Recent cybersecurity reports reveal two significant threats. First, a broad cyberattack campaign targeting popular cloud platforms like AWS and Azure has been active since late 2025. The attacker group, TeamPCP, exploits common misconfigurations in cloud tools such as Docker and Kubernetes to infiltrate servers. Their goal is to create an automated, scalable system for stealing data, deploying ransomware, mining cryptocurrencies, and maintaining control over compromised systems. They use familiar hacking techniques, installing backdoors and malware to expand their reach and sell stolen information, forming a dangerous, self-sustaining criminal network. Separately, researchers have uncovered a sophisticated espionage tool called DKnife, attributed to Chinese-linked groups by Cisco Talos since 2019. DKnife operates on Linux devices and stealthily monitors and hijacks network traffic across various devices, including smartphones and IoT gadgets. It can steal login credentials, deliver malware, and intercept app updates, all while remaining hidden. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- TheHackerNews: TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure article
- BleepingComputer: DKnife Linux Toolkit Hijacks Router Traffic To Spy, Deliver Malware article
- TheHackerNews: China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery article
- SecurityWeek: Malware & Threats‘DKnife’ Implant Used by Chinese Linked Threat Actor for Adversary-in-the-Middle Attacks article
- InfoSecurityMagazine: Chinese-Linked Malware Kit Targets Chinese-Based Routers and Edge Devices article