Attackers are increasingly leveraging sophisticated techniques to maintain long-term access in cloud environments, and a newly surfaced tool named AWSDoor is emerging as a major threat.
AWSDoor automates a range of IAM and resource-based persistence methods, allowing adversaries to hide in plain sight within AWS accounts without deploying traditional malware.
Key Takeaways 1. AWSDoor exploits IAM stealthily by injecting AccessKeys, backdooring TrustPolicies. 2. Leverages resource-based persistence via poisoned Lambda layers. 3. Disables CloudTrail logging, misuses S3 lifecycle rules, and detaches accounts.
IAM-Based Backdoors and Rogue Policies
RiskInsight reports that AWSDoor abuses AWS Identity and Access Management (IAM) to create stealthy backdoors. By injecting AccessKeys into compromised IAM users, attackers can secure CLI persistence. With a simple invocation:
AWSDoor creates a new AccessKey pair, granting attacker-controlled credentials that blend with legitimate traffic. To avoid detection, the tool can list existing keys, deactivate unused ones, and remove evidence.
AWS Key added through AWSDoor
Beyond AccessKeys, AWSDoor manipulates TrustPolicy documents to backdoor IAM roles.
Trust policy modified using AWSDoor
By updating a role’s trust policy to include attacker-controlled principals, the adversary ensures a persistent cross-account AssumeRole capability.
The new policy injects a statement allowing sts:AssumeRole from an external account, granting durable, credential-less access that escapes CloudTrail’s simple credential logs, reads the report.
AWSDoor’s resource-based persistence modules take advantage of AWS services themselves. For example, the AdminLambda module provides a malicious Lambda function or layer with an over-privileged role attachment:
Here, the -l flag instructs AWSDoor to deploy a Lambda Layer containing poisoned libraries that override legitimate functions (e.g., a backdoored requests.get()), ensuring code execution each time the function executes.
Exposed via API Gateway or Function URL, this Lambda becomes a remote shell. This stealthy tactic hides malicious code outside the main function body, bypassing routine console inspections and evading inline code reviews.
Mitigations
Security teams must continuously monitor IAM policy changes, specifically CloudTrail events like CreateAccessKey, UpdateAssumeRolePolicy, and PutRolePolicy.
AWS Config custom rules can flag rogue NotAction statements that grant near-Administrator privileges:
Additionally, defenders should audit Lambda layer attachments (UpdateFunctionConfiguration) and validate any externally accessible function URLs.
Employing both Cloud Security Posture Management (CSPM) and Cloud EDR solutions will enable detection of anomalous IAM modifications and unusual runtime behaviors.
As AWSDoor demonstrates, attackers are shifting towards configuration-based persistence, making vigilant policy auditing and telemetry integrity essential to maintaining AWS environment security.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
In today’s complex digital landscape, the volume and sophistication of cyber threats have outpaced the ability of most organizations to manage their security on their own. The escalating costs of in-house security teams, the global cybersecurity skills gap, and the 24/7 nature of cyberattacks have made it nearly impossible for businesses to maintain a resilient […]
Unvetted Model Context Protocol (MCP) servers introduce a stealthy supply chain attack vector, enabling adversaries to harvest credentials, configuration files, and other secrets without deploying traditional malware. The Model Context Protocol (MCP)—the new “plug-in bus” for AI assistants—promises seamless integration of AI models with external tools and data sources. Yet this flexibility creates a novel […]
The cybersecurity landscape demands sophisticated tools to identify and exploit vulnerabilities effectively, with Nessus vs Metasploit representing one of the most powerful combinations in modern penetration testing.
As cyber threats continue to evolve rapidly, security professionals require comprehensive solutions that can both discover security weaknesses and validate their exploitability through controlled testing environments.
The integration of Nessus vulnerability scanner with the Metasploit exploitation framework creates a synergistic approach to vulnerability assessment and penetration testing that has become the industry standard for ethical hackers and security researchers worldwide.
This technical research article explores the comprehensive comparison between Nessus and Metasploit, examining their individual capabilities, integration methodologies, and practical exploitation techniques.
Through detailed analysis of both tools’ strengths, limitations, and real-world applications, security professionals can better understand how to leverage these platforms for maximum effectiveness in their vulnerability assessment and penetration testing operations.
