SecuriTricks - backdoor

Two sides of the same coin

This intelligence report analyzes the similarities between two previously separate APT groups, Team46 and TaxOff, concluding they are likely the same entity. The analysis covers their shared tactics, techniques, and procedures, including similar PowerShell commands, loader functionality, and infras…

backdoor

loader

Published: April 18, 2025

Downloadable IOCs: 0

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKS…

Published: April 16, 2025

Downloadable IOCs: 4

Renewed APT29 Phishing Campaign Against European Diplomats

A sophisticated phishing campaign targeting European diplomatic entities has been uncovered, attributed to the Russia-linked threat group APT29. The attackers impersonate a major European foreign affairs ministry, sending fake invitations to wine tasting events. The campaign employs a new loader ca…

Published: April 15, 2025

Downloadable IOCs: 13

Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools

The Lotus Blossom espionage group has been conducting cyber espionage campaigns targeting government, manufacturing, telecommunications, and media sectors in the Philippines, Vietnam, Hong Kong, and Taiwan. The group employs various versions of the Sagerunex backdoor, including new variants that us…

Published: April 4, 2025

Downloadable IOCs: 0

SocGholish's Intrusion Techniques Facilitate Distribution of RansomHub Ransomware

SocGholish, a malware-as-a-service framework, is being used to deploy RansomHub ransomware. It compromises legitimate websites, redirecting visitors to fake browser updates that deliver malicious payloads. The highly obfuscated JavaScript loader evades detection and executes various tasks, includin…

Published: March 14, 2025

Downloadable IOCs: 0

BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

HUMAN's Satori Threat Intelligence team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting low-cost consumer devices. This operation, an expansion of the 2023 BADBOX scheme, infected over 1 million Android Open Source Project devices worldwide with a backdoor called B…

Published: March 6, 2025

Downloadable IOCs: 59

Stealers and backdoors are spreading under the guise of a DeepSeek client

Cybercriminals are exploiting the popularity of DeepSeek, a powerful reasoning large language model, by creating fake websites that mimic the official DeepSeek chatbot site and distribute malicious code disguised as a client. Three main schemes were identified: a Python stealer targeting user data …

Published: March 6, 2025

Downloadable IOCs: 9

Call It What You Want: Threat Actor Delivers Highly Targeted Multistage Polyglot Malware

A highly targeted email-based campaign was identified, focusing on aviation and satellite communications organizations in the United Arab Emirates. The campaign utilized a compromised entity to send customized malicious messages, leading to the discovery of a new backdoor named Sosano. This malware…

Published: March 4, 2025

Downloadable IOCs: 0

Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations

Since at least March 2023, a suspected Chinese threat actor has been targeting government, defense, telecommunications, education, and aviation sectors in Southeast Asia and South America. The attackers employ a sophisticated backdoor known as Squidoor, which affects both Windows and Linux systems.…

Published: February 27, 2025

Downloadable IOCs: 30

Auto-Color: An Emerging and Evasive Linux Backdoor

Auto-color is a newly discovered Linux malware that employs sophisticated evasion techniques. It renames itself to benign-looking filenames, hides remote C2 connections using advanced methods similar to Symbiote malware, and uses proprietary encryption for communication. The malware installs a mali…

Published: February 25, 2025

Downloadable IOCs: 10

Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors

A malicious campaign is targeting Chinese-speaking users by distributing backdoored executables through fake download pages for popular apps like Signal, Line, and Gmail. The attackers use seemingly unrelated domain names and rely on search engine manipulation to lure victims. The malware follows a…

backdoor

infostealer

search engine manipulation

Published: February 18, 2025

Downloadable IOCs: 0

Don't Ghost the SocGholish: GhostWeaver Backdoor

The article details a sophisticated malware infection chain involving SocGholish, MintsLoader, and the GhostWeaver backdoor. The attack begins with a fake browser update, progressing through multiple stages to deploy a PowerShell backdoor and various plugins. These components work together to steal…

Published: February 17, 2025

Downloadable IOCs: 14

The Anatomy of Abyss Locker Ransomware Attack

Abyss Locker (AKA Abyss ransomware) is a relatively new threat group that emerged in 2023, specializing in swift and decisive intrusions designed to cripple victims with ransomware. Abyss Locker was active throughout 2024, causing multiple incidents investigated by Sygnia. However, no recent techni…

