'Crystalray' Attacks Jump 10X, Using Only OSS to Steal Credentials

Crystalray is a recently observed threat actor using open-source security and offensive tools (ASN, zmap, httpx, nuclei, SSH‑Snake, Sliver, Platypus) and public PoCs to exploit critical vulnerabilities (including Confluence and several CVEs) to drop credential-stealing tools and cryptominers; researchers observed activity affecting roughly 1,800 unique IPs worldwide with hundreds of active infections, monetizing stolen credentials and modest crypto-mining proceeds.