Tag: backdoor
-
1000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole
PAN-PAN! Intruders inject web shell backdoors, crypto-coin miners, more First seen on theregister.com Jump to article: www.theregister.com/2024/11/22/palo_alto_firewalls_under_exploit/
-
Novel WolfsBane backdoor leveraged in Chinese attacks against Linux systems
First seen on scworld.com Jump to article: www.scworld.com/brief/novel-wolfsbane-backdoor-leveraged-in-chinese-attacks-against-linux-systems
-
Gelsemium-Hacker: ESET warnt vor neuen Linux-Backdoors
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/gelsemium-hacker-eset-warnung-neuheit-linux-backdoors
-
Russian TAG-110 Hacked 60+ Users With HTML Loaded Python Backdoor
The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central Asia, East Asia, and Europe by deploying custom malware, HATVIBE and CHERRYSPY, to compromise government entities, human rights groups, and educational institutions. Initial access is typically gained through phishing or exploiting vulnerable web services, as the campaign’s goal is to…
-
Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations
Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India, Taiwan, and Japan, leveraging spear-phishing and exploiting vulnerabilities in public-facing applications like SSL-VPN and file storage services. The group has deployed various backdoors, including Cobalt Strike, LODEINFO, and the newly discovered NOOPDOOR, to maintain persistent access to compromised networks, which…
-
In Other News: Nvidia Fixes Critical Flaw, Chinese Linux Backdoor, New Details in WhatsApp-NSO Lawsuit
Noteworthy stories that might have slipped under the radar: Nvidia fixes vulnerability with rare ‘critical’ severity, Chinese APT’s first Linux backdoor, new details emerge from the WhatsApp-NSO lawsuit. The post In Other News: Nvidia Fixes Critical Flaw, Chinese Linux Backdoor, New Details in WhatsApp-NSO Lawsuit appeared first on SecurityWeek. First seen on securityweek.com Jump to…
-
Chinese APT Gelsemium Deploys ‘Wolfsbane’ Linux Variant
In a sign of the times, a backdoor malware whose ancestors date back to 2005 has morphed to target Linux systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/chinese-apt-gelsemium-wolfsbane-linux-variant
-
Chinese hackers target Linux with new WolfsBane malware
A new Linux backdoor called ‘WolfsBane’ has been discovered, believed to be a port of Windows malware used by the Chinese ‘Gelsemium’ hacking group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-gelsemium-hackers-use-new-wolfsbane-linux-malware/
-
Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor
The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia.That’s according to findings from cybersecurity firm ESET based on multiple Linux samples uploaded to the VirusTotal platform from Taiwan, the Philippines, and Singapore in…
-
Researchers unearth two previously unknown Linux backdoors
ESET researchers have identified multiple samples of two previously unknown Linux backdoors: WolfsBane and FireWood. The goal of the backdoors and tools discovered is … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/21/linux-backdoors-wolfsbane-firewood/
-
Rekoobe Backdoor In Open Directories Possibly Attacking TradingView Users
APT31, using the Rekoobe backdoor, has been observed targeting TradingView, a popular financial platform, as researchers discovered malicious domains mimicking TradingView, suggesting a potential interest in compromising the platform’s user community. By analyzing shared SSH keys, investigators identified additional infrastructure linked to this campaign and another open directory, highlighting the evolving tactics employed by APT31…
-
African Reliance on Foreign Suppliers Boosts Insecurity Concerns
Recent backdoor implants and cyber-espionage attacks on their supply chains have African organizations looking to diversify beyond Chinese, American tech vendors. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/african-reliance-on-foreign-suppliers-boosts-insecurity
-
How to make open source software more secure
Earlier this year, a Microsoft developer realized that someone had inserted a backdoor into the code of open source utility XZ Utils, which is used in… First seen on techcrunch.com Jump to article: techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/
-
LightSpy Spyware Operation Expands to Windows
The Chinese APT behind the LightSpy iOS backdoor has expanded its toolset with DeepData, a modular Windows-based surveillance framework. The post LightSpy Spyware Operation Expands to Windows appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/lightspy-ios-spyware-operation-expands-to-windows/
-
Blinded by Silence
Tags: access, antivirus, attack, backdoor, breach, control, credentials, crowdstrike, cybersecurity, data, defense, detection, edr, endpoint, exploit, extortion, firewall, github, malicious, malware, microsoft, mitre, monitoring, network, open-source, phone, ransomware, risk, service, siem, sophos, threat, tool, update, vulnerability, windowsBlinded by Silence: How Attackers Disable EDR Overview Endpoint Detection and Response systems (EDRs) are an essential part of modern cybersecurity strategies. EDR solutions gather and analyze data from endpoints to identify suspicious activities and provide real-time threat visibility. This allows security teams to respond quickly to incidents, investigate threats thoroughly, and mitigate the impact of…
