SF
Company Details
Linkedin ID:
the-shadowserver-foundation
Website:
Employees number:
22
Number of followers:
9,767
NAICS:
541514
Industry Type:
Homepage:
shadowserver.org
IP Addresses:
0
Company ID:
THE_2172993
Scan Status:
In-progress
The Shadowserver Foundation Company CyberSecurity Posture
shadowserver.org
The Shadowserver Foundation is a non-profit watchdog group of security professionals that gather, track, and report on malware, botnet activity, and electronic fraud. It is the mission of the Shadowserver Foundation to improve the security of the Internet by raising awareness of the presence of compromised servers, malicious attackers, and the spread of malware. Join our Alliance - https://www.shadowserver.org/partner/
The Shadowserver Foundation A.I CyberSecurity Scoring
SF Risk Score (AI oriented)Between 700 and 749
SF
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
SF Global Score (TPRM)XXXX
SF
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
SF Company CyberSecurity News & History
Past Incidents
1
Attack Types
1
Shadowserver Foundation: FBI: BADBOX 2.0 malware victimization widespread
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: FBI Warns of Widespread BADBOX 2.0 Malware Infections Targeting Home IoT Devices The FBI has issued an alert regarding BADBOX 2.0, a sophisticated malware campaign compromising over 1 million internet-exposed home devices, primarily manufactured in China. The malware, downloaded during device setup, enables attackers to establish residential proxy networks, conduct credential stuffing attacks, and execute ad fraud. Compromised devices may exhibit deactivated Google Play Protect settings or unusual internet traffic, prompting the FBI to recommend immediate isolation and restricted network access. Users are advised to monitor network activity, download apps exclusively from official stores, and keep devices updated to mitigate risks. The advisory follows recent disclosures of other cyber threats, including the New Cosmali Loader, which infects Windows systems via typosquatted Microsoft Activation Scripts domains using malicious PowerShell scripts. Additionally, the Shai Hulud malware campaign has impacted over 25,000 repositories and hundreds of npm packages, automating developer environment compromises. Efforts to disrupt BADBOX 2.0 involved collaboration between the FBI, Google, Trend Micro, and the Shadowserver Foundation, while tools like Nezha a post-exploitation remote access trojan help attackers evade detection by blending with legitimate activity.
SF Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for SF
Incidents vs Computer and Network Security Industry Average (This Year)
No incidents recorded for The Shadowserver Foundation in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for The Shadowserver Foundation in 2026.
Incident Types SF vs Computer and Network Security Industry Avg (This Year)
No incidents recorded for The Shadowserver Foundation in 2026.
Incident History — SF (X = Date, Y = Severity)
SF cyber incidents detection timeline including parent company and subsidiaries
SF Company Subsidiaries
The Shadowserver Foundation is a non-profit watchdog group of security professionals that gather, track, and report on malware, botnet activity, and electronic fraud. It is the mission of the Shadowserver Foundation to improve the security of the Internet by raising awareness of the presence of compromised servers, malicious attackers, and the spread of malware. Join our Alliance - https://www.shadowserver.org/partner/
Loading...
SF Similar Companies
Palo Alto Networks
Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. We help address the world's greatest s
NETWORK-SECURITY-SOLUTIONS
## Our core business We manage linux / unix server infrastructures and build the efficient and secure networking environments using hardware cutting edge technologies suited to the needs of the project and the client. We believe in quality, opposed to quantity. Our company consists of highly
CrowdStrike
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data. Powered by the CrowdStrike Security Cloud and world-clas
.png)
SF CyberSecurity News
January 13, 2026 07:32 AM
100,000+ n8n Instances Exposed to Internet Vulnerable to RCE Attacks
An n8n vulnerability exposes over 100000 internet-facing instances to remote code execution, according to The Shadowserver Foundation.
December 30, 2025 08:00 AM
70,000+ MongoDB Servers Vulnerable to MongoBleed Exploit - PoC Released
MongoDB vulnerability exposes thousands of databases, allowing unauthenticated attackers to steal data from server memory.
December 22, 2025 08:00 AM
125,000 IPs WatchGuard Firebox Devices Exposed to Internet Vulnerable to 0-day RCE Attacks
The Shadowserver Foundation identified approximately 125000 WatchGuard Firebox firewall devices worldwide at risk due to a critical...
December 21, 2025 08:00 AM
100+ Cisco Secure Email Devices Exposed to Zero‑Day Exploited in the Wild
Security researchers have identified at least 120 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager devices vulnerable to a...
