Larry Cashdollar

Explore how a self-propagating IoT botnet combines automated scanning, C2 control, and 30 DDoS techniques to expand attack capacity.

Learn how threat actors exploit Langflow CVE-2025-3248 to hijack high-performance AI infrastructure and deploy customized Gafgyt DDoS botnets.

The Akamai SIRT uncovered a custom P2P Trojan masquerading as system activity. Learn how to detect and mitigate this stealthy Go-based cryptominer.

Learn why human oversight is crucial to the responsible use of AI systems in identifying security vulnerabilities and how to avoid false positives.

Stay ahead with the latest on the Vivotek upload_map.cgi vulnerability, CVE-2026-22755, and protect your legacy firmware from command injection attacks.

The Akamai SIRT has uncovered an old flaw in legacy Vivotek firmware that affects a significant number of device models.

This botnet has also been observed targeting various other vulnerabilities … including a Docker API endpoint exploit.

The Akamai SIRT has uncovered a new Mirai-based Aquabot variant being spread by exploiting a command injection vulnerability in Mitel SIP models.

A vulnerability in DigiEver DS-2105 Pro DVRs is being exploited to spread a Mirai variant that has been modified to use improved encryption algorithms.

The Akamai Security Intelligence and Response Team tested and confirmed the DDoS threat in the CUPS service to provide guidance and mitigations for defenders.

The Akamai SIRT discovered a vulnerability in an AVTECH CCTV camera. Read how it is actively being exploited in the wild to spread the Corona Mirai variant.

Akamai SIRT discovered a vulnerability in a Zhejiang Uniview ISC camera. Read how it is actively being exploited in the wild to spread the LZRD Mirai variant.

As part of the InfectedSlurs discovery, our researchers uncovered vulnerabilities in multiple Hitron DVR device models. Learn about affected devices and firmware.

When researching the InfectedSlurs botnet, the SIRT uncovered a vulnerability in QNAP VioStor NVR devices being actively exploited in the wild. Get the details.

Akamai uncovered a zero-day vulnerability in some FXC routers, which allowed the spread of Mirai. Read all about it now that the patch has been released.

KmsdBot is back — and, this time, it’s going after IoT devices. Read about the updates to the binary and their effects, which reinforce the need for robust security measures.

Akamai researchers uncover and reverse engineer a new Go-based DDoS botnet.

Read about the global impact of KmsdBot, a botnet that hit our honeypot earlier this year, and why the evidence is pointing toward it being a DDoS for hire.

Akamai security research has observed a new malware: a cryptominer with dreams of DDoS functionality. Read about kmdsbot in this blog.

Identity theft affects millions of people every year. See this piece on a scam purporting to be PayPal in an effort to gain total identity theft.

Threat Researcher Larry Cashdollar has discovered evidence of the Mirai botnet abusing Log4j vulnerability and shares code examples.

There are many crypto mining malware variants infecting systems on the internet. On Friday, March 4, 2021, I noticed an interesting hit in my honeypot logs. The binary it captured stood out, as it was rather large at 4MB. I immediately thought it would be a crypto miner written in the Go language. I was correct. This one however, has some newer exploits it's using for proliferation.

While recently looking over my honeypots, I discovered an infection where a malicious actor added a storefront on top of my existing WordPress installation. For background, this particular honeypot is a full instance of WordPress running on a Docker image....

By: Larry Cashdollar Malware that can target Windows and Linux systems was recently installed on my honeypot. After some investigation, I determined it to be similar to the malware discovered in February of 2019 by Malwarebytes, and later examined by...

I have been playing close attention to Internet of Things (IoT) malware targeting systems with Telnet enabled, while also collecting samples targeting systems with SSH enabled on port 22. I've collected over 650 samples landing in my honeypot within the...

In June 2019, logs on my personal website recorded markers that were clearly Remote File Inclusion (RFI) vulnerability attempts. The investigation into the attempts uncovered a campaign of targeted RFI attacks that currently are being leveraged to deploy phishing kits....

When it comes to phishing, criminals put a lot of effort into making their attacks look legitimate, while putting pressure on their victims to take action.