Coverage: Last 24 hours

Today’s Highlights

Proxy infrastructure disruption, rapid Citrix exploit weaponization, and AI-driven attack automation dominate today’s risk landscape. Ransomware operators are leveraging new vulnerabilities across the perimeter and supply chain while autonomous agents cross the line from tool to operator. Defenders need precise detection, immediate response, and controls that adapt to nonhuman threat actors.

Table of Contents

1. FBI Seizes NetNut Proxy Platform, Popa Botnet
2. Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices
3. Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
4. AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
5. New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure
6. FortiBleed credential harvesting now confirmed as ransomware pipeline via INC and Lynx operations

Top Stories

FBI Seizes NetNut Proxy Platform, Popa Botnet

Source: Krebs on Security | Risk: Medium | Impacted: SOC teams tracking proxy infrastructure, Internet-facing service operators, Fraud detection platforms

Summary: The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at

Why it matters: Threat actors have lost access to a major proxy platform used to conceal attack infrastructure, reducing their operational anonymity and potentially exposing downstream customers who relied on that service for traffic obfuscation.

Practitioner Perspective

Any environment previously seeing attacks routed through NetNut or the Popa botnet should expect shifts to alternate proxy or VPN networks. Attribution confidence may temporarily improve as obfuscation options shrink, but adversaries will seek replacements rapidly. Consider that any ongoing investigations relying on connections through NetNut infrastructure may surface new evidence. This window presents an opportunity to update threat intelligence collections and detection rules tuned to NetNut signatures.

Recommended Actions – Purge and update detection rules referencing NetNut and Popa botnet IPs and domains in SIEM and threat intel feeds – Augment hunting playbooks for proxy-based attacker traffic to watch for migration to less-known services

Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices

Source: SecurityWeek | Risk: Medium | Impacted: Threat intelligence teams, Cloud app providers, Network security monitoring staff

Summary: NetNut rented access to millions of compromised devices, allowing cybercriminals and nation-state actors to mask their identities during attacks. The post Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices appeared first on SecurityWeek.

Why it matters: The takedown of NetNut disrupts a tool heavily relied on by both cybercriminal and nation-state actors to mask operational traffic, potentially degrading their ability to conduct stealthy attacks against enterprises and SaaS providers.

Practitioner Perspective

Enterprises that depended on detection of NetNut proxy activity should pivot to monitoring for similar patterns across new or emerging proxy services. The impact may be felt across red team operations and any legitimate use that routed through NetNut endpoints. Track how threat groups reconstitute lost capacity; the initial disruption creates noise, but adversary operations will adapt quickly. This is a brief window to leverage increased visibility before new proxy infrastructure emerges.

Recommended Actions – Identify and block residual NetNut-associated indicators per threat intel advisories – Map any legitimate business reliance on NetNut relays and transition to approved providers

Emerging Signals

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

Source: The Hacker News | Risk: Medium | Impacted: Proxy operators, Home device manufacturers, Incident response teams

Summary: Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people’s traffic. Working with the FBI, Lumen, and others, Google’s Threat Intelligence Group (GTIG) said this week it had reduced the network’s pool of usable devices by millions. Google identifies NetNut, also tracked as Popa, as a network spread across home

Why it matters: The reduction in operational relay nodes for a major botnet proxy disrupts attacker traffic flows. Security teams may briefly gain improved visibility as attackers scramble to move to alternative networks.

Practitioner Perspective

Organizations encountering high volumes of anomalous traffic have a window in which relabeled device activity can be analyzed for missed threats. Update proxy reputation models as attacker behavior adapts. Track for upsurge in alternative home relay networks.

Recommended Actions – Tune network monitoring to identify shifts in relay-based attack infrastructure – Monitor for emergence of new proxy network traffic patterns on consumer devices

Exploits & CVEs

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Source: The Hacker News | Risk: High | Impacted: DevOps teams running Langflow, Data platform security leads, Incident response teams

Summary: Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the network, then encrypting and wiping a company’s production database. Ransomware has always

Why it matters: AI-driven automation of full ransomware campaigns eliminates many of the delays and errors that slow down human operators, raising the likelihood and potential speed of large-scale compromise for any environment running vulnerable components.