December 10, 2025 08:00 AM
Over 644,000 Domains Exposed to Critical React Server Components Vulnerability
The Shadowserver Foundation has released alarming new data regarding the exposure of web applications to CVE-2025-55182, a critical...
November 18, 2025 08:00 AM
Operation ENDGAME 3.0: Europol Dismantles Three Malware Networks in Major Cybercrime Sweep
Europol has dismantled a cybercrime operation tied to Elysium, Rhadamanthys, and VenomRAT malware networks, which stole millions of...
November 13, 2025 08:00 AM
Operation Endgame 3.0 Takes Down 3 Major Global Malware Networks
November 05, 2025 08:00 AM
Hackers targeting Cisco IOS XE devices with BadCandy implant
Security researchers and Australian authorities warn that exploitation activity is ongoing.
November 03, 2025 08:00 AM
Hackers Actively Scanning TCP Ports 8530/8531 for WSUS Vulnerability CVE-2025-59287
These scans represent a shift from research-related activities to what appears to be malicious reconnaissance efforts by threat actors...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
SF CyberSecurity History Information
Official Website of The Shadowserver Foundation
The official website of The Shadowserver Foundation is https://www.shadowserver.org.
The Shadowserver Foundation’s AI-Generated Cybersecurity Score
According to Rankiteo, The Shadowserver Foundation’s AI-generated cybersecurity score is 735, reflecting their Moderate security posture.
How many security badges does The Shadowserver Foundation’ have ?
According to Rankiteo, The Shadowserver Foundation currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has The Shadowserver Foundation been affected by any supply chain cyber incidents ?
According to Rankiteo, The Shadowserver Foundation has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does The Shadowserver Foundation have SOC 2 Type 1 certification ?
According to Rankiteo, The Shadowserver Foundation is not certified under SOC 2 Type 1.
Does The Shadowserver Foundation have SOC 2 Type 2 certification ?
According to Rankiteo, The Shadowserver Foundation does not hold a SOC 2 Type 2 certification.
Does The Shadowserver Foundation comply with GDPR ?
According to Rankiteo, The Shadowserver Foundation is not listed as GDPR compliant.
Does The Shadowserver Foundation have PCI DSS certification ?
According to Rankiteo, The Shadowserver Foundation does not currently maintain PCI DSS compliance.
Does The Shadowserver Foundation comply with HIPAA ?
According to Rankiteo, The Shadowserver Foundation is not compliant with HIPAA regulations.
Does The Shadowserver Foundation have ISO 27001 certification ?
According to Rankiteo,The Shadowserver Foundation is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of The Shadowserver Foundation
The Shadowserver Foundation operates primarily in the Computer and Network Security industry.
Number of Employees at The Shadowserver Foundation
The Shadowserver Foundation employs approximately 22 people worldwide.
Subsidiaries Owned by The Shadowserver Foundation
The Shadowserver Foundation presently has no subsidiaries across any sectors.
The Shadowserver Foundation’s LinkedIn Followers
The Shadowserver Foundation’s official LinkedIn profile has approximately 9,767 followers.
NAICS Classification of The Shadowserver Foundation
The Shadowserver Foundation is classified under the NAICS code 541514, which corresponds to Others.
The Shadowserver Foundation’s Presence on Crunchbase
No, The Shadowserver Foundation does not have a profile on Crunchbase.
The Shadowserver Foundation’s Presence on LinkedIn
Yes, The Shadowserver Foundation maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/the-shadowserver-foundation.
Cybersecurity Incidents Involving The Shadowserver Foundation
As of January 22, 2026, Rankiteo reports that The Shadowserver Foundation has experienced 1 cybersecurity incidents.
Number of Peer and Competitor Companies
The Shadowserver Foundation has an estimated 3,291 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at The Shadowserver Foundation ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack.
How does The Shadowserver Foundation detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with google, third party assistance with trend micro, third party assistance with shadowserver foundation, and law enforcement notified with fbi, and containment measures with device isolation, containment measures with restricted internet access, and remediation measures with evaluating network activity, remediation measures with downloading apps only from official stores, remediation measures with regularly updating devices, and communication strategy with fbi advisory..
Incident Details
Can you provide details on each incident ?
Title: BADBOX 2.0 Malware Campaign
Description: Malicious software downloaded by vulnerable devices during the setup process facilitates infection with BADBOX 2.0, which then executes commands enabling residential proxy networks, credential stuffing intrusions, and ad fraud. Over 1 million internet-exposed home devices, mostly manufactured in China, were compromised. The FBI issued an alert urging users to mitigate the threat by evaluating network activity, downloading apps only from official stores, and regularly updating devices. Potential compromise indicators include deactivated Google Play Protect settings and atypical internet traffic.