The combination of automated vulnerability discovery with targeted exploitation capabilities provides organizations with the insights needed to strengthen their security posture against advanced persistent threats and sophisticated attack vectors.
Nessus vulnerability scanner interface displaying a completed scan report with categorized vulnerabilities and detailed scan metadata
Understanding Nessus
Nessus stands as the world’s most widely deployed vulnerability assessment solution, developed by Tenable Network Security and trusted by over 30,000 organizations globally.
With more than 2 million downloads and adoption by 65% of Fortune 500 companies, Nessus has established itself as the benchmark for vulnerability scanning accuracy and coverage.
The platform features an extensive database of over 140,000 plugins covering more than 50,000 common vulnerability exploits (CVEs), with Tenable releasing more than 100 new plugins weekly to address emerging threats within 24 hours of vulnerability disclosure.
The scanner operates through a sophisticated engine that performs comprehensive network discovery, operating system fingerprinting, and service enumeration across diverse IT environments.
Nessus excels in identifying vulnerabilities across traditional IT assets, web applications, cloud infrastructures, and modern attack surfaces, including IoT devices and containerized environments.
Its credentialed scanning capabilities provide deep visibility into system configurations, missing patches, and security misconfigurations, while unauthenticated scans simulate external attacker perspectives to identify externally exploitable vulnerabilities.
Advanced Scanning Capabilities And Features
The latest Nessus versions include groundbreaking features such as CVSSv4 and EPSS scoring for enhanced vulnerability prioritization, triggered agent scanning in Nessus Manager, and improved offline mode capabilities for air-gapped environments.
These enhancements enable organizations to conduct more precise risk assessments by incorporating real-world threat intelligence and exploit prediction scoring systems.
The platform’s six-sigma accuracy achievement, with a false positive rate of only 0.32 defects per 1 million scans, ensures that security teams can focus their remediation efforts on genuine security threats without wasting resources on non-existent vulnerabilities.
Nessus supports multiple scanning methodologies, including network-based vulnerability assessments, web application security testing, and compliance auditing against frameworks such as PCI DSS, GDPR, and various industry-specific standards.
The platform’s asset discovery capabilities automatically identify and catalog network-connected devices, creating comprehensive inventories that include operating system versions, installed software, open ports, and running services.
This comprehensive visibility enables security teams to maintain accurate attack surface mapping and ensures that no assets remain hidden from security assessments.
Metasploit Framework: The Ultimate Exploitation Platform
Metasploit Framework represents the world’s most sophisticated open-source penetration testing platform, providing security professionals with an extensive arsenal of exploits, payloads, and post-exploitation tools.
Developed by Rapid7 and continuously enhanced by a global community of security researchers, Metasploit contains over 2,180 working exploits targeting vulnerabilities across Windows, Unix/Linux, and macOS systems, along with 592 payload options for diverse attack scenarios.
The framework’s modular architecture enables security professionals to combine any exploit with compatible payloads, creating customized attack vectors tailored to specific target environments and testing objectives.
The platform operates on five primary module types: exploit modules for delivering payloads through vulnerability exploitation, payload modules containing the actual code executed on target systems, auxiliary modules providing non-exploit functionality like scanning and fuzzing, post-exploitation modules for maintaining access and gathering intelligence, and encoder modules for evading security detection systems.
This comprehensive toolkit enables penetration testers to simulate real-world attack scenarios, from initial reconnaissance through complete system compromise and lateral movement across network infrastructures.
Post-Exploitation And Advanced Capabilities
Metasploit’s Meterpreter payload stands as one of the most powerful post-exploitation tools available, providing an interactive shell that operates entirely in memory without writing files to disk.
This advanced payload enables security professionals to perform sophisticated post-exploitation activities, including privilege escalation, credential harvesting, file system manipulation, network pivoting, and persistence establishment.
The framework integrates seamlessly with vulnerability scanners like Nessus, enabling automated correlation between discovered vulnerabilities and available exploits for streamlined penetration testing workflows.
Recent additions to the Metasploit arsenal include Shadow Credentials modules for Active Directory exploitation, critical CVE modules like CVE-2024-3400 for PAN-OS GlobalProtect Gateway exploitation, and enhanced automation capabilities for large-scale security assessments.