Practitioner Perspective

Teams with deployments of Langflow or similar AI workflow orchestration tools should treat them as likely offensive targets, particularly where remote code execution is possible. The automation shown by the JADEPUFFER operator demonstrates that threat actors can now chain reconnaissance, credential extraction, lateral movement, and ransomware using LLMs with minimal human intervention. This shifts the RTO/RPO calculus for defenders: rapid, fully automated attacks increase the pressure on detection and containment speed. Treat every new RCE in AI-centric platforms as a top-tier incident response trigger.

Recommended Actions – Patch or isolate Langflow instances until all known RCE vulnerabilities are resolved – Monitor audit logs and endpoint telemetry near Langflow for signs of credential theft and lateral movement

New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

Source: SecurityWeek | Risk: High | Impacted: Enterprises running NetScaler appliances, Citrix administrators, Remote access infrastructure teams

Summary: Hackers are targeting NetScaler appliances using public PoC code to retrieve arbitrary memory content in the HTTP response. The post New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure appeared first on SecurityWeek.

Why it matters: Mass exploitation of perimeter appliances can yield direct access to internal networks, enabling credential dumping, privilege escalation, and lateral movement before defenders have time to patch or remediate.

Practitioner Perspective

NetScaler/Citrix administrators must recognize that PoC exploitation began immediately after disclosure, meaning lagging on patch adoption exposes internal assets to viable hands-on-keyboard attackers. This class of vulnerability (memory disclosure via HTTP response) feeds directly into ransomware and APT tradecraft. Defenders should not expect meaningful lag between public disclosure and exploitation at scale for Citrix or other high-value perimeter tech. There is no grace period for unpatched systems.

Recommended Actions – Apply latest Citrix patches closing memory disclosure in NetScaler (CitrixBleed) immediately – Search HTTP server logs for exploitation attempts tied to public CitrixBleed PoCs

FortiBleed credential harvesting now confirmed as ransomware pipeline via INC and Lynx operations

Source: SOCRadar (via SecurityWeek) | Risk: Critical | Impacted: Enterprises using Fortinet/FortiGate appliances, SOC and IR teams, MSSPs responsible for perimeter infrastructure

Summary: SOCRadar confirms FortiBleed’s harvested FortiGate credentials are feeding active ransomware deployments by INC and Lynx, with at least 12 confirmed incidents.

Why it matters: Compromised FortiGate credentials are actively feeding ransomware operations, meaning any exposed credential represents an immediate path to network-wide compromise by actors leveraging INC and Lynx campaigns.

Practitioner Perspective

Organizations with unpatched FortiGate appliances or unmanaged credentials should assume ongoing credential harvesting is being operationalized by ransomware crews. The direct connection from FortiBleed leaks to active ransomware deployments eliminates any benefit of ‘patch soon’ thinking: attackers are moving faster than most remediation windows. Coordinate closely across IT and IR to verify that all known Fortinet exposures are catalogued, contained, and investigated for post-exploitation activity. Treat confirmed credential exposure as equivalent to active foothold until proven otherwise.

Recommended Actions – Immediately rotate all credentials potentially exposed via FortiBleed on affected FortiGate units – Patch all Fortinet devices vulnerable to FortiBleed and verify successful hotfix application

Defensive Actions

• Purge and update detection rules referencing NetNut and Popa botnet IPs and domains in SIEM and threat intel feeds
• Augment hunting playbooks for proxy-based attacker traffic to watch for migration to less-known services
• Identify and block residual NetNut-associated indicators per threat intel advisories
• Map any legitimate business reliance on NetNut relays and transition to approved providers
• Patch or isolate Langflow instances until all known RCE vulnerabilities are resolved
• Monitor audit logs and endpoint telemetry near Langflow for signs of credential theft and lateral movement
• Apply latest Citrix patches closing memory disclosure in NetScaler (CitrixBleed) immediately
• Search HTTP server logs for exploitation attempts tied to public CitrixBleed PoCs
• Immediately rotate all credentials potentially exposed via FortiBleed on affected FortiGate units
• Patch all Fortinet devices vulnerable to FortiBleed and verify successful hotfix application

What We’re Watching

• The immediate aftermath of the NetNut and Popa proxy platform takedowns and where attacker traffic migrates next
• Rapid CitrixBleed exploitation and potential mass compromise waves in unpatched environments
• Ransomware developments leveraging credential theft from perimeter devices like Fortinet and Citrix
• Early indicators of AI agents chaining full-attack automation, altering the speed and chain of compromise
• Ongoing analysis of new proxy and relay services filling the gap left by industry-wide crackdowns on major platforms

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI Security, cve, cybersecurity, Identity, proxy networks, Ransomware