Tag: backdoor
-
PHP backdoor looks to be work of Chinese-linked APT group
Known as Glutton, researchers at QiAnXin’s XLab believe Winnti is responsible for the malware. First seen on cyberscoop.com Jump to article: cyberscoop.com/glutton-php-backdoor-winnti-apt-41-china/
-
Cleo MFT Zero-Day Exploits Are About to Escalate, Analysts Warn
Defenders running the Cleo managed file transfer are urged to be on the lookout for the Cleopatra backdoor and other indicators of an ongoing ransomware campaign, as patching details remain foggy, and no CVE has been issued. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/cleo-mft-zero-day-exploits-escalate-analysts-warn
-
New Glutton Malware Exploits Popular PHP Frameworks Like Laravel and ThinkPHP
Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States, Cambodia, Pakistan, and South Africa.QiAnXin XLab, which discovered the malicious activity in late April 2024, attributed the previously unknown malware with moderate confidence to the prolific Chinese nation-state group tracked Winnti…
-
The Zero-Detection PHP Backdoor Glutton Exposed
A discovery by XLab has detailed Glutton, a stealthy PHP backdoor targeting both traditional organizations and the cybercrime ecosystem itself. According to XLab’s analysis, Glutton represents a new generation of... First seen on securityonline.info Jump to article: securityonline.info/the-zero-detection-php-backdoor-glutton-exposed/
-
Winnti hackers target other threat actors with new Glutton PHP backdoor
The Chinese Winnti hacking group is using a new PHP backdoor named ‘Glutton’ in attacks on organizations in China and the U.S., and also in attacks on other cybercriminals. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/winnti-hackers-target-other-threat-actors-with-new-glutton-php-backdoor/
-
Thai Officials Targeted in Yokai Backdoor Campaign Using DLL Side-Loading Techniques
Thai government officials have emerged as the target of a new campaign that leverages a technique called DLL side-loading to deliver a previously undocumented backdoor dubbed Yokai.”The target of the threat actors were Thailand officials based on the nature of the lures,” Nikhil Hegde, senior engineer for Netskope’s Security Efficacy team, told The Hacker News.…
-
Cleo MFT Zero-Day Exploits Are About Escalate, Analysts Warn
Defenders running the Cleo managed file transfer are urged to be on the lookout for the Cleopatra backdoor and other indicators of an ongoing ransomware campaign, as patching details remain foggy, and no CVE has been issued. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/cleo-mft-zero-day-exploits-escalate-analysts-warn
-
Arctic Wolf beobachtet Zero-Day-Exploit von Cleo-MFT-Software
Das Threat-Intelligence-Team der Arctic Wolf Labs haben neue schadhafte Aktivitäten beobachtet. Diese stehen im Zusammenhang mit der von Huntress aufgedeckten Zero-Day-Schwachstelle in der Cleo-Managed-File-Transfer (MFT) -Software. Im Dezember 2024 beobachtete Arctic Wolf Labs eine Mass-Exploitation-Kampagne, bei der Cleo-MFT-Lösungen für den unberechtigten Fernzugriff genutzt wurden. Die Ausführungskette umfasste einen verschleierten Powershell-Stager, einen Java-Loader sowie eine Java-basierte Backdoor,…
-
Russia Used Borrowed Spyware to Target Ukrainian Troops
Secret Blizzard Used Third-party Amadey Bots to Hack Ukrainian Military Devices. A Russian state-backed hacker group used third-party data-stealing bots and possibly a backdoor used by another Russia-based threat group to infiltrate and spy on devices used by frontline Ukrainian military units, according to a report from the Microsoft threat intelligence team. First seen on…
-
Hunk Companion, WP Query Console Vulnerabilities Chained to Hack WordPress Sites
Two vulnerabilities in the Hunk Companion and WP Query Console WordPress plugins allow attackers to backdoor websites. The post Hunk Companion, WP Query Console Vulnerabilities Chained to Hack WordPress Sites appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/hunk-companion-wp-query-console-vulnerabilities-chained-to-hack-wordpress-sites/
-
Russia’s Secret Blizzard APT targets Ukraine with Kazuar backdoor
Russia-linked APT group Secret Blizzard is using Amadey Malware-as-a-Service to infect systems in Ukraine with the Kazuar backdoor. The Russia-linked APT group Secret Blizzard (aka Turla, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) was spotted using the Amadey malware to deploy the KazuarV2 backdoor on devices in Ukraine. The experts observed threat actors using the Amadey bot malware between March and April 2024. Microsoft highlights…
-
Black Hat Europe preview: Cryptographic protocol attacks and AI in the spotlight
Tags: access, ai, application-security, attack, authentication, backdoor, best-practice, computer, conference, control, cybercrime, cybersecurity, data, dns, encryption, exploit, finance, github, government, hacker, healthcare, identity, injection, Internet, LLM, malicious, microsoft, mitigation, office, open-source, radius, RedTeam, risk, service, sophos, technology, tool, training, vulnerability, vulnerability-management, windowsThis week in London Black Hat Europe will feature a diverse range of talks and presentations covering the latest developments in cybersecurity.The opening keynote on Wednesday will be delivered by Frédérick Douzet, a professor of geopolitics at the University of Paris 8, and director of the French Institute of Geopolitics research team. No preview is…
-
Earth Minotaur: MOONSHINE Exploit Kit and DarkNimbus Backdoor Threaten Multi-Platform Security
A sophisticated cyber campaign orchestrated by the threat actor Earth Minotaur has been uncovered by Trend Micro researchers, exposing their reliance on the MOONSHINE exploit kit and a previously unreported... First seen on securityonline.info Jump to article: securityonline.info/earth-minotaur-moonshine-exploit-kit-and-darknimbus-backdoor-threaten-multi-platform-security/
-
Supply chain compromise of Ultralytics AI library results in trojanized versions
Attackers have compromised Ultralytics YOLO packages published on PyPI, the official Python package index, by compromising the build environment of the popular library for creating custom machine learning models. The malicious code deployed cryptocurrency mining malware on systems that installed the package, but the attackers could have delivered any type of malware.According to researchers from…
-
More_eggs MaaS Expands Operations with RevC2 Backdoor and Venom Loader
The threat actors behind the More_eggs malware have been linked to two new malware families, indicating an expansion of its malware-as-a-service (MaaS) operation.This includes a novel information-stealing backdoor called RevC2 and a loader codenamed Venom Loader, both of which are deployed using VenomLNK, a staple tool that serves as an initial access vector for the…
-
Government agencies urged to use encrypted messaging after Chinese Salt Typhoon hack
Chinese hacking of US telecom networks raises questions about the exploitation by hostile hacking groups of government backdoors to provide lawful access to telecoms services First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366616972/Government-agencies-urged-to-use-encrypted-messaging-after-Chinese-Salt-Typhoon-hack
-
‘Earth Minotaur’ Exploits WeChat Bugs, Sends Spyware to Uyghurs
The emerging threat actor, potentially a Chinese state-sponsored APT, is using the known exploit kit Moonshine in cross-platform attacks that deliver a previously undisclosed backdoor called DarkNimbus to ethnic minorities, including Tibetans. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/earth-minotaur-exploits-wechat-bugs-spyware-uyghurs
-
Backdoor slipped into popular code library, drains ~$155k from digital wallets
Solana-web3.js code library drains private keys, giving access to user wallets. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2024/12/backdoor-slips-into-popular-code-library-drains-155k-from-digital-wallets/
-
Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor
A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs.”Earth Minotaur uses MOONSHINE to deliver the DarkNimbus backdoor to Android and Windows devices, targeting WeChat, and possibly making it a First seen on thehackernews.com…
-
Backdoor slips into popular code library, drains ~$155k from digital wallets
Solana-web3.js code library drains private keys giving access to user wallets. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2024/12/backdoor-slips-into-popular-code-library-drains-155k-from-digital-wallets/
-
ANEL and NOOPDOOR Backdoors Weaponized in New MirrorFace Campaign Against Japan
The China-linked threat actor known as MirrorFace has been attributed to a new spear-phishing campaign mainly targeting individuals and organizations in Japan since June 2024.The aim of the campaign is to deliver backdoors known as NOOPDOOR (aka HiddenFace) and ANEL (aka UPPERCUT), Trend Micro said in a technical analysis.”An interesting aspect of this campaign is…
-
European law enforcement breaks high-end encryption app used by suspects
Tags: awareness, backdoor, ciso, communications, computing, crime, crimes, cryptography, data, defense, encryption, endpoint, exploit, flaw, group, hacker, infrastructure, international, jobs, law, malware, monitoring, service, technology, threat, tool, vulnerabilityA group of European law enforcement agencies were able to crack a high-level encryption app that a group of suspects created to avoid law enforcement monitoring, according to a statement issued Tuesday by Europol. Europol, understandably, did not provide any specifics about how they broke the app, but encryption experts said that the most likely method…
-
Researchers Uncover Backdoor in Solana’s Popular Web3.js npm Library
Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3.js npm library that involved pushing two malicious versions capable of harvesting users’ private keys with an aim to drain their cryptocurrency wallets.The attack has been detected in versions 1.95.6 and 1.95.7. Both these versions are no longer available for download from…
-
Venom Spider Spins Web of New Malware for MaaS Platform
A novel backdoor malware and a loader that customizes payload names for each victim have been added to the threat group’s cybercriminal tool set. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/venom-spider-malware-maas-platform
-
Zscaler analysiert neue Backdoor-Bedrohung MadMxShell
Die Gefahr, die von dieser Malvertising-Kampagne ausgeht, zeigt ein hohes Maß an fortschrittlichen Taktiken, Techniken und Vorgehensweisen, die auf IT… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/zscaler-analysiert-neue-backdoor-bedrohung-madmxshell/a37271/
-
Iranische Angreifer missbrauchen Backdoor für SpearAngriffe
In den meisten Beispielen erstellt BugSleep eine geplante Aufgabe mit demselben Namen wie die Mutex, die die Persistenz der Malware gewährleistet. Die… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/iranische-angreifer-missbrauchen-backdoor-fuer-phishing-angriffe/a37886/