Published: February 10, 2025

Downloadable IOCs: 15

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

A sophisticated breach was identified where threat actors exploited vulnerabilities in SimpleHelp's Remote Monitoring and Management client to infiltrate a network. The attack involved post-compromise tactics including network discovery, administrator account creation, and persistence establishment…

Published: February 7, 2025

Downloadable IOCs: 6

New TorNet backdoor seen in widespread campaign

A financially motivated threat actor has been conducting a malicious campaign since July 2024, primarily targeting users in Poland and Germany. The campaign uses phishing emails impersonating financial institutions and companies to deliver various payloads, including a new backdoor called TorNet. T…

Published: January 28, 2025

Downloadable IOCs: 0

Supply chain of Korean VPN service compromised

ESET researchers have uncovered a supply-chain attack against a South Korean VPN provider by a previously unknown China-aligned APT group named PlushDaemon. The attackers replaced the legitimate VPN installer with a malicious version that deployed their SlowStepper backdoor, a feature-rich implant …

Published: January 22, 2025

Downloadable IOCs: 0

Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

A critical code execution vulnerability, CVE-2024-50603, affecting Aviatrix Controller has been observed being exploited in the wild. This unauthenticated remote code execution flaw allows attackers to execute arbitrary commands on the system, potentially leading to privilege escalation in AWS envi…

Published: January 13, 2025

Linked vulnerabilities : CVE-2024-50603 (CVSS 10.0), CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0), CVE-2021-40870

Downloadable IOCs: 6

Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software

The Lazarus group, a highly active APT organization, has been observed weaponizing the IPMsg installer for attacks. When executed, the malicious installer releases the official IPMsg version 5.6.18.0 to deceive users while activating a malicious DLL in memory. This DLL connects to a remote control …

Published: January 2, 2025

Downloadable IOCs: 3

New Yokai Side-loaded Backdoor Targets Thai Officials

A new backdoor named Yokai has been discovered targeting Thai officials. The malware is distributed via RAR files containing shortcut files that create decoy documents and execute a dropper. The dropper deploys a legitimate iTop Data Recovery application used to side-load the Yokai backdoor DLL. Yo…

Published: December 16, 2024

Downloadable IOCs: 20

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Elastic Security Labs has uncovered a new intrusion set targeting Chinese-speaking regions, dubbed REF3864. The threat group employs a custom loader called SADBRIDGE to deploy GOSAR, a Golang-based reimplementation of the QUASAR backdoor. The infection chain involves trojanized MSI installers masqu…

Published: December 16, 2024

Downloadable IOCs: 13

Black and White Domination: Glutton Trojan Lurks in Mainstream PHP Frameworks

The XLab threat detection system uncovered an advanced PHP trojan named Glutton, which has been active for over a year without detection. Glutton targets both legitimate businesses and cybercriminal operations, infiltrating popular PHP frameworks like ThinkPHP and Laravel. It employs modular compon…

Published: December 11, 2024

Downloadable IOCs: 5

Intensifies Attacks On Russia With PhantomCore

The Head Mare hacktivist group has escalated its campaign against Russian targets using the PhantomCore backdoor. The group employs deceptive ZIP archives containing malicious LNK files and executables disguised as archive files to deploy PhantomCore. This C++-compiled backdoor, which replaces earl…

Published: December 11, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 31

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Earth Minotaur, a threat actor targeting Tibetan and Uyghur communities, utilizes the MOONSHINE exploit kit to compromise Android devices and install the DarkNimbus backdoor. The exploit kit targets vulnerabilities in instant messaging apps, particularly WeChat, and has been updated with new exploi…

Published: December 5, 2024

Downloadable IOCs: 0

Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024

A spear-phishing campaign targeting Japan since June 2024 has been identified, featuring the reemergence of the ANEL backdoor, previously used by APT10 until 2018. The campaign, attributed to Earth Kasha, targets individuals in political organizations, research institutions, and international relat…

Published: November 27, 2024

Downloadable IOCs: 6

Unveiling WolfsBane: Linux counterpart to Gelsevirine

ESET researchers have discovered previously unknown Linux backdoors attributed to the China-aligned Gelsemium APT group. The main backdoor, named WolfsBane, is the Linux equivalent of Gelsemium's Gelsevirine backdoor for Windows. Another backdoor, FireWood, is connected to the group's Project Wood …

Published: November 22, 2024

Downloadable IOCs: 41

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Earth Kasha, a threat group targeting Japan since 2019, has launched a new campaign with significant updates to their tactics and arsenals. The group has expanded its targets to include Taiwan and India, focusing on advanced technology organizations and government agencies. They now exploit public-…

Published: November 19, 2024

Linked vulnerabilities : CVE-2023-3519, CVE-2023-27997, CVE-2023-45727, CVE-2023-28461, CVE-2013-3900, CVE-2023-3467, CVE-2023-3466

Downloadable IOCs: 7

Malware Spotlight: A Deep-Dive Analysis of WezRat

Check Point Research provides a comprehensive analysis of WezRat, a custom modular infostealer attributed to the Iranian cyber group Emennet Pasargad. The malware has been active for over a year, targeting organizations in multiple countries. WezRat's capabilities include executing commands, taking…

Published: November 14, 2024

Downloadable IOCs: 0

PHP Reinfector and Backdoor Malware Target WordPress Sites

A sophisticated PHP reinfector and backdoor malware is targeting WordPress websites, infecting plugin files and database tables. The malware reinfects active plugins, manipulates wp_options and wp_posts tables, and creates malicious admin users. It utilizes WordPress's cron system to maintain contr…

database manipulation

Published: November 14, 2024

Downloadable IOCs: 0

WINELOADER Analysis

APT29, also known as Cozy Bear, has targeted European diplomats using a sophisticated multi-stage attack chain involving a new modular backdoor called WINELOADER. The attack begins with a fake PDF invitation to a wine-tasting event, which leads to the download of a malicious HTA file. This file the…

Published: November 7, 2024

Downloadable IOCs: 0

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

On October 22, 2024, Microsoft identified a spear-phishing campaign in which Midnight Blizzard sent phishing emails to thousands of users in over 100 organizations. The emails were highly targeted, using social engineering lures relating to Microsoft, Amazon Web Services (AWS), and the concept of Z…

Published: October 30, 2024

Downloadable IOCs: 281

CoreWarrior Spreader Malware Surge

This report delves into an analysis of CoreWarrior, a persistent trojan designed for rapid propagation. It creates multiple copies of itself, attempts connections to various IP addresses, opens backdoor access, and hooks Windows UI elements for monitoring purposes. The malware employs techniques li…

Published: October 15, 2024

Downloadable IOCs: 3

Rhysida Ransomware: Multi-Tiered Infrastructure and Early Detection Analysis

Insikt Group unveiled Rhysida's complex infrastructure, comprising typo-squatted domains for SEO poisoning, payload servers, CleanUpLoader C2 infrastructure, and higher-tier components including an admin panel and Zabbix monitoring server. This multi-tiered setup enables early victim identification…

Published: October 10, 2024

Downloadable IOCs: 106

MDR in Action: Preventing The More_eggs Backdoor From Hatching

A sophisticated spear-phishing attack led to a more_eggs backdoor infection at a company. The attack began with an email to a senior executive, followed by a recruitment officer downloading a fake resume. The malicious file, disguised as a resume, contained obfuscated commands that executed when op…

Published: October 1, 2024

Downloadable IOCs: 10

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Microsoft has observed Storm-0501, a financially motivated cybercriminal group, conducting multi-staged attacks targeting hybrid cloud environments. The group compromises on-premises networks, performs lateral movement to cloud environments, exfiltrates data, steals credentials, creates persistent …

Published: September 30, 2024

Linked vulnerabilities : CVE-2023-4966, CVE-2023-38203, CVE-2023-29300, CVE-2022-47966

