KadNap employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol to conceal C2 infrastructure within a peer-to-peer system. The attack begins with a shell script (aic.sh) downloaded from C2 server that creates persistence via cron job, retrieves and renames malicious ELF file to 'kad', and executes KadNap malware. The malware targets ARM and MIPS processors, connects to NTP server for time synchronization, creates hash for peer location in decentralized network, and closes SSH port 22. Infrastructure is categorized based on device type and models. Also detailed is ClipXDaemon Linux threat that targets cryptocurrency users by intercepting wallet addresses, delivered via ShadowHS framework, operates entirely in memory with process masquerading, monitors clipboard every 200ms, and avoids Wayland sessions due to security controls.