The framework’s database integration allows security teams to import vulnerability scan results from multiple sources, creating centralized repositories of attack surface intelligence that can be queried, filtered, and analyzed to prioritize high-impact security testing activities.
Metasploit Framework console v6.1.14 showing module counts and ready for exploitation commands
Nessus vs Metasploit Workflow
The integration of Nessus with Metasploit creates a powerful vulnerability discovery and exploitation pipeline that maximizes the efficiency of security assessments.
This workflow begins with comprehensive Nessus vulnerability scanning to identify potential attack vectors, followed by systematic exploitation using Metasploit’s extensive exploit database to validate the practical impact of discovered vulnerabilities.
The integration process leverages both tools’ strengths: Nessus provides broad vulnerability coverage and accurate asset intelligence, while Metasploit delivers precise exploitation capabilities and post-compromise simulation tools.
Security professionals can establish this integration through multiple methodologies, including direct Nessus API connectivity within the Metasploit console, manual import of Nessus report files in .nbe or .nessus formats, and automated scripting solutions that synchronize vulnerability data between platforms.
The Nessus Bridge plugin enables real-time connectivity between tools, allowing penetration testers to initiate vulnerability scans from within the Metasploit console and automatically import results for immediate exploitation analysis.
Nessus-Metasploit Integration Workflow: From Vulnerability Discovery to Exploitation
Step-by-Step Integration Process
The practical implementation of Nessus via Metasploit begins with network reconnaissance using Nessus’s asset discovery capabilities to identify active hosts, open ports, and running services across the target environment.
Following initial discovery, comprehensive vulnerability scanning analyzes identified assets for security weaknesses, misconfigurations, and unpatched software vulnerabilities.
The scanner’s credentialed assessment capabilities provide deeper visibility into system configurations, installed software versions, and local security policies that may not be visible through external scanning methodologies.
Once vulnerability scanning completes, security professionals export results in compatible formats and import them into the Metasploit database using the db_import command.
This process populates the framework’s database with comprehensive vulnerability intelligence, including CVE identifiers, affected services, exploit difficulty ratings, and potential impact assessments.
The integrated data enables automated correlation between discovered vulnerabilities and available Metasploit exploit modules, significantly reducing the time required to identify viable attack vectors and exploitation opportunities.
Strengths And Limitations
The Nessus vs Metasploit comparison reveals complementary strengths that make their combination particularly powerful for comprehensive security assessments.
Nessus excels in broad vulnerability discovery, offering unparalleled CVE coverage, high-accuracy scanning, and extensive plugin libraries that identify security weaknesses across diverse technology platforms and configurations.
Its automated scanning capabilities enable rapid assessment of large network environments, while detailed reporting features provide comprehensive documentation for compliance and remediation planning purposes.
Metasploit’s primary strengths lie in exploitation validation and post-compromise simulation, offering security teams the ability to demonstrate real-world attack impacts and business risk exposure.
The framework’s extensive exploit database, advanced payload options, and sophisticated post-exploitation tools enable realistic simulation of advanced persistent threat (APT) scenarios and sophisticated attack campaigns.
However, Metasploit requires significant technical expertise for effective utilization and may not identify vulnerabilities that lack corresponding exploit modules in its database.
Performance And Usability Comparison
From a performance perspective, Nessus demonstrates superior scanning speed and accuracy, with its optimized scan engine capable of assessing thousands of network assets simultaneously while maintaining minimal false positive rates.
The platform’s user-friendly web interface and extensive policy templates enable rapid deployment and configuration, making it accessible to security professionals with varying technical expertise levels.
Nessus’s comprehensive reporting capabilities provide executive-level summaries alongside detailed technical findings, supporting both strategic decision-making and tactical remediation activities.
Metasploit requires more specialized knowledge but provides unmatched flexibility for advanced penetration testing scenarios and security research activities.
The framework’s command-line interface and modular architecture enable experienced security professionals to create custom attack scenarios and develop novel exploitation techniques.
While this complexity may challenge novice users, it provides expert practitioners with the tools needed to simulate sophisticated threat actors and advanced attack methodologies that automated scanners cannot replicate.
