ThreatCluster

Surge in Cyberattacks Targeting IoT and Mobile Devices in Critical Industries

First seen 11 Nov 2025, 11:18 UTC • •66

Article Content

1 / 2

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Zscaler ThreatLabz reported a significant increase in cyberattacks, with Android malware rising by 67%. Critical infrastructure sectors, particularly energy and manufacturing, experienced malware activity increases of up to 387% and 111%, respectively, as mobile and IoT devices proliferate in these environments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

More articles in this cluster (1)

Threat Graph

17 entities, 25 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Salt Typhoon
Volt Typhoon

Technique (6)

Botnet
DDoS
Malware
Phishing
Ransomware
Supply Chain Attack

Malware (3)

Gafgyt
Mirai
Mozi

Affected Platform (4)

5G networks
D-Link routers
Netgear routers
Parks Fiberlike routers

Tool (2)

Curl
wget

Relationships

Salt Typhoon uses Gafgyt
Salt Typhoon uses Mirai
Salt Typhoon uses Mozi
Volt Typhoon uses Gafgyt
Volt Typhoon uses Mirai
Volt Typhoon uses Mozi
Salt Typhoon uses Curl
Salt Typhoon uses wget
Volt Typhoon uses Curl
Volt Typhoon uses wget
Salt Typhoon uses Botnet
Salt Typhoon uses DDoS
Salt Typhoon uses Malware
Salt Typhoon uses Phishing
Salt Typhoon uses Ransomware
Volt Typhoon uses Botnet
Volt Typhoon uses DDoS
Volt Typhoon uses Malware
Volt Typhoon uses Phishing
Volt Typhoon uses Ransomware
Salt Typhoon related to Supply Chain Attack
Salt Typhoon related to 5G networks
Salt Typhoon related to D-Link routers
Salt Typhoon related to Netgear routers
Salt Typhoon related to Parks Fiberlike routers

Following this threat?

Track Salt Typhoon and Gafgyt in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits The Joint Cybersecurity Advisory JCSA-20260826-01, released on August 26, 2026, details ongoing activities by the China-linked hacking group QTFY, attributed to Nanjing Xinjiuwei Network Technology Co. Active since 2018, QTFY employs platforms like QScan and QTRouter to exploit vulnerabilities in critical…

Fire Ant Threat Actor Targets Trusted Infrastructure in 2026 The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trusted infrastructure, including Cisco routers, TACACS authentication servers, and Linux management hosts. This shift allows Fire Ant to collect credentials, traffic, and…