CuraSec

tag: Persistence · 2 items

Plan archived Tengu Botnet Uses Hardware Watchdog to Survive Process Kills on Linux
2026-07-29 · The Hacker News · source ↗ #botnet#linux#persistence
  • Engineer — Plan: Any Linux device with Telnet exposed and weak credentials is a candidate target; audit your estate for Telnet listeners, disable them, and review hardware watchdog configurations on edge/IoT devices so defenders can’t be stymied by the reboot-on-kill mechanism.
  • SOC/IR — Plan: Build or tune detections for Telnet brute-force login bursts against Linux endpoints and flag unexpected device reboots following process termination events; update IR runbooks to account for the watchdog reboot loop before attempting to kill botnet processes on compromised hosts.
  • Leader — Learn: A novel DDoS botnet persistence technique that complicates incident response on Linux devices — no immediate leadership action required, but useful context if DDoS risk or IoT/edge device exposure comes up in a risk review.
Plan archived ClickOnce Abused for Persistent Threat Actor Access (Part 2)
2026-07-11 · CrowdStrike Blog · source ↗ #windows#persistence#ttp
  • Engineer — Learn: Describes how attackers abuse the ClickOnce deployment mechanism for persistence in Windows environments — no patch or config change indicated, but worth understanding if you deploy .NET apps or manage Windows estates.
  • SOC/IR — Plan: New ClickOnce-based persistence TTP with public CrowdStrike analysis — build or tune detections around ClickOnce application installations and associated scheduled tasks or registry run keys in your SIEM/EDR.
  • Leader — Skip