Market Share and Performance Comparison of Leading Vulnerability Scanning Tools in 2024-2025
Real-World Exploitation Scenarios And Case Studies
Practical application of Nessus via Metasploit methodology demonstrates significant value in real-world penetration testing engagements and security assessments.
Consider a scenario where Nessus identifies an unpatched Windows system vulnerable to MS17-010 (EternalBlue), the infamous vulnerability exploited by WannaCry ransomware.
Security professionals can leverage this intelligence to configure the appropriate Metasploit exploit module (exploit/windows/smb/ms17_010_eternalblue), establish reverse TCP payloads, and demonstrate complete system compromise within minutes of vulnerability discovery.
Advanced exploitation scenarios involve multi-stage attacks where initial Nessus reconnaissance identifies web application vulnerabilities, database misconfigurations, and network service weaknesses across interconnected systems.
Security teams can then orchestrate complex attack chains using Metasploit’s pivoting capabilities, moving laterally through compromised networks while maintaining persistence and avoiding detection.
These realistic attack simulations provide organizations with concrete evidence of potential impact and support strategic security investment decisions.
Market Trends And Future Developments
The vulnerability scanning market continues experiencing rapid growth, with global market valuation projected to reach $11 billion by 2032, reflecting a compound annual growth rate of 9% driven by increasing cyber threats and regulatory compliance requirements.
Cloud-based vulnerability scanning solutions represent the fastest-growing segment, with 64% of organizations preferring cloud-native platforms for their scalability, accessibility, and reduced infrastructure requirements.
This shift toward cloud-based security tools aligns with broader digital transformation initiatives and the increasing adoption of DevSecOps practices across industries.
Artificial intelligence integration is revolutionizing vulnerability management capabilities, with AI-enhanced scanning tools projected to reach $10.5 billion by 2034, growing at a CAGR of 14.20%.
These advanced platforms incorporate machine learning algorithms for improved threat detection, automated vulnerability prioritization, and predictive risk assessment capabilities.
The integration of AI technologies enables security teams to process vast amounts of vulnerability data more efficiently while reducing false positive rates and improving remediation prioritization accuracy.
Global Vulnerability Scanning Market Growth Projection 2021-2034 by Technology Segment
Zero Trust Architecture adoption is driving increased demand for continuous vulnerability assessment and validation capabilities, with organizations requiring real-time security posture monitoring across distributed network environments.
The combination of Nessus vulnerability intelligence with Metasploit exploitation validation supports Zero Trust implementations by providing continuous verification of security controls and assumption validation.
This approach enables organizations to identify security gaps in their Zero Trust implementations before malicious actors can exploit them.
DevSecOps integration represents another significant trend, with security teams incorporating vulnerability scanning and penetration testing tools directly into continuous integration/continuous deployment (CI/CD) pipelines.
This shift-left security approach enables organizations to identify and remediate vulnerabilities during development phases rather than post-deployment, significantly reducing remediation costs and security risk exposure.
The automation capabilities of both Nessus and Metasploit support these integration requirements through API connectivity and scriptable interfaces.
The combination of Nessus vulnerability scanning with Metasploit exploitation capabilities provides security organizations with unparalleled visibility into their security posture and a realistic assessment of potential attack impacts.
This powerful integration enables comprehensive security testing that goes beyond simple vulnerability identification to demonstrate actual exploitability and business risk exposure.
Organizations implementing this methodology gain competitive advantages through improved security awareness, more effective resource allocation, and enhanced regulatory compliance capabilities.
Security professionals should prioritize developing expertise in both platforms while maintaining focus on ethical testing practices and comprehensive documentation of security findings.
The evolving threat landscape requires continuous learning and adaptation, with security teams staying current on emerging vulnerabilities, new exploitation techniques, and advanced defense strategies.
Investment in training and certification programs ensures that security personnel can maximize the value of these sophisticated tools while maintaining professional standards and ethical boundaries.
Modern cybersecurity demands proactive approaches that combine automated discovery with manual validation to address sophisticated threat actors and advanced attack methodologies.
The integration of Nessus and Metasploit represents a mature, proven approach that provides organizations with the intelligence and capabilities needed to maintain robust security postures in increasingly complex digital environments.
