Masjesu botnet targets IoT devices while evading high-profile networks
2026-04-09T14:51:45Z•98a5330fc6d0ba9b0f814ed5231be7c432d8bcb868baf8973ec3c8fb99193f07
AI-securityAPT28AnthropicCISACVE-2025-59528CVE-2026-1340Claude-MythosDDoS-for-hireFlowiseICSIoTIran-linked-actorsIvanti EPMMModbusPLC-targetingPRISMEXSCADAbotnetdata-exfiltrationfinancial-outagehealthcare-cyberattackhospital-attackremote-code-executionrisky-exposed-devicessupercomputing
What happened
Multiple high-impact cyber incidents and warnings reported: a stealthy DDoS‑for‑hire IoT botnet (Masjesu) targeting routers/gateways and avoiding high‑profile networks; an alleged massive theft (>10 PB) of military/aerospace data from China’s National Supercomputing Center; growing exposure of ICS/SCADA devices and insecure protocols (e.g., Modbus) that raise risks to critical infrastructure; CISA added a critical Ivanti EPMM code‑injection flaw (CVE-2026-1340, CVSS 9.8) to its Known Exploited Vulnerabilities catalog; Russia‑linked APT28 is deploying PRISMEX malware against Ukraine and allied‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 98a5330fc6d0ba9b0f814ed5231be7c432d8bcb868baf8973ec3c8fb99193f07
- Enrichment time
- 2026-04-09T14:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.