Cyware Daily Threat Intelligence - August 14, 2026
A surge in Mirai-based botnets is turning everyday edge devices into covert relay networks, as attackers exploit a string of old and new vulnerabilities to quietly conscript routers and gateways. Cyware spotlights Evooo1Bot, which leverages encrypted command channels and brute-force scanning to build persistent proxy fleets, raising the stakes for organizations with exposed infrastructure.
A critical zero-day in Oracle PeopleSoft has handed attackers direct access to campus servers, with exploitation observed across higher education networks before a patch was released. The flaw, tracked as CVE-2026-35273, has already enabled remote code execution and data theft, underscoring the urgent need for emergency fixes and network segmentation.
Espionage and extortion groups are escalating their campaigns, with Jewelbug breaching government webmail accounts and siphoning over 2,300 emails and 580,000 browser cookies, while Cl0p claims data thefts from nearly 50 major firms via Oracle zero-days. These incidents highlight the expanding reach and technical sophistication of today’s threat actors.
Top Malware Reported in the Last 24 Hours
Evooo1Bot turns edge devices into proxies
Evooo1Bot is a Mirai-based Linux botnet designed to convert internet-facing edge devices into persistent proxies. Evooo1Bot exploits a wide array of known vulnerabilities—CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, and CVE-2025-10123—and uses a loader script to deploy binaries tailored to the victim’s CPU architecture. Evooo1Bot incorporates encrypted C2 communications, an SSH brute-force scanner, and a SOCKS relay module, merging botnet control with proxy services. Evooo1Bot employs persistence mechanisms and startup checks to evade analysis, and obfuscates strings using AES and ChaCha20. Evooo1Bot spreads through exploitation of vulnerable routers and gateways, targeting internet-facing devices. Fortinet researchers discovered Evooo1Bot, highlighting the risk of compromised infrastructure being used to route malicious traffic.
Dysphoria botnet amasses 296,000 IoT devices
Dysphoria is an IoT botnet that has compromised approximately 296,000 devices, including consumer routers, DVRs, cameras, and small-office gateways. Dysphoria exploits known vulnerabilities and weak authentication to convert devices into a DDoS-capable fleet and decentralized relay/residential-proxy ecosystem. Dysphoria scans for UPnP-capable gateways and uses router port mapping to expand inbound access. Dysphoria manages its C2 infrastructure using blockchain-backed naming systems such as Ethereum Name Service and Solana Name Service, making takedown efforts more difficult. Dysphoria targets a wide range of IoT devices globally. Early tracking recorded over 200,000 active bots, with a single-day overseas peak of 239,000 devices.
AmnesiaStealer tricks macOS users via GitHub
AmnesiaStealer is a Rust-based macOS infostealer that targets users through a counterfeit GitHub download page. AmnesiaStealer employs a three-stage infection chain, beginning with a shell script that fetches and executes the payload, then establishes persistence via a LaunchDaemon and attempts a TCC bypass using CVE-2020-9771. AmnesiaStealer performs reconnaissance, prompts for and validates the user’s login password, copies keychains, and harvests browser databases from Chromium-based browsers including Chrome, Brave, Arc, and Edge. AmnesiaStealer overwrites the Safe Storage key in the login keychain, potentially making saved passwords and cookies unrecoverable. SecurityWeek reports that AmnesiaStealer also enables remote control of browser sessions via the Chrome DevTools Protocol, supporting live screencasting.
Top Vulnerabilities Reported in Last 24 hours
PeopleSoft zero-day exploited in universities
CVE-2026-35273 is a zero-day authentication bypass in Oracle PeopleSoft Environment Management Hub with a CVSS score of 9.8 (Oracle) and 9.3 (Zero Day Initiative). Successful exploitation allows unauthenticated remote code execution, granting attackers full control of the server. CVE-2026-35273 is actively exploited in the wild, with attacks observed from May 27 to June 9, 2026. The campaign is attributed to ShinyHunters (also tracked as UNC6040 and UNC 6240). Oracle has released an emergency patch, and mitigations include disabling the Environment Management Hub service and blocking external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector. The vulnerability affects campus networks running unpatched PeopleSoft servers.
Unpatched GeoServer zero-day draws probes
An unpatched SQL injection zero-day in GeoServer exposes mapping servers to potential remote code execution. Successful exploitation can result in unauthorized access, data exposure, and attackers gaining a foothold for further intrusion. Exploitation attempts have been observed in the wild, with watchTowr reporting hundreds of probes from a small set of sources. Researcher @q1uf3ng publicly disclosed the issue on August 12, 2026 at 10:46 UTC. No patch is available; organizations are advised to restrict public access to GeoServer instances and enhance monitoring for exploitation attempts.
SharePoint auth bypass weaponized after PoC
CVE-2026-55040 is a critical authentication bypass in Microsoft SharePoint with a CVSS score of 9.1. Exploitation allows attackers to bypass authentication and act as a SharePoint user or administrator, enabling file disclosure and data tampering. Attackers are actively using proof-of-concept code published by Rapid7 against SharePoint honeypots, though Microsoft has not confirmed widespread exploitation. Rapid7 researcher Stephen Fewer published the technical analysis. A fix is available in Microsoft’s July 2026 Patch Tuesday updates, and organizations are advised not to expose SharePoint servers directly to the internet.