As cyber threats continue evolving, this combination will remain essential for comprehensive security assessment and risk management programs across all industry sectors.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Active since 2011, SmokeLoader (also known as Smoke or Dofoil) has cemented its reputation as a versatile malware loader engineered to deliver second-stage payloads, including trojans, ransomware, and information stealers. Over the years, it has evolved to evade detection and optimize payload delivery, extending its reach through an extensible plugin framework capable of credential harvesting, […]
President Donald Trump Monday directed Tennessee's National Guard deployed to the Democratic-led city of Memphis, following similar actions in the District of Columbia that Trump has said were needed to tackle crime.
“We’re going to make Memphis safe again," Trump said.
It’s the latest test of Trump’s presidential powers in using the U.S. military domestically, despite a law that bars soldiers from partaking in local law enforcement. Trump said his efforts in the district – using the National Guard – would be replicated in cities across the country.
In the Oval Office, flanked by Tennessee’s GOP Gov. Bill Lee and the state’s Republican U.S. senators, Bill Hagerty and Marsha Blackburn, the president signed a presidential memorandum to establish a “Memphis Safe Task Force” to address violent crime using federal law enforcement and agencies.
“We're sending in the big force,” Trump said.
Multiple federal agencies
In addition to the National Guard, the task force will include the U.S. Marshals Service, FBI, Drug Enforcement Agency, Homeland Security Investigations and U.S. Immigration and Customs Enforcement agents. It’s unclear how many Guard members or members of federal law enforcement will be sent.
“This task force will be a replica of our extraordinarily successful efforts here, and you'll see it's a lot of the same thing,” Trump said of using the National Guard in the district.
It’s the first time Trump has sent the National Guard into a red state, after seizing control of the California National Guard from the state’s governor — a Democrat — for deployment in Los Angeles, and then sending Guard members to the district, another Democratic stronghold.
The Memphis mayor's office could not immediately be reached for comment.
Trump added that St. Louis, Missouri, could also see similar action.
Other cities
The dispatch of the National Guard to Tennessee comes after Trump has threatened to send troops to other cities including New Orleans; Portland, Oregon; and Chicago. Illinois Gov. J.B. Pritzker pushed back and the president had backed off his threat, though he mentioned the city again on Monday.
Governors have control over their state National Guard except in rare circumstances where the president can seize control. Pritzker has repeatedly rejected the idea of sending the National Guard into Chicago.
“If we don’t have the governor's help we’re doing it without him,” Trump said of Pritzker.
With Memphis, Lee welcomed the intervention and thanked Trump for directing federal resources to the city.
“We are very hopeful and excited about the prospect of moving that city forward,” Lee said.
Two critical vulnerabilities, CVE-2025-41248 and CVE-2025-41249, have emerged in Spring Security and Spring Framework that could allow attackers to bypass authorization controls in enterprise applications.
These flaws arise when using Spring Security’s @EnableMethodSecurity feature in conjunction with method-level annotations such as @PreAuthorize and @PostAuthorize.
In applications where service interfaces or abstract base classes employ unbounded generics, the annotation detection mechanism may fail to locate security annotations on overridden methods, enabling unauthorized access to protected endpoints.
Key Takeaways 1. Spring Security 6.4.x/6.5.x ignores method-level annotations, enabling bypass. 2. Spring Framework 5.3.x/6.1.x/6.2.x fails to detect annotations. 3. Upgrade to fixed versions or redeclare annotations on concrete classes.
Both the authorization bypass and annotation detection flaws are classified as Medium severity and impact a wide range of Spring Security and Spring Framework versions spanning the 5.x through 6.x release trains.
CVE-2025-41248 targets Spring Security versions 6.4.0 through 6.4.9 and 6.5.0 through 6.5.3.
When a parameterized superclass defines a secured method signature, and a subclass fails to redeclare the relevant annotation, the framework’s metadata resolver does not traverse the generic type hierarchy correctly.
Attackers may exploit this logic gap by invoking secured operations defined only on a generic interface, bypassing authorization checks that rely on @PreAuthorize(“hasRole(‘ADMIN’)”) or similar SpEL expressions.
The vulnerability yields a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2025-41249 affects Spring Framework core modules in versions 5.3.0 through 5.3.44, 6.1.0 through 6.1.22, and 6.2.0 through 6.2.10.
In this case, the annotation detection flaw impedes recognition of any method annotation used for authorization or auditing when defined on a generic base class.
Without the annotation metadata, Spring Security cannot enforce method-level security constraints.
Both vulnerabilities stem from improper handling of unbounded generics during annotation introspection, causing the runtime to ignore security metadata and treat sensitive service methods as if they were unprotected.
CVE
Title
CVSS 3.1 Score
Severity
CVE-2025-41248
Spring Security authorization bypass for method security annotations on parameterized types
6.5
Medium
CVE-2025-41249
Spring Framework annotation detection vulnerability on generic superclasses
6.5
Medium
Mitigations
Spring maintainers have released fixed versions for all affected modules. For Spring Security, users should upgrade to 6.4.10 or 6.5.4.
For Spring Framework, the recommended upgrades are 5.3.45, 6.1.23, and 6.2.11. Full mitigation details are available in the Spring Security Advisories and RSS feed.
Teams unable to upgrade immediately can enforce a temporary workaround by declaring all secured methods directly in the concrete class rather than relying on inherited annotations from generic superclasses.
Ensuring consistent use of @PreAuthorize, @PostAuthorize, and other method security annotations on each implementing class will prevent the bypass.
Development teams are urged to review their service interfaces for usage of @EnableMethodSecurity in conjunction with generics.
Static analysis tools and custom annotation scanning scripts should be updated to detect annotated methods correctly across type hierarchies.
Security teams must prioritize these upgrades in CI/CD pipelines to avoid inadvertent exposure of protected APIs. Continuous validation of method-level security, combined with code reviews focusing on generic service patterns, will strengthen authorization enforcement and guard against similar flaws.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
SmokeLoader, first seen on criminal forums in 2011, has evolved into a highly modular malware loader designed to deliver a variety of second-stage payloads, including trojans, ransomware, and credential stealers.
After Operation Endgame disrupted numerous campaigns in mid-2024, the loader reemerged in early 2025 as two distinct variants: version 2025 alpha and version 2025.
Both variants address previous performance bugs, enhance evasion capabilities, and expand the plugin framework that enables disparate malicious activities.
Zscaler researchers noted that these updates allow SmokeLoader to operate more stealthily and efficiently on compromised hosts.
Initially, SmokeLoader’s primary function was to inject a main module into Windows Explorer for persistent execution and beaconing to command-and-control (C2) servers.
The stager, responsible for this injection, previously lacked proper checks and would continually inject new copies of the module at ten-minute intervals, resulting in severe performance degradation.
Zscaler analysts identified that version 2025 alpha introduced a mutex check in the stager, terminating the injection process if the mutex already exists.
Mutex Code (Source – Zscaler)
This mutex generation algorithm, which derives a random lowercase string based on the first four bytes of the bot ID, prevents repeated injections and conserves system resources.
Beyond loader stability, SmokeLoader’s plugin framework has matured significantly. Operators can optionally deploy modules that harvest browser credentials, hijack sessions, perform distributed denial-of-service (DoS) attacks, and mine cryptocurrency.
Each plugin is delivered as a second-stage payload, triggered based on configuration flags received from the C2.
This flexibility allows threat actors to tailor payloads to specific objectives, from data exfiltration in targeted espionage to volumetric DoS in extortion campaigns.
Infection Mechanism and Persistence
SmokeLoader’s infection chain begins with a reconnaissance email or exploit kit that delivers the stager as a shellcode-packed executable.
Upon execution, the stager resolves Windows API dependencies by hash, decrypts code blocks with a hardcoded offset, and injects the main module into the explorer.exe process using 64-bit shellcode.
Once inside explorer.exe, the main module creates a scheduled task for persistence, now named “MicrosoftEdgeUpdateTaskMachine%hs,” where the placeholder is the first 16 characters of the bot ID.
SmokeLoader execution process control flow (Source – Zscaler)
This contrasts with earlier variants that used “Firefox Default Browser Agent %hs,” evidencing the author’s attempt to masquerade as legitimate update services.
