Loading story…
NANOG mailing list participants sought an accurate list of IP ranges tied to Cloud Innovation after operators reported attack traffic from Seychelles-associated networks that were now receiving transit through Cox Communications (AS22773). David Hubbard said the routing change complicated mitigation because blocking Cox would also affect substantial legitimate traffic, turning what had been a more targeted filtering problem into a broader operational risk.
The discussion also highlighted that many of the same networks appeared to be routed by AS35916 (identified in the thread as Multacom), with more specific advertisements seen via Cox, raising questions about whether Cloud Innovation and Multacom are the same entity or have a business relationship. In reply, Frank Habicht shared AFRINIC delegation data associated with identifier F368F2D0 and provided four large IPv4 CIDR blocks, while cautioning that any use of the list for blocking should be done at the operator's own risk.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
In response to the NANOG discussion, Frank Habicht shared AFRINIC delegation data tied to identifier F368F2D0 and listed four large IPv4 CIDR blocks he said were associated with Cloud Innovation, noting they should be used at one's own risk. This added concrete network ranges to the ongoing operational discussion about filtering attack traffic.
David Hubbard posted to the NANOG mailing list that some Seychelles-associated networks he considered questionable were receiving transit through Cox Communications' AS22773, complicating mitigation because blocking Cox would also affect legitimate traffic. He also said many of the same networks appeared to be routed by AS35916 (identified as Multacom), raising questions about the relationship between Cloud Innovation and Multacom.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Network operators on the NANOG mailing list said **remotely triggered black hole** (RTBH) routing remains widely used for DDoS response but is implemented inconsistently across providers, with limited documentation and no universal cross-network model. James Bensley launched surveys and a public repository to collect details on how RTBH is deployed, why operators choose it, and what security and observability tradeoffs they face, with the stated aim of informing operational guidance, a BCOP, or a possible RFC on filtering practices. Participants said RTBH can be attractive because it is simple and can quickly protect other customers by dropping traffic to an attacked destination, especially for smaller operators, but critics warned that full blackholing reduces visibility and may prolong outages by making it harder to tell when an attack has ended. Operators discussed alternatives such as downgrading attack traffic into a scavenger QoS class to preserve observability and automate recovery, while also noting that **BGP FlowSpec** is not yet a practical industry-wide replacement because of uneven vendor support, rule-compression differences, TCAM limits, and limited acceptance by upstreams, peers, and IXPs; broader anti-spoofing measures such as **uRPF** were also highlighted as important for spoofed-traffic attacks.
Jul 30, 2026
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026
Researchers disclosed **Underminr**, a CDN abuse technique that allows attackers to conceal malicious connections behind trusted, high-reputation domains hosted on shared content delivery infrastructure. Unlike classic domain fronting, the method relies on a legitimate DNS lookup to an allowed domain that resolves to a shared CDN IP, while the actual connection presents the blocked destination in the TLS `SNI` field and HTTP `Host` header, enabling cross-tenant routing that many defenses fail to detect. ADAMnetworks said it has already observed insider threats using the technique to bypass controls, and warned it could support command-and-control traffic, malware delivery, phishing, data exfiltration, and access to malicious sites. The issue is being described as an architectural weakness rather than a software flaw, with **no CVE and no simple patch**. ADAMnetworks' analysis of nearly **5 million** Tranco-ranked websites across **73 CDN providers** found roughly **42% of domains** and **33 providers** were susceptible, while broader estimates suggested the exposure could extend to **more than 88 million domains** across major platforms including **Cloudflare, Akamai, AWS CloudFront, and Fastly**. Researchers and defenders recommended deep packet inspection, validating `SNI` and `Host` header consistency, monitoring unusual traffic to reputable domains, reviewing CDN tenant isolation, and working with providers; ADAMnetworks also released a lookup tool for domain owners and an open-source monitoring tool called **Outminr**.
Jun 29, 2026