Eclypsium Device Threat Intel - March 2026

**Executive Summary:** Eclipsium reports discovery of two active campaigns targeting network devices and servers: a previously undocumented multi-architecture CondiBot DDoS variant that infects Linux-based network equipment and kills competing botnets, and the Monaco SSH scanner/cryptominer that brute-forces SSH credentials to deploy Monero miners; the report includes technical indicators (hashes, C2 IPs/ports), attack mechanisms, YARA rules, and recommendations to improve device-level visibility and integrity.