Threat Briefings

Daily Threat Briefing — 2026-04-07

On April 7, 2026, threat intelligence collection identified 50 malicious indicators from abuse.ch URLhaus, representing active malware distribution campaigns. The threat landscape is dominated by IoT botnet activity (Mozi and Mirai variants targeting MIPS and ARM architectures) and browser-based social engineering attacks (ClearFake campaigns delivering ACRStealer and NetSupport RAT). Additionally, Chinese-language malware campaigns were observed distributing advanced RATs including SilverFox, Gh0stRAT, and Kryplod through cloud storage services. The ClearFake campaign shows sophisticated infrastructure with multiple subdomain variations across semanticvector[.]in[.]net, abstractlogic[.]in[.]net, conceptmatrix[.]in[.]net, structuralcore[.]in[.]net, and exhortshelk[.]in[.]net domains, suggesting a well-resourced operation with rotation capabilities. IoT botnet operators continue targeting vulnerable devices through known exploitation vectors, with Mozi malware maintaining persistent distribution across Asian IP ranges. The Chinese-language RAT campaign leverages legitimate cloud infrastructure (Alibaba OSS, AWS S3) for malware hosting, indicating supply chain compromise or targeted regional attacks. Organizations should prioritize patching IoT devices, implementing network segmentation for operational technology environments, deploying browser isolation technologies, and monitoring for connections to the identified malicious domains and IP addresses. No critical vulnerabilities, KEV entries, or honeypot data were recorded for this period.