Downloadable IOCs: 14

Analyzing the Newest Turla Backdoor

The Russian APT group Turla has launched a new campaign using shortcut files to infect systems with a fileless backdoor. The malware employs evasion techniques such as disabling ETW and AMSI, and unhooking. The attack begins with a shortcut file mimicking a PDF, which creates a file executed using …

backdoor

apt

2024-09-27

Published: September 27, 2024

Downloadable IOCs: 5

An Offer You Can Refuse: Backdoor Deployment Using Trojanized PDF Reader

UNC2970, a suspected North Korean cyber espionage group, targeted critical infrastructure sectors using job-themed phishing lures. The group employed a trojanized version of SumatraPDF to deliver the MISTPEN backdoor via the BURNBOOK launcher. The infection chain involved a password-protected ZIP a…

Published: September 18, 2024

Downloadable IOCs: 14

Observes Targeted Attacks Amid FBI Warnings

The report details targeted attacks observed by Jamf Threat Labs that align with FBI warnings about the Democratic People's Republic of Korea (DPRK) targeting individuals in the crypto industry through social engineering tactics for malware delivery. It outlines attack scenarios involving malicious…

Published: September 17, 2024

Downloadable IOCs: 8

New macOS malware gives attackers backdoor access to Macs

A new remote access Trojan (RAT) targeting macOS systems, dubbed HZ RAT, grants remote attackers complete control over infected Macs. The malware collects sensitive data, such as installed apps, user information from WeChat and DingTalk, and Google Password Manager credentials. It's suspected of sp…

Published: September 16, 2024

Downloadable IOCs: 25

Hadooken Malware Targets Weblogic Applications

Aqua Nautilus researchers identified a Linux malware, named Hadooken, targeting Oracle WebLogic servers. Upon gaining initial access through an exploited weak password, Hadooken deploys a cryptominer and the Tsunami malware. The report details the attack flow, techniques employed by the threat acto…

Published: September 13, 2024

Downloadable IOCs: 4

Targeted Iranian Attacks Against Iraqi Government Infrastructure

Check Point Research uncovered a new malware campaign targeting Iraqi government entities, employing custom tools named Veaty and Spearal. The attack utilizes various techniques including passive IIS backdoors, DNS tunneling, and C2 communication via compromised email accounts. The malware shows co…

Published: September 12, 2024

Downloadable IOCs: 16

Loki: a new private agent for the popular Mythic framework

Kaspersky researchers discovered a previously unknown Loki backdoor, utilized in a series of targeted attacks. Analysis revealed that Loki is a private version of an agent compatible with the open-source Mythic framework. The malware employs techniques like memory encryption, indirect system API ca…

Published: September 9, 2024

Downloadable IOCs: 7

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

A long-term intrusion targeting a Vietnamese human rights non-profit organization has been discovered, likely spanning at least four years. The attack shows significant overlaps with techniques used by APT32/OceanLotus, a threat actor known for targeting Vietnamese activists. The intrusion involved…

Published: September 3, 2024

Downloadable IOCs: 46

Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

Between April and July 2024, Iranian state-sponsored threat actor Peach Sandstorm deployed a new custom multi-stage backdoor called Tickler. The malware targeted organizations in the satellite, communications equipment, oil and gas, and government sectors in the United States and UAE. Peach Sandsto…

linkedin intelligence gathering

tickler malware

iranian threat actor

Published: August 30, 2024

Downloadable IOCs: 9

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk

A version of the HZ Rat backdoor targeting users of China’s WeChat and DingTalk was uploaded to VirusTotal in July 2023 and was not detected by any vendor, research by Kaspersky suggests.

Published: August 27, 2024

Downloadable IOCs: 10

A Dive into Latest Campaign

Earth Baku, an advanced persistent threat actor, has broadened its operations from the Indo-Pacific region to Europe, the Middle East, and Africa, targeting countries like Italy, Germany, UAE, and Qatar. The group leverages public-facing applications like IIS servers as entry points, deploying soph…

Published: August 9, 2024

Downloadable IOCs: 30

Hackers Leveraging OneDrive Or Google Drive To Hide Malicious Traffic

Cyber threat actors, including nation-state groups, are utilizing legitimate cloud services like Microsoft OneDrive and Google Drive for covert operations. These services evade detection by masquerading as trusted entities, enabling data exfiltration and tool deployment. A new Go-based backdoor, Go…

