Backdoor

Updated on 2023-01-05: New WordPress backdoor Dr.Web researchers have found a new exploit tool designed to attack WordPress sites, infect them with a backdoor, and then inject malicious scripts in their codebase. The malware targets vulnerabilities in more than 30 WordPress themes and plugins and exclusively targets Linux-based servers. Read more: Linux backdoor malware infects …

Updated on 2023-01-11 SF BART ransomware The San Francisco Bay Area Rapid Transit (BART) is investigating an intrusion of its IT network after the Vice Society ransomware gang claimed to have compromised the agency via a blog post on their dark web leak site. The agency’s spokesperson told The Record that “no BART services or …

Updated on 2022-12-02 AquaSec researchers have spotted a new malware strain named Redigo that is currently being used to attack and infect Redis database servers. Redigo is written in the Go programming language and leverages an exploit for the CVE-2022-0543 vulnerability to compromise unpatched Linux servers. AquaSec said Redigo-infected servers are being added to a …

Updated on 2022-12-08: North Korea’s APT37 Hackers Exploited Internet Explorer JScript9 Engine Zero-Day Hackers linked to North Korea have been exploiting a zero-day type-confusion vulnerability in Internet Explorer’s JScript9 engine. Google’s Project Zero detected the vulnerability, which affects Windows 7 though 11 and Windows Server 2008 through 2022 prior to patches Microsoft released in November. …

Updated on 2022-11-29 US cybersecurity firm Mandiant has discovered a new cyber-espionage group that is heavily active in the Southeast Asian region, where it has targeted public and private sector entities using a novel piece of malware that is currently being spread via infected USB devices. Mandiant said it tracks the group under the temporary …

Updated on 2022-11-04 BlackBerry’s security team has a technical report on a suspected nation-state operation that appears to be using a backdoor typically employed by the cybercrime ecosystem to go after targets in Ukraine and the United Kingdom. This campaign, first spotted by CERT-Ukraine, is using cloned websites for popular enterprise software tools like SolarWinds …

Updated on 2022-10-30: ShadowPad C2 servers In a report last week, the VMware security team said they found more than 80 command and control servers for ShadowPad, a backdoor trojan typically used in intrusions by Chinese state-sponsored hacking groups. VMware said it identified the servers after it analyzed the ShadowPad command and control protocol for …

Updated on 2022-10-19: Windows PowerShell Backdoor Researchers from SafeBreach Labs have found a PowerShell backdoor that masquerades as part of the Windows Update process. The backdoor is being actively exploited to exfiltrate data. SafeBreach’s advisory includes a list of indicators of compromise. Note An interesting find and certainly new and different which makes it difficult …

Updated on 2022-12-29 K7 has a report out on recent Lazarus APT operations, namely, one baiting users with job vacancies at Coinbase that try to infect victims with macOS malware. Read more: Lazarus APT’s Operation Interception Uses Signed Binary Updated on 2022-12-26 The Lazarus threat group is linked to a massive phishing campaign that targeted …