Honeypots Capture New Danfoss Device Attack Wave, Possibly Tied to Recent Campaign
cyb3rops · x · 2026-11-04
Security researcher @felixaime reports that SEKOIA captured an attack on four different honeypots on Sunday at 10 PM, potentially linked to the latest wave targeting connected devices. Unlike the earlier "code of the day" exploit, this one leveraged a different unauthenticated vulnerability.
The screenshot shows source IPs 178.83.226.215 (AS214036 ULTAHOST-AS) and 37.16.75.128 (AS43641 SOLLUTIUM-NL) firing HTTP POST requests at Danfoss API endpoints, all blocked by the firewall, with request bodies containing write-list configuration actions.
More from Safety
- Postman installer silently adds Codex/Claude Code plugins and tries to self-approve its hook — Future_AGI · 2026-11-04
- Copyright Alliance files amicus brief arguing no categorical fair use for AI training in OpenAI case — TuhinChakr · 2026-11-04
- Lean4 formalization: hash-based signature security drops to 122 bits under conservative accounting — jedisct1 · 2026-11-04
- Anthropic's FlashProve prototype uses cryptography to verify which model wrote an AI response — The Decoder · 2026-11-04
- AI policy after the election: legislative reset, hearings, and a likely market correction — ShakeelHashim · 2026-11-04
- New paper: reasoning models' CoT is far more controllable than evals suggest, usable to evade monitors — LChoshen · 2026-11-04