-
Iranian Cybercriminals Target Aerospace Workers via LinkedIn
The group seeks out aerospace professionals by impersonating job recruiters, a demographic it has targeted in the past as well, then deploys the SlugResin backdoor malware. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/iranian-cybercriminals-aerospace-workers-linkedin
-
Feds Warn of Godzilla Webshell Threats to Health Sector
Stealthy Backdoor Publicly Available on GitHub Can Be Weaponized for Larger Attacks. Godzilla webshell, a Chinese-language backdoor known for its stealth and ability to execute commands and manipulate files, is now publicly available on GitHub, and federal authorities have issued a stern warning to the healthcare sector to prepare for this threat and inevitable cyberattacks.…
-
Iranian Hackers Use “Dream Job” Lures to Deploy SnailResin Malware in Aerospace Attacks
The Iranian threat actor known as TA455 has been observed taking a leaf out of a North Korean hacking group’s playbook to orchestrate its own version of the Dream Job campaign targeting the aerospace industry by offering fake jobs since at least September 2023.”The campaign distributed the SnailResin malware, which activates the SlugResin backdoor,” Israeli…
-
China’s infosec leads accuse Intel of NSA backdoor, cite chip security flaws
First seen on theregister.com Jump to article: www.theregister.com/2024/10/16/china_intel_chip_security/
-
Angreifer nutzen emulierte Linux-Umgebung als Backdoor
First seen on heise.de Jump to article: www.heise.de/news/CRON-TRAP-Emulierte-Linux-Umgebung-als-Backdoor-nach-Phishing-Angriff-10005721.html
-
Hackers Deploy CRON#TRAP for Persistent Linux System Backdoors
First seen on hackread.com Jump to article: hackread.com/hackers-crontrap-persistent-linux-system-backdoors/
-
New CRON#TRAP Malware Infects Windows by Hiding in Linux VM to Evade Antivirus
Cybersecurity researchers have flagged a new malware campaign that infects Windows systems with a Linux virtual instance containing a backdoor capable of establishing remote access to the compromised hosts.The “intriguing” campaign, codenamed CRON#TRAP, starts with a malicious Windows shortcut (LNK) file likely distributed in the form of a ZIP archive via a phishing email.”What makes…
-
Beware of phishing emails delivering backdoored Linux VMs!
Unknown attackers are trying to trick Windows users into spinning up a custom Linux virtual machine (VM) with a pre-configured backdoor, Securonix res… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/05/phishing-oneamerica-survey-linux-vm-backdoor/
-
North Korean Hackers Target macOS Users
North Korean cryptocurrency thieves caught targeting macOS with fake PDF applications, backdoors and new persistence tactics. The post North Korean Hackers Target macOS Users appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/north-korean-hackers-target-macos-users-with-fake-crypto-pdfs/
-
North Korean Hackers Target macOS Users with Fake Crypto PDFs
North Korean cryptocurrency thieves caught targeting macOS with fake PDF applications, backdoors and new persistence tactics. The post North Korean Hackers Target macOS Users with Fake Crypto PDFs appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/north-korean-hackers-target-macos-users-with-fake-crypto-pdfs/
-
Subverting LLM Coders
Really interesting research: “An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection“: Abstract: Large Language Models (LLMs) have transformed code com- pletion tasks, providing context-based suggestions to boost developer productivity in software engineering. As users often fine-tune these models for specific applications, poisoning and backdoor attacks can covertly alter…
-
Windows infected with backdoored Linux VMs in new phishing attacks
A new phishing campaign dubbed ‘CRON#TRAP’ infects Windows with a Linux virtual machine that contains a built-in backdoor to give stealthy access to c… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/windows-infected-with-backdoored-linux-vms-in-new-phishing-attacks/
-
Custom Pygmy Goat malware used in Sophos Firewall hack on govt network
UK’s National Cyber Security Centre (NCSC) has published an analysis of a Linux malware named Pigmy Goat created to backdoor Sophos XG firewall device… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/custom-pygmy-goat-malware-used-in-sophos-firewall-hack-on-govt-network/
-
Phishing Campaign Installs Backdoor-Loaded VM to Evade Antivirus and Harvest Credentials
Overview Assura, Inc. has been made aware of this attack pattern, has taken steps to detect it in our managed services, and is following the attack i… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/phishing-campaign-installs-backdoor-loaded-vm-to-evade-antivirus-and-harvest-credentials/
-
Malicious npm Packages Target Developers’ Ethereum Wallets with SSH Backdoor
Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/malicious-npm-packages-target.html