Nozomi Networks

CrowdStrike Joins Anthropic Critical Infrastructure Defense Program as Founding Partner

CrowdStrike has become a founding partner in Anthropic's critical infrastructure defense program, which applies artificial intelligence to protect energy, water, manufacturing, and transportation systems. The partnership was announced on October 8 and brings together 11 founding partners, including Nozomi Networks, Rockwell Automation, and Palo Alto Networks. The initiative combines access to Claude models, dedicated engineers, and threat research aimed at security providers and industrial equipment manufacturers. CrowdStrike contributes its Falcon platform, delivering security data, threat intelligence, and attacker behavior history through Falcon for XIoT, which unifies visibility across industrial and IT assets. The program builds on the existing integration of Claude within CrowdStrike's Charlotte AI assistant. Initial focus remains on identifying defensive methods that work safely and effectively in industrial settings without positioning AI as a complete solution.

Realtek Jungle SDK Flaw CVE-2021-35394 Fuels Cling Botnet Spread Across Routers

Researchers at Nozomi Networks have observed a sharp rise in exploitation attempts against CVE-2021-35394, a critical remote code execution vulnerability in the Realtek Jungle SDK. The flaw, rated 9.8 on the CVSS scale and disclosed five years ago, is being used to deploy the Cling botnet on routers and video recorders. The affected SDK is embedded in products from multiple vendors, leaving large numbers of devices exposed because firmware updates are rarely applied. Cling carries exploits for seven distinct vulnerabilities targeting Realtek, Linksys, MVPower, TBK, LB-LINK, FiberHome and China Mobile hardware. Once installed, the malware performs recursive scanning, spreads like a worm, manipulates TCP tunnels and proxies, and participates in DDoS attacks. Its command-and-control channel hides instructions inside STUN protocol transaction IDs, impersonating legitimate responses from Google public STUN servers. FortiGuard Labs has confirmed the findings and tracks the variant as ClingSTUN.