Ankura CTIX FLASH Update – June 10, 2026

Malware Activity

Rising Threats Target Both Network Infrastructure and Software Supply Chains

Recent cybersecurity activity highlights two rapidly evolving threats targeting both infrastructure and software ecosystems. The C0XMO botnet is actively exploiting a known vulnerability in DD-WRT router firmware, allowing attackers to take control of unpatched devices without authentication and spread across routers, DVRs, and other Linux-based systems. Once inside, it scans for additional targets, uses weak credentials to expand, and launches large-scale DDoS attacks while maintaining persistence by hiding in system files and restarting itself automatically. At the same time, supply chain attacks like Miasma and IronWorm are targeting developers by abusing trusted software distribution processes. These threats spread through compromised accounts and malicious package updates, quietly stealing credentials such as API keys and cloud access tokens. It subsequently spreads to infect