Ransomware Erasing Backups and Hunting Linux Infrastructure

News

FBI Issues New Warning on Luna Moth Callback Phishing Tactics

The FBI issued a fresh public service announcement detailing new tactics by Luna Moth operators. The group is using more aggressive social engineering to bypass technical defenses. This signals that defenders need to invest in training as much as tools.

Qilin Ransomware Deploys New Linux Encryptor for ESXi

Qilin is now shipping a fully equipped Linux variant specifically to target ESXi infrastructure. If you are running VMs on-prem, your backup chain is the primary target right now. Assume this binary is in the wild scanning for you.

Ransomware Actors Shift Focus to Wiping Cloud Backups Pre-Encryption

Attackers are automating the deletion of cloud backups before dropping payloads to ensure you can't restore without paying. If your backups are not truly immutable or air-gapped, they are now functionally useless against a skilled actor. Stop relying on soft deletes.

Tools

Nuclei Templates Merge Adds Coverage for Fresh Vulnerabilities

Projectdiscovery just merged a significant batch of community templates covering newer CVEs. If you're running Nuclei for asset monitoring, make sure your local instance pulls the latest models to catch these specific exploits.

Analysis

Inside PumaBot: The Linux Malware Eliminating Rivals for Control

A new SSH botnet is actively killing off rival malware to claim sole ownership of the compromised host. It means you might see a temporary dip in infection noise, but the machine is still compromised and now under tighter, exclusive control.