Top Threat Actors Reported in Last 24 hours
Jewelbug breaches government webmail, runs crypto scams
Jewelbug is a suspected espionage-and-fraud group believed to operate multiple campaigns for data theft and financial gain. Jewelbug uses the Antino backdoor, an XG-Web framework, and the ClientKing implant to breach Linux servers, ARM64 devices, and ASUS routers. Jewelbug compromises government webmail accounts and exfiltrates large volumes of data, including over 2,300 email bodies and 580,000 browser cookies. Jewelbug targets government and military organizations in the Middle East, Southeast Asia, and South Asia. Jewelbug’s recent campaign used public Google Docs to store obfuscated payloads, blending malicious activity into normal cloud traffic.
Cl0p claims Oracle bug-led corporate thefts
Cl0p is a ransomware-and-extortion group suspected to originate from Eastern Europe and primarily motivated by financial gain. Cl0p leverages zero-day vulnerabilities in Oracle’s E-Business Suite to conduct data-theft attacks, using “steal-and-threaten” tactics instead of encryption. Cl0p claims to have compromised nearly 50 companies, including Shell, Philips, GE, and Fiserv, and exfiltrated 89GB from Shell and 13.5GB from Philips. Cl0p targets large enterprises that standardize on Oracle platforms. The campaign highlights the risk of widespread compromise when a single vulnerability affects multiple organizations. Shell is investigating a potential incident, while Philips reported containing an attempted attack with no customer impact.
ShinyHunters exploited PeopleSoft zero-day at universities
ShinyHunters (also tracked as UNC6040 and UNC 6240) is a threat group suspected to originate from Eastern Europe, known for social engineering and data theft. ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft to gain unauthenticated remote code execution before a patch was available. ShinyHunters used stolen credentials for lateral movement and exfiltrated sensitive data from over 100 organizations, primarily in higher education. ShinyHunters targeted universities, with the University of Nottingham confirming a breach that exposed about 455,000 email addresses and personal information. Oracle scored the flaw at 9.8, while the Zero Day Initiative listed it at 9.3. Oracle’s guidance includes applying the emergency patch and monitoring for compromise tied to the PeopleSoft hub service.
Frequently Asked Questions
What is Evooo1Bot? Evooo1Bot is a newly identified Mirai-based Linux botnet that turns internet-facing edge devices into persistent proxies, giving operators a ready-made relay network. It spreads by exploiting a long list of known flaws—CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, and CVE-2025-10123—then uses a loader script to download and run binaries matched to the victim device’s CPU architecture.
What is Dysphoria? Dysphoria has grown into an IoT botnet of about 296,000 compromised devices, ranging from consumer routers and DVRs to cameras and small-office gateways. It spreads by exploiting known vulnerabilities and weak authentication, then converts devices into a DDoS-capable fleet and a decentralized relay/residential-proxy ecosystem.
What is AmnesiaStealer? AmnesiaStealer is a Rust-based macOS infostealer that arrives through a counterfeit GitHub download page and is tied to the recent ClickFix-style attacks that coax users into running a Terminal command. It uses a three-stage infection chain that starts with a shell script fetching and executing the payload, then relies on a LaunchDaemon for persistence while attempting a TCC bypass via CVE-2020-9771.
What is CVE-2026-35273? Attackers used a zero-day in Oracle PeopleSoft Environment Management Hub to run code remotely on vulnerable servers without a login (CVE-2026-35273; CVSS 9.8 per Oracle, 9.3 per the Zero Day Initiative). In plain terms, the bug can hand an outsider direct control of a PeopleSoft server, opening the door to data theft and deeper compromise across campus networks.
What is GeoServer? An unpatched SQL injection zero-day in GeoServer has been disclosed that can potentially be pushed into remote code execution, putting exposed mapping servers at risk of takeover. For affected organizations, that can translate into unauthorized access, data exposure, and attackers using the server as a foothold for further intrusion.
What is CVE-2026-55040? A critical Microsoft SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) is being used against targets after Rapid7 published proof-of-concept code, raising the odds of fast, copycat exploitation. The flaw allows attackers to sidestep normal access checks and act as a SharePoint user or administrator, enabling file disclosure and data tampering on vulnerable servers.
What is Jewelbug? Jewelbug, a suspected espionage-and-fraud threat group, is running two tracks at once: breaking into government webmail while also pushing victims toward fake cryptocurrency exchange sites. They compromised webmail accounts across 15 government tenants and used their access to pull large volumes of data, including more than 2,300 exfiltrated email bodies alongside thousands of captured credentials and 580,000 stolen browser cookies.
What is Cl0p? Cl0p, a ransomware-and-extortion group focused on financial gain, is claiming a fresh wave of data-theft attacks tied to a zero-day in Oracle’s E-Business Suite and says it has hit nearly 50 companies. Rather than locking systems, they are leaning on “steal-and-threaten” pressure, naming large firms including Shell, Philips, GE, and Fiserv as victims.
What is ShinyHunters? ShinyHunters, a threat group known for social engineering, was blamed for actively exploiting a critical Oracle PeopleSoft zero-day (CVE-2026-35273) to gain unauthenticated remote code execution before an emergency fix was available. The campaign ran from May 27 to June 9, 2026 and reportedly affected over 100 organizations, primarily in higher education, with the group using stolen credentials for lateral movement and then exfiltrating sensitive data.