AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

100Reachable catalog records
3 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.

Review source update dates and status
  • src_dd4a4c98d64bc46b3fCollection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

The Return of the Kinsing

Canary Intelligence linked exploitation of CVE-2023-46604, CVE-2023-38646, and CVE-2025-55182 to the same Kinsing infrastructure, including a shared staging host and attacker IP first seen in the canary network on March 12, 2026. The research shows how an older malware family is still adapting by adding new exploit paths while continuing to rely on established infrastructure.

First reported Mar 26, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Novel Use of "mount" Spotted in Hikvision Attacks

VulnCheck researchers spotted a novel use of the "mount" command in real-world exploitation of Hikvision CVE-2021-36260. The attacker used NFS to drop and execute binaries, bypassing traditional download methods and evading common detection signatures. This technique has since been integrated into VulnCheck’s open-source go-exploit framework.

First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Death By 20,000 PoCs

VulnCheck’s research team shares GitHub exploit trends and other lessons learned from reviewing thousands of exploit PoCs.

First reported Aug 20, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Metro4Shell: Exploitation of React Native’s Metro Server in the Wild

VulnCheck observed in-the-wild exploitation of CVE-2025-11953 targeting exposed React Native Metro servers shortly after public disclosure. Analysis of repeated attacks shows consistent, operational payload delivery rather than opportunistic scanning. This post examines how the vulnerability was exploited and why early exploitation visibility matters for defenders.

First reported Feb 03, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

The Linuxsys Cryptominer

VulnCheck observes exploitation of CVE-2021-41773 in the wild, and attributes the attack to the Linuxsys cryptominer. The team additionally discovers that the cryptominer has been part of a long-running campaign exploiting multiple vulnerabilities with a consistent attacker methodology since at least 2021.

First reported Jul 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

SiftRanking Canary Intelligence

Canary Intelligence captures thousands of real-world exploitation attempts every day, but scale alone does not create insight. This post walks through how clustering, structured feature extraction, and SiftRank transform raw exploitation telemetry into AI-driven prioritization. The result is a repeatable workflow that surfaces high-leverage attacker activity in minutes.

First reported Mar 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Monsta FTP: An SSRF Blocklist That Forgot IPv6 Exists

VulnCheck's Initial Access Intelligence team details an unauthenticated SSRF in Monsta FTP 2.14.4, where an IPv4-only blocklist waves through the IPv4-mapped IPv6 form of the cloud metadata endpoint and bypasses both the front gate and the anti-rebinding recheck.

First reported Jul 14, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Exposing CVEs from Black Bastas' Chats

Late last week, chat logs from Black Basta became available, offering rare insight into the operations of one of the most infamous ransomware groups. This research focuses on the vulnerabilities and CVEs mentioned in these logs, with the goal of providing defenders with actionable intelligence on the tactics of Black Basta.

First reported Feb 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Zyxel HTTP Vulnerability

As a follow-up to our previous Zyxel Telnet Vulnerabilities blog, VulnCheck examines CVE-2024-40890, a recently disclosed vulnerability in the HTTP interface of many end-of-life Zyxel CPE routers.

First reported Feb 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Virtualizor: The Login Parameter That Skips the Login

VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts

First reported Sep 22, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.