Tag: backdoor
-
WooCommerce admins targeted by fake security patches that hijack sites
A large-scale phishing campaign targets WooCommerce users with a fake security alert urging them to download a “critical patch” that adds a WordPress backdoor to the site. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/woocommerce-admins-targeted-by-fake-security-patches-that-hijack-sites/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 43
Tags: attack, backdoor, botnet, china, crypto, fraud, infrastructure, international, malware, nfc, rust, supply-chainSecurity Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Inside Gamaredon’s PteroLNK: Dead Drop Resolvers and evasive Infrastructure XRP supply chain attack: Official NPM package infected with crypto stealing backdoor SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation New Rust Botnet >>RustoBot
-
Three-Year Go Module Mirror Backdoor Exposed: Supply Chain Attack
Discover how a backdoored Go package exploited the module mirror for 3+ years. Learn vital security practices to safeguard your code. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/04/three-year-go-module-mirror-backdoor-exposed-supply-chain-attack/
-
SAP NetWeaver 0-Day Vulnerability Enables Webshell Deployment
Cybersecurity analysts have issued a high-priority warning after several incidents revealed active exploitation of SAP NetWeaver, the widely deployed enterprise integration platform. Attackers have leveraged an unreported 0-day vulnerability to deploy web shells, which give them remote command execution capabilities and persistent backdoor access even on fully patched systems. CVE Details The exposure centers around…
-
Backdoor Found in Official XRP Ledger NPM Package
XRP Ledger SDK hit by supply chain attack: Malicious NPM versions stole private keys; users urged to update… First seen on hackread.com Jump to article: hackread.com/backdoor-found-in-official-xrp-ledger-npm-package/
-
China-linked APT Mustang Panda upgrades tools in its arsenal
China-linked APT group Mustang Panda deployed a new custom backdoor, MQsTTang, in recent attacks targeting Europe, Asia, and Australia. China-linked APT group Mustang Panda (aka Camaro Dragon, RedDelta or Bronze President). deployed a new custom backdoor, tracked as MQsTTang, in recent attacks targeting entities in Europe, Asia, and Australia. Mustang Panda has been active since…
-
Toll of symlink backdoor-compromised Fortinet devices increases
First seen on scworld.com Jump to article: www.scworld.com/brief/toll-of-symlink-backdoor-compromised-fortinet-devices-increases
-
China-linked BRICKSTORM backdoor involved in Europe-targeted cyberespionage
First seen on scworld.com Jump to article: www.scworld.com/brief/china-linked-brickstorm-backdoor-involved-in-europe-targeted-cyberespionage
-
Novel BPFDoor backdoor component facilitates covert attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/novel-bpfdoor-backdoor-component-facilitates-covert-attacks
-
Florida draft law mandating encryption backdoors for social media accounts billed ‘dangerous and dumb’
A digital rights group blasted the Florida bill, but lawmakers voted to advanced the draft law. First seen on techcrunch.com Jump to article: techcrunch.com/2025/04/17/florida-draft-law-mandating-encryption-backdoors-for-social-media-accounts-billed-dangerous-and-dumb/
-
Your Network Is Showing Time to Go Stealth
Tags: access, ai, attack, authentication, backdoor, breach, china, cisco, cloud, computer, control, credentials, cyberattack, cybersecurity, data, data-breach, defense, detection, encryption, endpoint, exploit, firewall, firmware, fortinet, group, Hardware, infrastructure, mfa, network, software, theft, threat, tool, update, vpn, vulnerability, zero-day -
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
The China-linked threat actor known as Mustang Panda has been attributed to a cyber attack targeting an unspecified organization in Myanmar with previously unreported tooling, highlighting continued effort by the threat actors to increase the sophistication and effectiveness of their malware.This includes updated versions of a known backdoor called TONESHELL, as well as a new…
-
Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools
The China-sponsored hacking group, Mustang Panda, has been uncovered by Zscaler ThreatLabz to employ new techniques and tools, including the updated backdoor ToneShell and a novel tool named StarProxy, to evade endpoint detection and response (EDR) systems. Mustang Panda’s New Techniques Mustang Panda, known for targeting government and military entities primarily in East Asia, has…
-
Russia-linked APT29 targets European diplomats with new malware
WINELOADER variant: While the Check Point researchers didn’t manage to obtain the final payload delivered by GRAPELOADER directly, they located a new variant of the WINELOADER backdoor that was uploaded to the VirusTotal scanning service around the same time and which has code and compilation time similarities to both AppvIsvSubsystems64.dll and ppcore.dll. As such, there…
-
Over 16,000 Fortinet devices compromised with symlink backdoor
Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/
-
China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks
Researchers discovered new variants of the malware, which is tied to a China-nexus threat group, targeting Windows environments of critical infrastructure networks in Europe. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/china-linked-hackers-brickstorm-backdoors-european-networks