Published: August 7, 2024

Downloadable IOCs: 20

Fighting Ursa Luring Targets With Car for Sale

This analysis examines a campaign attributed to the Russian threat actor Fighting Ursa, also known as APT28, Fancy Bear, and Sofacy. The group utilized a phishing lure disguised as an advertisement for a car sale to distribute the HeadLace backdoor malware, likely targeting diplomats. The lure expl…

Published: August 5, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 6

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Elastic Security Labs uncovered a new Windows backdoor called BITSLOTH that utilizes the Background Intelligent Transfer Service (BITS) for command-and-control communication. This malware, discovered during an intrusion into a South American government's Foreign Ministry, possesses capabilities for…

Published: August 2, 2024

Downloadable IOCs: 8

Patch or Peril: A Veeam vulnerability incident

While the vulnerability CVE-2023-27532 was made public in March 2023 and subsequently patched by Veeam for versions 12/11a and later for Veeam Backup & Replication software, Group-IB’s Digital Forensics and Incident Response (DFIR) team recently observed a notable incident related to this vulnerabi…

Published: July 12, 2024

Downloadable IOCs: 2

MoonWalk

This blog post examines MoonWalk, a new backdoor employed by APT41, a China-based threat actor known for campaigns in Southeast Asia. MoonWalk utilizes numerous evasion techniques, including DLL hollowing, call stack spoofing, and the abuse of Windows Fibers to evade security solutions. It also lev…

Published: July 12, 2024

Downloadable IOCs: 3

Turla: A Master of Deception

This report details a recent campaign by the Turla threat group involving malicious LNK files that deliver a fileless backdoor. The attack leverages compromised websites, PowerShell scripts, and MSBuild to deploy the payload, which employs various evasion techniques like disabling security features…

Published: July 8, 2024

Downloadable IOCs: 10

Attack Case against HFS (HTTP File Server) Server (Suspected CVE-2024-23692)

A remote code execution vulnerability (CVE-2024-23692) in the HFS (HTTP File Server) program has allowed attackers to execute malicious commands on vulnerable systems. Various attack cases exploiting this vulnerability have been observed, leading to the installation of malware such as coin miners, …

Published: July 3, 2024

Linked vulnerabilities : CVE-2024-23692 (CVSS 9.8)

Downloadable IOCs: 14

Appearance of Kimsuky group's new backdoor (HappyDoor)

Asec Ahnlab analyzes a new backdoor malware called HappyDoor used by the North Korean hacking group Kimsuky in recent email attacks. The malware has evolved over time and contains capabilities for information stealing and remote access. It communicates with command and control servers using encrypt…

Published: July 1, 2024

Downloadable IOCs: 16

Malicious npm package targets AWS users

ReversingLabs' researchers discovered a malicious package named legacyreact-aws-s3-typescript on the npm repository. It mimicked a popular legitimate package, react-aws-s3-typescript, designed to facilitate file uploads to Amazon S3 Buckets. Initially, the package appeared benign, but a later versi…

Published: June 27, 2024

Downloadable IOCs: 3

North Korean based backdoor packs a punch

This report analyzes a new threat campaign discovered in late May, featuring multiple layers and ultimately delivering a previously undocumented backdoor. The campaign specifically targets Aerospace and Defense companies, sectors of particular interest to North Korean threat groups. The backdoors a…

Published: June 21, 2024

Downloadable IOCs: 20

Sustained Campaign Using Chinese Espionage Tools Targets Telcos

Attackers using tools associated with Chinese espionage groups have breached multiple telecom operators in a single Asian country in a long-running espionage campaign. The attackers placed backdoors on the networks of targeted companies and also attempted to steal credentials.

Published: June 20, 2024

Downloadable IOCs: 47

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework

Trend Micro recently discovered a threat actor group dubbed Void Arachne targeting Chinese-speaking users with malicious Windows Installer (MSI) files containing legitimate software bundled with malicious Winos payloads. The campaign promotes compromised MSI files embedded with nudifiers, deepfake …

Published: June 19, 2024

Linked vulnerabilities : CVE-2024-21412

Downloadable IOCs: 46

SolarMarker Impersonates Job Employment Website

On April 2024, Cyber Analysts responded to a SolarMarker infection event. The infection occurred through a drive-by download when a user, while searching for workplace team-building ideas on Bing, was directed to a malicious site impersonating the global employment website, Indeed.

