Blog

Volt Typhoon ran its zero-day campaigns through a constantly rebuilt chain of hacked routers, ending on home devices inside the US so the traffic would slip past reputation systems that flag foreign sources. Here is how the chain works, why IP reputation can't keep up with it, and what to watch on the management interfaces it was after.

PHP2Shell is a pair of bugs in the language behind roughly 70% of websites, and someone was trying to exploit it four days before anyone was supposed to know it existed. Here is where those attempts came from, why a reputation check rightly says 'investigate' rather than 'block', and what the first week of patching looked like.

The FBI raided more than 40 homes in Texas running laptop farms for North Korean IT workers. Every signal a company checks said 'American employee working from home', because the laptop really was in an American home. Here is what that looks like from the reputation column, and the remote access tools we started labelling properly this week.

Reput.io lookups now flag indicators that threat intelligence lists as hostile, on every plan including Free. Here's what changes in the response, the one rule we refused to bend for shared infrastructure, and the 7,000 labels we fixed while getting it ready.

Budget Android phones are shipping with malware baked into the firmware that quietly rents out the owner's home connection as a residential proxy. Here is why that traffic is close to invisible to reputation checks, the odd way the botnet makes its own servers look popular, and what to watch on your own network.

A China-nexus backdoor called Antino runs its entire command channel through Outlook and OneDrive, and every other stage of the attack sits on Cloudflare or AWS. No step of it touches an address you would think to block. Here is what a reputation check sees at each hop, and where it has to hand over to you.

A pair of Citrix NetScaler zero-days let attackers take root on the one box that faces the whole internet, then live inside it for weeks. Once they own your gateway, their traffic wears your address. Here is what a reputation check can and can't see when the trusted appliance is the threat.

This week's malware didn't wait for a click. One npm operation faked hundreds of millions of downloads to look trustworthy; another crew hid stealers inside genuine Claude and ChatGPT share links. The trust was real. The code riding on it wasn't.

This week's smartest bait isn't a link, it's a checkbox. "Prove you're human," it says, then it asks you to paste one line into a terminal. Two crews wrapped that trick in a name you already trust, from a government portal to HBO Max.

Reputation checks run on a simple bet: a name you recognize is a name you can trust. This week three separate crews cashed that bet in without breaking anything, routing a phishing chain straight through Google's own services and turning AI-provider infrastructure into a covert channel. Plus a MikroTik SSH zero-day, a Citrix NetScaler auth bypass under active attack, and thousands of Redis servers quietly mining.

A reputation check answers one question well: is this the right address? Two stories this week show what it misses when the trouble lives one layer down. A BGP hijack forged the route to a legitimate update server, and a China-linked crew turned trusted Cisco routers into listening posts. Plus routers backdoored at the factory, a state proxy network seized, and the end of a 23-year-old botnet.

A residential IP feels trustworthy because it belongs to a real home, a car, a TV box. This week two stories show how attackers rent that trust out from under people: a botnet that turns cars into proxies, and a bandwidth-sharing network churning through a thousand fresh exit IPs an hour. Plus npm packages hiding behind a CDN and a research paper on turning CDNs into amplifiers.

Two campaigns this week ran their command-and-control entirely inside services a SOC can't block: a Python implant living inside Microsoft 365, and an espionage kit relaying through Google Apps Script. Plus a 14,000-camera botnet and a vCenter bug under active exploitation.

Three attacks this week didn't beat the network trust signals a SOC relies on. They wore them: a 633-server proxy network, Midnight Blizzard on hotel Wi-Fi, and a proof-of-concept running on Cloudflare's own edge.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: a self-replicating worm rode the trust of hundreds of hugely popular npm packages, Unit 42 turned AI loose and found 14,000 unreported bugs in mature open source, plus the Cisco ASA zero-days, an Azure Cosmos DB cross-tenant escape, and a coordinated OT campaign against Minnesota water systems.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: OpenAI's own models escaped an eval sandbox through a self-hosted package proxy and breached Hugging Face, a phishing crew hiding inside 20+ Brazilian .gov.br portals, a botnet resolving its C2 through blockchain naming services, plus the Arista, Zimbra, and TeamCity bugs worth patching.

When something AI-shaped shows up in your logs, 'it's the AI stuff' is not a verdict. AI infrastructure splits into four classes with four very different risk profiles. Here's a taxonomy any analyst can use, the research that shaped it, and how we apply it.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: C2 living inside a Microsoft 365 calendar, the carding market's hunt for 'clean' residential IPs, a botnet that ships with 90+ cloud ranges, plus the SharePoint, Palo Alto, and NGINX bugs worth patching.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: AI agents spinning up C2 in minutes behind trusted infra, npm and GitHub abused at scale, and the first US sanction of a VPN provider for enabling ransomware.

Our weekly read on the infosec landscape, seen through an infrastructure-reputation lens. This week: agentic botnets on trusted AI tools, the NetNut residential-proxy takedown, proxyware in fake installers, fake Google/Cloudflare pages, an 81M-attempt run at Microsoft 365, a tricked GitHub AI agent, North Korea's PolinRider campaign, plus the active-exploit news worth patching for.

Most SOC alert triage advice starts with the blocklist. That's backwards. Here's a practical order of operations that clears the 70-90% benign noise first, so analysts spend their attention where it matters.

A live phishing kit stages its lures on Google Cloud Storage to borrow Google's good name. We used the campaign to pressure-test our own rule that big-brand cloud is never automatically benign, and tightened two things along the way.

A real case from this week: a Microsoft Teams IP showing up as 'Commercial VPN' in our API. The root cause is in your upstream feeds, the fix is in the ASN, and the design question is harder than either.

Alert fatigue is the worst-kept secret in security. Here's the math on what false positives actually cost, what's triggering them in 2026, and what a honest whitelist intelligence response looks like.