After establishing persistence, the main module generates the same mutex to avoid duplicate execution and begins beaconing to C2 servers using an updated protocol that includes a four-byte CRC32 checksum.
This checksum is calculated over the payload starting at offset six, ensuring integrity and hindering simplistic network detections.
The response handling also changed: the initial four-byte command length field is now XOR-obfuscated with the RC4 key, complicating static signature matching.
Throughout this process, Zscaler analysts observed that SmokeLoader’s network communications consistently mimic legitimate browser user agents and TLS handshakes, further blending malicious traffic with normal web browsing.
By integrating both stager and main-module enhancements along with versatile plugins, SmokeLoader remains a potent threat for data theft and DoS operations under a single, adaptable framework.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
Since early 2025, the cybersecurity community has witnessed an unprecedented surge in distributed denial-of-service (DDoS) bandwidth, culminating in a record-shattering 11.5 Tbps assault attributed to a botnet named AISURU.
Emerging from XLab’s continuous monitoring of global DDoS incidents, this botnet leveraged compromised router firmware to amass approximately 300,000 active devices worldwide.
Researchers first detected unusual spikes of malicious traffic targeting major infrastructure providers, prompting deeper investigation into the underlying threat.
XLab analysts noted striking similarities between AISURU’s attack methodology and earlier campaigns, yet the scale and sophistication of this operation far surpassed previous benchmarks.
Propagation of AISURU began in April 2025 when threat actors exploited a vulnerability in Totolink router firmware update servers.
By altering the firmware URL to point to a malicious script, every device performing an automatic update became infected.
In a matter of weeks, the size of AISURU’s network swelled to over 100,000 routers, and by September 2025, the botnet had consolidated around 300,000 nodes.
XLab researchers identified the use of GRE tunneling to distribute traffic loads across multiple command-and-control (C2) servers, enabling the botnet to orchestrate a simultaneous flood of packets that overwhelmed target networks with ease.
The impact of the 11.5 Tbps attack was felt globally as service providers scrambled to mitigate the flood of SYN, UDP, and DNS amplification requests.
Affected organizations reported intermittent outages and service degradation, highlighting the potency of combining large-scale IoT compromise with advanced evasion techniques.
XLab analysts identified the rapid shift from traditional amplification vectors to custom-crafted packet sequences designed to bypass legacy mitigation tools, an innovation that allowed AISURU to set new world records in DDoS throughput.
While AISURU’s distributed architecture and bandwidth capacity are staggering on their own, the malware’s underlying behavior reveals a deeper level of technical refinement.
Its dual-version propagation engine demonstrates continuous evolution, integrating both zero-day exploits and known N-day vulnerabilities to expand its reach.
Equally concerning is its modular design, which facilitates swift updates to encryption, communication protocols, and attack commands without requiring a complete overhaul of the malware codebase.
Infection Mechanism: Firmware Update Hijacking
Delving into AISURU’s infection mechanism uncovers a deceptively simple yet devastating approach.
In April 2025, attackers breached Totolink’s firmware update server, planting a shell script named t.sh that redirected devices to download the AISURU payload.
Once executed, the script set up persistent execution by modifying /etc/rc.local entries and disabling the Linux OOM Killer via /proc/self/oom_score_adj, ensuring the bot remained resident across reboots.
The payload binary, renamed to libcow.so, avoided detection by masquerading as a common system daemon such as telnetd or dhclient.
Upon initialization, AISURU performs environment checks to terminate itself under virtualized or analysis environments by scanning for virtualization artifacts and debugging tools.
It then establishes a secure channel with C2 servers via a custom AES-XOR hybrid protocol, exchanging commands that range from DDoS instructions to residential proxy assignments.
One illustrative snippet of the persistence routine follows:-
This mechanism underscores the threat actors’ mastery over both traditional Linux administration and bespoke malware engineering, enabling AISURU to maintain dominance in the DDoS ecosystem.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A new variation of the Rowhammer attack, named Phoenix, breaks through the built-in defenses of modern DDR5 memory modules. Researchers reverse-engineered the in-DRAM protections on SK Hynix chips and found blind spots that let them flip bits despite the most advanced hardware safeguards. Their work shows that every tested DDR5 module from the world’s largest DRAM […]
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)