-
Latest Mustang Panda Arsenal: ToneShell and StarProxy – P1
IntroductionThe Zscaler ThreatLabz team discovered new activity associated with Mustang Panda, originating from two machines from a targeted organization in Myanmar. This research led to the discovery of new ToneShell variants and several previously undocumented tools. Mustang Panda, a China-sponsored espionage group, traditionally targets government-related entities, military entities, minority groups, and non-governmental organizations (NGOs) primarily…
-
China-Backed Hackers Exploit BRICKSTORM Backdoor to Spy on European Businesses
NVISO discovered new variants of the BRICKSTORM backdoor, initially designed for Linux, on Windows systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-hackers-brickstorm-backdoor/
-
New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks
Cybersecurity researchers have unearthed a new controller component associated with a known backdoor called BPFDoor as part of cyber attacks targeting telecommunications, finance, and retail sectors in South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024.”The controller could open a reverse shell,” Trend Micro researcher Fernando Mercês said in a technical report published earlier…
-
Chinese Hackers Unleash New BRICKSTORM Malware to Target Windows and Linux Systems
A sophisticated cyber espionage campaign leveraging the newly identified BRICKSTORM malware variants has targeted European strategic industries since at least 2022. According to NVISO’s technical analysis, these backdoors previously confined to Linux vCenter servers now infect Windows environments, employing multi-tiered encryption, DNS-over-HTTPS (DoH) obfuscation, and cloud-based Command & Control (C2) infrastructure to evade detection. The…
-
BRICKSTORM Backdoor Targets European Industries
In a recent technical expose, NVISO sheds light on BRICKSTORM, a stealthy espionage backdoor attributed to the China-nexus First seen on securityonline.info Jump to article: securityonline.info/brickstorm-backdoor-targets-european-industries/
-
European Companies Infected With New Chinese-Nexus Backdoor
Threat Actors Deploy Obfuscation Tactics to Targets Windows Machines. Likely Chinese nation-state hackers are targeting European companies using previously unseen malware backdoor variants with advanced network tunneling and evasion capabilities for data theft. Brussels-based security firm Nviso links the campaign to a threat actor tracked as UNC5221. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/european-companies-infected-new-chinese-nexus-backdoor-a-28009
-
Wave of Wine-Inspired Phishing Attacks Targets EU Diplomats
Russia-backed APT29’s latest campaign once again uses malicious invites to wine-tasting events as its lure, but this time targets a different set of vintages, errr, victims, and delivers a novel backdoor, GrapeLoader. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/wine-inspired-phishing-eu-diplomats
-
BPFDoor Malware Uses Reverse Shell to Expand Control Over Compromised Networks
A new wave of cyber espionage attacks has brought BPFDoor malware into the spotlight as a stealthy and dangerous tool for compromising networks. According to security experts at Trend Micro, BPFDoor is a state-sponsored backdoor attributed to the advanced persistent threat (APT) group known as Earth Bluecrow (also referred to as Red Menshen). This malware…
-
Fortinet Issues Fixes After Attackers Bypass Patches to Maintain Access
Hackers exploit Fortinet flaws to plant stealth backdoors on FortiGate devices, maintaining access even after patches. Update to… First seen on hackread.com Jump to article: hackread.com/fortinet-fixe-attackers-bypass-patches-maintain-access/
-
Ransomware-Attacken stoßen in Windows-Lücke
Tags: access, backdoor, bug, cve, cvss, cyberattack, exploit, kaspersky, malware, microsoft, ransomware, update, vulnerability, windowsCyberkriminelle missbrauchen eine Sicherheitslücke in Windows, um eine Backdoor-Malware und Ransomware einzuschleusen.Sicherheitsforscher von Microsoft haben eine Schwachstelle im CLFS-Treiber (Common Log File System) von Windows entdeckt, die Angreifern Systemrechte verleiht. Sie wird als CVE-2025-29824 geführt, die mit einem CVSS-Wert von 7,8 über einen hohen Schweregrad verfügt.Laut einem Blogbeitrag der Forscher wurde die Lücke bereits für…
-
Ihr werdet den Tag nie vergessen, an dem ihr FamousSparrow geschnappt habt
ESET Forscher decken Werkzeuge der APT-Gruppe FamousSparrow auf. Darunter sind zwei nicht dokumentierte Versionen der von der Gruppe entwickelten Backdoor “SparrowDoor”. First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/ihr-werdet-den-tag-nie-vergessen-an-dem-ihr-famoussparrow-geschnappt-habt/
-
Dino-Malware Analyse eines weiteren Spionage-Cartoons
Nach Casper, Bunny und Babar haben wir einen weiteren Spionage-Cartoon entdeckt, der von seinen Entwicklern Dino genannt wird. Hierbei handelt es sich um einen ausgeklügelten Backdoor-Trojaner, der vermutlich von der bereits bekannten Hacker-Gruppe ‘Animal Farm” entwickelt wurde, die auch hinter den anderen Spionage-Cartoons stecken. First seen on welivesecurity.com Jump to article: www.welivesecurity.com/deutsch/2015/06/30/dino-malware-analyse-eines-weiteren-spionage-cartoons/
-
UK-Apple backdoor hearing should be public, tribunal rules
First seen on scworld.com Jump to article: www.scworld.com/brief/uk-apple-backdoor-hearing-should-be-public-tribunal-rules