CISA Known Exploited Vulnerabilities
Whose software is being exploited
Machine learning · text classifier
Recently exploited, and resembling ransomware targets
abuse.ch URLhaus
What malware is being handed out
Machine learning · clustering
Servers that behave like one operation
abuse.ch Feodo Tracker × Tor Project
Who is controlling the botnets
First-hand · Cowrie honeypot
Attacks on our own sensor
How this bulletin is made
From public feed to this page, every morning
- Collect. Four feeds are downloaded and published to Kafka (Redpanda), each record checked against an Avro schema.
- Land. A writer appends them to Apache Iceberg tables in S3-compatible storage, the Bronze layer: raw and never edited.
- Model. dbt builds deduplicated Silver tables and question-shaped Gold tables in DuckDB, with data tests that stop the build on a broken rule.
- Learn. scikit-learn clusters malware servers into campaigns and ranks new vulnerabilities, each model evaluated the way it is used.
- Publish. An allow-listed export writes these files. Honeypot addresses leave only as keyed pseudonyms.