Kyle Lefton

Security Researcher II

Kyle Lefton is a security researcher on Akamai's Security Intelligence Response Team. Formerly an intelligence analyst for the Department of Defense, Kyle has experience in cyber defense, threat research, and counter-intelligence, spanning several years. He takes pride in investigating emerging threats, vulnerability research, and threat group mapping. In his free time, he enjoys spending time with friends and family, strategy games, and hiking in the great outdoors.

Posts by Kyle Lefton

CVE-2025-29635: Mirai Campaign Targets D-Link Devices

April 21, 2026Kyle Lefton

Read about the active exploitation attempts of the D-Link command injection vulnerability CVE-2025-29635 discovered by the Akamai SIRT.

AI in Vulnerability Discovery: A Call for Human Oversight and Caution

March 13, 2026Kyle Lefton and Larry Cashdollar

Learn why human oversight is crucial to the responsible use of AI systems in identifying security vulnerabilities and how to avoid false positives.

Zerobot Malware Targets n8n Automation Platform

February 27, 2026Kyle Lefton

Learn how an attacker can use a legitimate feature of the Windows System Restore mechanism to bypass and disable a modern EDR.

Two Botnets, One Flaw: Mirai Spreads Through Wazuh Vulnerability

June 09, 2025Daniel Messing and Kyle Lefton

Akamai SIRT identified an active exploitation of the remotely exploitable unsafe deserialization vulnerability CVE-2025-24016 against Wazuh servers.

Here Comes Mirai: IoT Devices RSVP to Active Exploitation

May 06, 2025Kyle Lefton

See details and IOCs of Akamai SIRT’s discovery of active exploitation of the command injection vulnerabilities CVE-2024-6047 and CVE-2024-11120.

Negative Exposure: Edimax Network Cameras Used to Spread Mirai

March 13, 2025Kyle Lefton and Larry Cashdollar

This botnet has also been observed targeting various other vulnerabilities … including a Docker API endpoint exploit.

Active Exploitation: New Aquabot Variant Phones Home

January 28, 2025Kyle Lefton and Larry Cashdollar

The Akamai SIRT has uncovered a new Mirai-based Aquabot variant being spread by exploiting a command injection vulnerability in Mitel SIP models.

DigiEver Fix That IoT Thing!

December 19, 2024Daniel Messing, Kyle Lefton, and Larry Cashdollar

A vulnerability in DigiEver DS-2105 Pro DVRs is being exploited to spread a Mirai variant that has been modified to use improved encryption algorithms.

When CUPS Runneth Over: The Threat of DDoS

October 01, 2024Chad Seaman, Kyle Lefton, and Larry Cashdollar

The Akamai Security Intelligence and Response Team tested and confirmed the DDoS threat in the CUPS service to provide guidance and mitigations for defenders.

Beware the Unpatchable: Corona Mirai Botnet Spreads via Zero-Day

August 28, 2024Aline Eliovich, Kyle Lefton, and Larry Cashdollar

The Akamai SIRT discovered a vulnerability in an AVTECH CCTV camera. Read how it is actively being exploited in the wild to spread the Corona Mirai variant.

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

July 10, 2024Sam Tinklenberg, Kyle Lefton, and Allen West

Akamai researchers observed numerous exploit attempts to abuse the PHP vulnerability CVE-2024-4577 as early as one day after disclosure.

NetKiller.Condi Botnet Exploits CVE-2024-0778 One Week After Disclosure

March 05, 2024Kyle Lefton and Larry Cashdollar

Akamai SIRT discovered a vulnerability in a Zhejiang Uniview ISC camera. Read how it is actively being exploited in the wild to spread the LZRD Mirai variant.

Actively Exploited Vulnerability in Hitron DVRs: Fixed, Patches Available

January 30, 2024Aline Eliovich, Chad Seaman, Kyle Lefton, and Larry Cashdollar

As part of the InfectedSlurs discovery, our researchers uncovered vulnerabilities in multiple Hitron DVR device models. Learn about affected devices and firmware.

Actively Exploited Vulnerability in FXC Routers: Fixed, Patches Available

December 06, 2023Chad Seaman, Kyle Lefton, and Larry Cashdollar

Akamai uncovered a zero-day vulnerability in some FXC routers, which allowed the spread of Mirai. Read all about it now that the patch has been released.

View cloud pricing

Get started with Akamai Cloud

Get started with Security

Get started with Content Delivery

Security and Delivery

Cloud pricing