Tag: backdoor
54 articles
Attackers Hijack AOMEI Backupper's Update Servers to Deploy Backdoor
In a shocking security breach, attackers hijacked AOMEI Backupper's update servers for just a few minutes on three separate occasions, deploying a sneaky backdoor to unsuspecting users who checked for updates during that time. This tiny window of opportunity was all the hackers needed to compromise the system, thanks to a vulnerability in AOMEI's update process.
WordPress Backdoor Persists Through Self-Healing Mechanisms
Meet the sneaky WordPress backdoor that refuses to be erased, thanks to its cunning self-healing mechanisms that spread its payload across eight files, the database, and shared memory. This clever malware can rebuild itself from any surviving copy, making it a formidable foe for security experts.
Russian Enterprises Targeted by Backdoor, Ransomware Attacks from Three Threat Groups
Russian enterprises are under attack by three threat groups, with hackers exploiting compromised credentials to breach corporate VPNs and deploy powerful malware like GhostContainer, a modular backdoor that gives attackers complete control over Microsoft Exchange Servers. This sneaky malware can run arbitrary code, manipulate files, and hide in plain sight, making it a formidable foe for even the most secure systems.
Compromised Plugin Backdoors 1,500 WordPress Sites
A malicious update to the WordPress plugin Admin Menu Editor Pro infected around 1,500 sites with a backdoor, after hackers compromised the plugin's update server and uploaded a trojanized version. The attackers even created a hidden user account and installed a web shell on affected sites.
North Korea's Ted Backdoor Infiltrates HAProxy Builds to Intercept Web Traffic
Security researchers have uncovered a sneaky backdoor, dubbed "ted", hidden in HAProxy builds used by two South Korean companies, allowing hackers to intercept web traffic. This cleverly concealed Linux toolkit was deployed through a trojanized HAProxy load balancer, highlighting the need for extra vigilance in cybersecurity.
Silver Fox Exploits Adware to Deploy ValleyRAT Backdoor
Meet Silver Fox, a sneaky threat actor that's been using adware to disguise a powerful backdoor called ValleyRAT, which can give attackers full control over your computer. They've even hijacked a legitimate Chinese desktop wallpaper tool to spread their malicious software.
ValleyRAT Exploits Adware to Evade Detection
Meet ValleyRAT, a sneaky backdoor that's been evading detection with the help of adware, infecting over 1500 users in China and India with a staggering 100,000 detections in 2026 alone. Its clever disguise was uncovered when researchers dug deeper into a suspicious installer initially labeled as ordinary adware.
APT28-linked Backdoor Targets European Diplomats
A sophisticated backdoor linked to APT28, a notorious Russian hacking group, has been targeting European diplomats with evolving tactics to evade detection. The malware has been refined over seven months to outsmart automated defenses and stay under the radar.
Tortoiseshell Malware Toolkit Expands with New Backdoor, SSH Tunneling
Meet Tortoiseshell, a stealthy malware toolkit that's been lurking in the shadows since 2018, and just got a nasty upgrade with a new backdoor and SSH tunneling capabilities. This cyber-espionage group's toolkit expansion could spell trouble for defense, aerospace, and military organizations worldwide.
Mustang Panda Upgrades CoolClient Backdoor with Signed Windows Rootkit
Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.
Zbtlink Routers Expose Unauthenticated Root Shells via Factory-Shipped Backdoor
Meet ENDLESSDOORS, a sneaky backdoor embedded in over 20 Zbtlink router models that lets hackers tap into an unauthenticated root shell, allowing them to remotely control your device. This hidden threat masquerades as a harmless Linux kernel thread, but in reality, it's a powerful tool that can phone home to Chinese command-and-control infrastructure every 35 seconds.
Zbtlink Router Firmware Exposes Potential Backdoor Risks
Some Zbtlink routers have a shocking secret: they come equipped with a built-in backdoor that lets them phone home and wait for orders, all without needing to be hacked. This unsettling feature, dubbed ENDLESSDOORS, was found on twenty models across years of images, sparking concerns about potential security risks.
