamers with XMRig cryptominers

Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.

BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people’s posts about games crashing, lost inventory items, and other technical issues.

The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.

The vulnerability, tracked as CVE-2026–16812, is an unauthenticated OS command injection flaw with severity scores of 10.0, the maximum score that can be given to flaws.

VeloCloud Orchestrator, also known as VCO, is a centralized management platform used to configure, monitor, and manage VeloCloud SD-WAN deployments and associated edge devices.

New Dysphoria DDoS botnet spreads to 200k devices worldwide

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations.

According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the ‘jackskid’ and ‘fbot’ malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism.

Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.

New Certighost PoC exploit lets attackers hijack Windows domains

A proof-of-concept exploit for “Certighost,” a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.

Tracked as CVE-2026–54121, the vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates.

“An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT,” Microsoft explained.

Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin

Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet application from the App Store.

The complaint, filed on July 24 in California, alleges that Apple failed to adequately review and monitor applications distributed through the App Store while promoting the marketplace as a safe and trusted source for software.

Plaintiffs James Ramirez, Christopher Ellis, and Jalen Delgado say the malicious application impersonated the legitimate Sparrow Bitcoin wallet and instructed them to enter their seed phrases.

Risks of solar storms may be underestimated, warn researchers

The effects of extreme space weather may be larger than previously thought, research in the journal Nature reveals. The paper, titled “Regression to the mean can explain saturation of geomagnetic storms,” is led by Dr. Nithin Sivadas of NASA’s Goddard Space Flight Center and co-authored by Dr. Maria Walach from Lancaster University.

Space weather—caused by fluctuating electric fields in Earth’s magnetic field and upper atmosphere—can affect technologies on and around Earth in several ways. Extreme geomagnetic storms are among the less frequent but more severe forms of space weather.

Extreme geomagnetic storms are temporary disturbances in the plasma and magnetic field around Earth that can disrupt global satellite communications, cause extensive power outages and affect how much radiation astronauts and pilots are exposed to.

AI finds tiny gene editor changes that reduce unintended DNA edits

Gene editing is a highly precise and powerful technology that allows scientists to insert, delete, modify or replace DNA bases in living organisms. It has a variety of uses, including correcting disease-causing mutations and improving crops. Tools like CRISPR act as molecular scissors that target specific places in a genome to make these changes. But the technology is not perfect and can accidentally edit the wrong pieces of DNA or RNA.

In research published in Nature, scientists describe a new framework that uses AI to make these tools more accurate. Hoi Yee Chu and Alan S.L. Wong of the University of Hong Kong published a News and Views piece in the same journal on the significance of this research.

/* */