Tag: backdoor
-
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories.The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person.…
-
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10.A web shell is a small file that executes any command an attacker sends via a web request, with…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts
A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume. The operation combines embedded OLE objects, sequential scripts, a Python backdoor, and Quasar RAT, linking the September 2026 activity to earlier Endpoint ransomware deployments attributed to the group. The findings indicate continuity rather than an entirely new ransomware operation.…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER MALFEX A malicious npm postinstall no advisory has caught for fourteen months Canto incognito: tracking the PoeLLM malware […]…
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/matchboil-malware-uac-0099/
-
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/
-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the…
-
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet details ClingSTUN, a Linux backdoor exploiting unpatched IoT devices and abusing public STUN servers to route traffic past NAT. FortiGuard Labs researchers spotted a Linux malware family they call ClingSTUN, and the name gives away its trick immediately. Instead of relying on a dedicated command server, the malicious code leans on STUN, the protocol…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications. First seen on darkreading.com Jump to article: www.darkreading.com/iot/clingstun-vulnerable-iot-devices-proxy-nodes
-
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor
Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes. First seen on hackread.com Jump to article: hackread.com/hackers-exploit-iot-vulnerabilities-clingstun-linux-backdoor/
-
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/smtp-linux-backdoors-network-edge/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 117
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Lunex Unmasked: A New Information Stealer Deployed Through BYOVD Storm-3168: Agentic-driven cloud attacks using compromised service principals Don’t Call Us, We’ll Call Your APIs – TraderTraitor Backdoors Resurface on Victim With No Crypto Ties…
-
Security Affairs newsletter Round 598 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Fake Zoom installer hides macOS backdoor CloudSyncD CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed Antino Backdoor Lets…
-
Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Jamf Threat Labs found CloudSyncD while doing routine scanning on VirusTotal, buried inside a disguised Zoom client. They first spotted it on September 15, clearly still under construction, and within two days watched it move…
-
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments. Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight…
-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor.The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster First…
-
Malicious Linux Implants Mimic Asian Mail Security Products
A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it’s hard to tell they’re not. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/malicious-linux-implants-mimic-asian-mail-security
-
New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords
CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers. First seen on hackread.com Jump to article: hackread.com/cloudsyncd-macos-backdoor-fake-zoom-installer-passwords/
-
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again.The backdoor has been codenamed SC after the “SC_” markers present in the injected content. Sucuri has described the malware as a “self-healing mesh”…
-
CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer
CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoor First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cloudsyncd-macos-backdoor-fake/
-
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional…