Tag: backdoor
-
MoustachedBouncer: Spionage gegen ausländische Diplomaten in Belarus
ige Spionage gegen Diplomaten, Nutzung von E-Mail-basierten C&C-Protokollen, modularen C++-Backdoors und Adversary-in-the-Middle (AitM)-Angriffen… K… First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/moustachedbouncer-spionage-gegen-auslaendische-diplomaten-in-belarus/
-
Sponsor mit Schnurrhaaren: Ballistic Bobcats Scan- und Strike-Backdoor
Tags: backdoorFirst seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/sponsor-mit-schnurrhaaren-ballistic-bobcats-scan-und-strike-backdoor/
-
Stealth Falcon fällt mit Deadglyph über den Nahen Osten her
Tags: backdoorcher haben Deadglyph entdeckt, eine ausgeklügelte Backdoor, die von der berüchtigten Stealth Falcon-Gruppe zur Spionage im Nahen Osten eingesetzt wird… First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/stealth-falcon-fallt-mit-deadglyph-uber-den-nahen-osten-her/
-
Turla APT Exploits New Backdoors to Infiltrate the EU Ministry of Defense
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/turla-apt-exploits-new-backdoors-to-infiltrate-the-eu-ministry-of-defense/
-
Kimsuky APT Group Deploys New Linux Backdoor: Gomir
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/kimsuky-apt-group-deploys-new-linux-backdoor-gomir/
-
New Backdoor Used By Iranian State-Sponsored Group
The backdoor is being used for intelligence gathering campaigns against U.S. organizations in the government, communications equipment, oil and gas an… First seen on duo.com Jump to article: duo.com/decipher/new-backdoor-used-by-iranian-state-sponsored-group
-
New Backdoor Linked to Earth Lusca Threat Group
Researchers have uncovered a new backdoor called KTLVdoor, which is written in the Go language, has versions for targeting Windows and Linux and is li… First seen on duo.com Jump to article: duo.com/decipher/new-backdoor-linked-to-chinese-threat-group
-
Code found online exploits LogoFAIL to install Bootkitty Linux backdoor
Unearthed sample likely works against Linux devices from Acer, HP, Fujitsu, and Lenovo. First seen on arstechnica.com Jump to article: arstechnica.com/security/2024/11/code-found-online-exploits-logofail-to-install-bootkitty-linux-backdoor/
-
ANEL Backdoor Reactivated in Earth Kasha Cyber-Espionage Campaign
In June 2024, Trend Micro identified a new spear-phishing campaign targeting political organizations, research institutions, and think tanks in Japan. This operation, attributed to the cyber-espionage group Earth Kasha, marks... First seen on securityonline.info Jump to article: securityonline.info/anel-backdoor-reactivated-in-earth-kasha-cyber-espionage-campaign/
-
SMOKEDHAM Backdoor: UNC2465’s Stealth Weapon for Extortion and Ransomware Campaigns
A comprehensive analysis by TRAC Labs has shed light on the SMOKEDHAM backdoor, a malicious tool leveraged by the financially motivated threat actor UNC2465. Active since 2019, SMOKEDHAM plays a... First seen on securityonline.info Jump to article: securityonline.info/smokedham-backdoor-unc2465s-stealth-weapon-for-extortion-and-ransomware-campaigns/
-
Salt Typhoon’s surge extends far beyond US telcos
Plus, a brand-new backdoor, GhostSpider, is linked to the cyber-spy crew’s operations First seen on theregister.com Jump to article: www.theregister.com/2024/11/27/salt_typhoons_us_telcos/
-
Russian APT RomCom combines Firefox and Windows zero-day flaws in drive-by exploit
Tags: access, antivirus, apt, attack, backdoor, browser, business, computer, cve, cybercrime, cyberespionage, defense, endpoint, exploit, flaw, germany, government, group, insurance, intelligence, malicious, microsoft, msp, password, powershell, russia, software, threat, ukraine, vulnerability, windows, zero-dayA Russia-aligned group that engages in both cybercrime and cyberespionage operations used a zero-click exploit chain last month that combined previously unknown and unpatched vulnerabilities in Firefox and Windows.The campaign, whose goal was to deploy the group’s RomCom backdoor on computers, targeted users from Europe and North America. The APT group, also known as Storm-0978,…
-
Russian Hackers Exploit Firefox and Windows 0-Days to Deploy Backdoor
Watch out for the Russian hackers from the infamous RomRom group, also known as Storm-0978, Tropical Scorpius, or UNC2596, and their use of a custom backdoor. First seen on hackread.com Jump to article: hackread.com/russian-hackers-firefox-windows-0-days-backdoor/
-
APT60 Exploits WPS Office Vulnerability to Deploy SpyGlace Backdoor
The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor.That’s according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google Drive, Bitbucket, and StatCounter. The attack was carried out around August…
-
Hackers Exploit Firefox and Windows Flaws: RomCom’s Advanced Attack Unveiled
A Russia-aligned hacking group, known as RomCom (also identified as Storm-0978, Tropical Scorpius, or UNC2596), has successfully exploited two zero-day vulnerabilities”, one in Mozilla Firefox and another in Microsoft Windows Task Scheduler. These vulnerabilities, identified as CVE-2024-9680 and CVE-2024-49039, were chained together to allow the group to execute arbitrary code and install malicious backdoors on…
-
Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets
The Russia-linked RomCom APT has been observed chaining two zero-days in Firefox and Windows for backdoor delivery. The post Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/russian-apt-chained-firefox-and-windows-zero-days-against-us-and-european-targets/
-
RomCom Hackers Exploits Windows Firefox Zero-Day in Advanced Cyberattacks
In a new wave of cyberattacks, the Russia-aligned hacking group >>RomCom>The compromise chain is composed of a […] The post RomCom Hackers Exploits Windows & Firefox Zero-Day in Advanced Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform. First seen on gbhackers.com Jump to article: gbhackers.com/romcom-hackers-exploits-windows-firefox-zero-day/
-
Chinese APT Hackers Using Multiple Tools And Vulnerabilities To Attack Telecom Orgs
Tags: apt, attack, backdoor, china, control, cyber, exploit, government, group, hacker, infrastructure, rat, tool, vulnerabilityEarth Estries, a Chinese APT group, has been actively targeting critical sectors like telecommunications and government entities since 2023. They employ advanced techniques, including exploiting vulnerabilities, lateral movement, and deploying multiple backdoors like GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, which have impacted Southeast Asia significantly. The group makes use of a sophisticated command and control infrastructure…
-
Aggressive Chinese APT Group Targets Governments with New Backdoors
A Trend Micro analysis of Earth Estries found that the Chinese threat actor is using new backdoors to avoid detection during espionage operations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-apt-governments-backdoors/
-
Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries
The China-linked threat actor known as Earth Estries has been observed using a previously undocumented backdoor called GHOSTSPIDER as part of its attacks targeting Southeast Asian telecommunications companies. Trend Micro, which described the hacking group as an aggressive advanced persistent threat (APT), said the intrusions also involved the use of another cross-platform backdoor dubbed First…
-
RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks
The Russia-aligned threat actor known as RomCom has been linked to the zero-day exploitation of two security flaws, one in Mozilla Firefox and the other in Microsoft Windows, as part of attacks designed to deliver the eponymous backdoor on victim systems.”In a successful attack, if a victim browses a web page containing the exploit, an…
-
RomCom hackers chained Firefox and Windows zero-days to deliver backdoor
Russia-aligned APT group RomCom was behind attacks that leveraged CVE-2024-9680, a remote code execution flaw in Firefox, and CVE-2024-49039, an elevation of privilege … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/26/romcom-backdoor-cve-2024-9680-cve-2024-49039/
-
Salt Typhoon hackers backdoor telcos with new GhostSpider malware
The Chinese state-sponsored hacking group Salt Typhoon has been observed utilizing a new “GhostSpider” backdoor in attacks against telecommunication service providers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/salt-typhoon-hackers-backdoor-telcos-with-new-ghostspider-malware/
-
WolfsBane Chinesische Hacker bauen Backdoors in Linux ein
First seen on security-insider.de Jump to article: www.security-insider.de/neue-linux-backdoor-wolfsbane-cybersecurity-bericht-a-b6f2d35625113cea670df3d992bcc192/
-
WolfsBane: Gelsemium APT Group’s Linux Backdoor Debut
ESET researchers have unveiled WolfsBane, the Linux counterpart to the Windows-based Gelsevirine backdoor, marking a significant milestone in the evolution of the Gelsemium Advanced Persistent Threat (APT) group. Known for... First seen on securityonline.info Jump to article: securityonline.info/wolfsbane-gelsemiums-linux-backdoor-debut/
-
1,000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole
PAN-PAN! Intruders inject web shell backdoors, crypto-coin miners, more First seen on theregister.com Jump to article: www.theregister.com/2024/11/22/palo_alto_firewalls_under_exploit/
-
Week in review: 0-days exploited in Palo Alto Networks firewalls, two unknown Linux backdoors identified
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 2,000 Palo Alto Networks devices compromised in latest attacks Attackers have … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/24/week-in-review-0-days-exploited-in-palo-alto-networks-firewalls-two-unknown-linux-backdoors-identified/
-
China-linked APT Gelsemium uses a new Linux backdoor dubbed WolfsBane
China-linked APT Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane in attacks targeting East and Southeast Asia. China-linked APT Gelsemium has deployed a previously unknown Linux backdoor, WolfsBane, in attacks targeting East and Southeast Asia, according to ESET. Victims include entities in Taiwan, the Philippines, and Singapore, as seen in VirusTotal samples from…
-
Tickt in der frei verfügbaren Open-Source-Software eine Security-Zeitbombe?
Open-Source: Meldungen, dass Cyberkriminelle Open-Source-Software mit gefährlichen Exploits oder Backdoors infiltrieren, häufen sich. Tickt in der frei verfügbaren Software eine Security-Zeitbombe? Wie können sich insbesondere Entwickler vor gefährlichen Backdoors oder Malware schützen? Netzpalaver hat zu dieser Fragestellung einige Statements aus der Netzpalaver-Community eingefangen, die sukzessive nachfolgend veröffentlicht werden. Statement von Harold Butzbach, Sysdig Statement […]…
-
DEF CON 32 The XZ Backdoor Story: The Undercover Op That Set the Internet on Fire
Authors/Presenters: # Thomas Roccia Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/def-con-32-the-xz-backdoor-story-the-undercover-op-that-set-the-internet-on-fire/