Quad7 Botnet Expands Targeting SOHO Routers, VPN Appliances; Selenium Grid Hit by Cryptomining

The Quad7 botnet operation is expanding its targeting and infrastructure, now focusing on SOHO routers and VPN appliances. The operators have unveiled new moves with advanced HTTP reverse shells. Additionally, hackers are exploiting Selenium Grid servers to deploy cryptomining and proxyjacking scripts. Researchers from Cado Security discovered two campaigns targeting these servers due to their default no-auth settings, making them prime targets for such attacks. The campaigns were reported by The Hacker News and darkreading.