Malicious Json Library Targets Online Betting Platform
A sneaky trojanized Json library has been targeting online betting platform Digitain, secretly rigging game results and sending them to an attacker-controlled server. This malicious code was hidden in a fake version of the popular Newtonsoft.Json library, downloaded around 1,200 times.
AI Models Vulnerable to Poisoning for Under $100
A cybersecurity expert recently discovered that AI models can be easily manipulated to behave maliciously, with a backdoor installable in just an hour for under $100. This startling vulnerability was uncovered through a simple fine-tuning test that quickly escalated into a full-blown security threat.
Microsoft Exposes GigaWiper Malware's Dual Espionage, Destructive Capabilities
Microsoft researchers have uncovered a highly sophisticated malware, GigaWiper, that masterfully combines espionage and destructive capabilities, allowing threat actors to operate efficiently and wreak havoc on infected systems. This multi-purpose backdoor enables attackers to quietly gather intel while packing a punch with its suite of destructive options.
Anthropic's Claude Code Exposes Security Risk, China Alleges
A Chinese cybersecurity group has raised a red flag about a potential backdoor security risk in Anthropic's Claude Code, warning that certain versions can secretly send sensitive user data to remote servers without consent. This alarming claim puts users' identity and location information at risk.
China Warns of Claude Code Backdoor Risks, Urges Developers to Uninstall
China's National Vulnerability Database has issued a high-priority alert, warning developers to immediately uninstall certain versions of Claude Code due to a potential backdoor risk that could compromise sensitive data. Upgrade to the latest secure version to safeguard your information.
Malicious PyPI Packages Expose Telegram Bot Servers to Hacker Control
Hackers have launched a sneaky attack, hiding malicious code in fake Python packages on PyPI, which can take control of Telegram bot servers and give attackers access to sensitive info like chats, contacts, and environment variables. This backdoor can be activated with a simple command, allowing attackers to execute any Python code on the victim's machine.
Chinese APT Deploys TinyRCT Backdoor in Southeast Asia Cyberattacks
A Chinese advanced persistent threat actor, CL-STA-1062, has launched a series of cyberattacks in Southeast Asia, targeting government entities and state-owned energy firms with a new .NET backdoor called TinyRCT. This sophisticated attack tool is part of a hybrid toolkit used by the group, which has been active since March 2022.
China-Linked Hackers Deploy TinyRCT Backdoor in Southeast Asian Infrastructure Attacks
For years, a stealthy China-linked hacking group has been quietly targeting critical infrastructure in Southeast Asia, with a clear strategic interest in disrupting or monitoring key regional industries. Their sophisticated attacks have zeroed in on state-owned energy and government sectors, using a potent tool called the TinyRCT backdoor.
Mistic Backdoor Exposes Link to Corporate Network Access Broker
Meet Mistic, a sneaky new backdoor that allows attackers to secretly access and control corporate networks for months on end, all while erasing its digital tracks. This stealthy threat can execute remote payloads in memory, upload and download files, and even self-destruct to avoid detection.
Mistic Backdoor Enables Long-Term Access in Ransomware Attacks
Cyber attackers have deployed a sneaky backdoor called Mistic, allowing them to maintain long-term access to infected systems during ransomware attacks, all while staying remarkably under the radar. This stealthy threat uses clever tactics like running payloads in memory and mimicking legitimate Microsoft security tools to evade detection.
WordPress Plugins Backdoored in ShapedPlugin Supply Chain Attack
A recent supply chain attack on ShapedPlugin compromised the updates for several WordPress plugins, including Product Slider Pro for WooCommerce, injecting backdoor code that could give attackers full control of affected sites. This severe vulnerability, rated 10.0 on the CVSS scale, highlights the importance of staying vigilant about plugin updates and security.
OceanLotus Targets Vietnam Investors with SPECTRALVIPER Backdoor
The notorious 15-year-old APT group, OceanLotus, is now setting its sights on Vietnam's investors with a cunning new backdoor attack called SPECTRALVIPER, showcasing their relentless adaptability and aggressive tactics. This latest move has left experts wondering if it's a temporary shift or a long-term strategy.