Recent cybersecurity activity highlights two rapidly evolving threats targeting both infrastructure and software ecosystems. The C0XMO botnet is actively exploiting a known vulnerability in DD-WRT router firmware, allowing attackers to take control of unpatched devices without authentication and spread across routers, DVRs, and other Linux-based systems. Once inside, it scans for additional targets, uses weak credentials to expand, and launches large-scale DDoS attacks while maintaining persistence by hiding in system files and restarting itself automatically. At the same time, supply chain attacks like Miasma and IronWorm are targeting developers by abusing trusted software distribution processes. These threats spread through compromised accounts and malicious package updates, quietly stealing credentials such as API keys and cloud access tokens. It subsequently spreads to infect additional repositories and projects. What makes these campaigns especially dangerous is their ability to appear as normal activity, either routine code commits or standard dependency updates, and making detection difficult. Together, these threats demonstrate a broader shift in attacker strategy, combining infrastructure exploitation with deep infiltration of development pipelines. Ultimately increasing risk for organizations that rely on connected devices and open-source software. CTIX analysts will continue to report on the latest malware strains and attack methodologies.