Type: malware
Attack Vector: malicious software downloaded during setupillicit PowerShell scripts via typosquatted domains
Motivation: residential proxy networkscredential stuffingad frauddata exfiltration
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
Impact of the Incidents
What was the impact of each incident ?
Incident : malware THE1766992985
Systems Affected: Over 1 million internet-exposed home devices
Which entities were affected by each incident ?
Incident : malware THE1766992985
Entity Type: IoT devices
Location: Global (primarily China-manufactured devices)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : malware THE1766992985
Third Party Assistance: Google, Trend Micro, Shadowserver Foundation.
Law Enforcement Notified: FBI
Containment Measures: device isolationrestricted internet access
Remediation Measures: evaluating network activitydownloading apps only from official storesregularly updating devices
Communication Strategy: FBI advisory
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Google, Trend Micro, Shadowserver Foundation, .
Data Breach Information
What type of data was compromised in each breach ?
Incident : malware THE1766992985
Data Exfiltration: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: evaluating network activity, downloading apps only from official stores, regularly updating devices, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by device isolation, restricted internet access and .
Lessons Learned and Recommendations
What recommendations were made to prevent future incidents ?
Incident : malware THE1766992985
Recommendations: Evaluate network activity, Download apps only from official stores, Regularly update devices, Isolate compromised devices, Restrict internet access for suspicious devicesEvaluate network activity, Download apps only from official stores, Regularly update devices, Isolate compromised devices, Restrict internet access for suspicious devicesEvaluate network activity, Download apps only from official stores, Regularly update devices, Isolate compromised devices, Restrict internet access for suspicious devicesEvaluate network activity, Download apps only from official stores, Regularly update devices, Isolate compromised devices, Restrict internet access for suspicious devicesEvaluate network activity, Download apps only from official stores, Regularly update devices, Isolate compromised devices, Restrict internet access for suspicious devices
References
Where can I find more information about each incident ?
Incident : malware THE1766992985
Source: FBI Alert
Incident : malware THE1766992985
Source: HUMAN's Satori Threat Intelligence team
Incident : malware THE1766992985
Source: BleepingComputer
Incident : malware THE1766992985
Source: SiliconANGLE
Incident : malware THE1766992985
Source: SC Media
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: FBI Alert, and Source: HUMAN's Satori Threat Intelligence team, and Source: BleepingComputer, and Source: SiliconANGLE, and Source: SC Media.
Investigation Status
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through FBI advisory.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : malware THE1766992985
Stakeholder Advisories: FBI advisory on mitigation and compromise indicators
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was FBI advisory on mitigation and compromise indicators.
Post-Incident Analysis
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Google, Trend Micro, Shadowserver Foundation, .
Additional Questions
Impact of the Incidents
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was google, trend micro, shadowserver foundation, .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was device isolationrestricted internet access.
Lessons Learned and Recommendations
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Download apps only from official stores, Restrict internet access for suspicious devices, Regularly update devices, Isolate compromised devices and Evaluate network activity.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are BleepingComputer, HUMAN's Satori Threat Intelligence team, FBI Alert, SiliconANGLE and SC Media.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was FBI advisory on mitigation and compromise indicators, .
.png)
Latest Global CVEs (Not Company-Specific)
Description
Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the `FetchUrlReader` component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in `backend.reading.allow` to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. This vulnerability is fixed in `@backstage/backend-defaults` version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later. Some workarounds are available. Restrict `backend.reading.allow` to only trusted hosts that you control and that do not issue redirects, ensure allowed hosts do not have open redirect vulnerabilities, and/or use network-level controls to block access from Backstage to sensitive internal endpoints.
Risk Information
cvss3
Base: 3.5
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Description
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 → link2 → /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users.
Risk Information
cvss3
Base: 6.3
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Description
Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access.
Risk Information
cvss3
Base: 7.1
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Description
FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.
Risk Information
cvss3
Base: 3.7
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. In order to be vulnerable, cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., `email`, `groups`), or configure custom CEL expressions that can evaluate to empty values. After OIDC token claims are processed through CEL expressions, there is no validation that the resulting `username` and `groups` values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions. This can result in privilege escalation, data exposure, and/or information disclosure. Version 0.40.0 patches the issue.
Risk Information
cvss3
Base: 5.3
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e
- https://github.com/controlplaneio-fluxcd/flux-operator/pull/610
- https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0
- https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=the-shadowserver-foundation' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