Published: June 18, 2024

Downloadable IOCs: 6

Dipping into Danger: The WARMCOOKIE backdoor

Elastic Security Labs identified a new wave of email campaigns targeting environments by deploying a novel backdoor dubbed WARMCOOKIE, which communicates via HTTP cookie parameters. The malware is an initial tool used to scout victim networks and deploy additional payloads, with hard-coded command …

Published: June 12, 2024

Downloadable IOCs: 6

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

This report details an intrusion that commenced with a spam campaign distributing a forked IcedID loader. After gaining initial access, the threat actor deployed ScreenConnect and established Cobalt Strike beacons, enabling remote command execution. They also utilized CSharp Streamer, a capable RAT…

Published: June 10, 2024

Downloadable IOCs: 33

Fake Advanced IP Scanner Installer Delivers Dangerous Backdoor

Security researchers discovered a malicious version of the Advanced IP Scanner installer, which contained a backdoored DLL module. The compromised installer was distributed through a typo-squatted domain and appeared in search results for the legitimate software. When executed, the installer inject…

Published: June 6, 2024

Downloadable IOCs: 11

Wineloader - Analysis of the Infection Chain

The analysis examines the Wineloader backdoor, a modular malware attributed to the APT29 threat group, which allows further tools or modules to be downloaded through an encrypted command and control channel. It starts with a phishing email luring targets with a wine tasting event invitation. Execut…

Published: June 6, 2024

Downloadable IOCs: 9

CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack

Rapid7 discovered that version 8.3.7 of the JAVS Viewer software from Justice AV Solutions contained a backdoor installer allowing attackers to gain remote control over affected systems. The malicious installer included a binary named fffmpeg.exe which executed obfuscated PowerShell scripts and fac…

credential harvesting

Published: May 24, 2024

Linked vulnerabilities : CVE-2024-4978 (CVSS 8.4)

Downloadable IOCs: 10

Springtail: New Linux Backdoor Added to Toolkit

Symantec's Threat Hunter Team has uncovered a new Linux backdoor, named Gomir, developed by the North Korean Springtail espionage group, which is linked to malware employed in a recent campaign targeting organizations in South Korea. The backdoor shares extensive code similarities with the Windows-…

Published: May 16, 2024

Downloadable IOCs: 20

To the Moon and back(doors): Lunar landing in diplomatic missions

ESET researchers discovered two previously unknown backdoors – LunarWeb and LunarMail – compromising a European ministry of foreign affairs and its diplomatic missions abroad. LunarWeb, deployed on servers, utilizes HTTP(S) for command and control communications, mimicking legitimate requests to av…

Published: May 16, 2024

Downloadable IOCs: 12

LNK File Disguised as Certificate Distributing RokRAT Malware

This analysis delves into the continuous distribution of malicious shortcut files (*.LNK) targeting South Korean users, particularly those related to North Korea. These LNK files contain legitimate documents, script code, and encoded malware data. When executed, they create and run a document file …

Published: May 7, 2024

Downloadable IOCs: 4

Playing Possum: What's the Backdoor Up To?

This report analyzes the Wpeeper backdoor targeting Android systems. Wpeeper utilizes compromised WordPress sites as relay C2 servers to hide its true C2. It uses HTTPS requests with Session fields to differentiate command types. Commands are encrypted with AES and signed to prevent takeover. Wpeep…

Published: May 3, 2024

Downloadable IOCs: 98

Tag: backdoor

Attack reports

Two sides of the same coin

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

Renewed APT29 Phishing Campaign Against European Diplomats

Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools

BeaverTail and Tropidoor Malware Distributed via Recruitment Emails

TookPS distributed under the guise of UltraViewer, AutoCAD, and Ableton

From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic

A Deep Dive into Water Arsenal and Infrastructure

CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin

Off the Beaten Path: Recent Unusual Malware

Credit Card Skimmer and Backdoor on WordPress E-commerce Site

SocGholish's Intrusion Techniques Facilitate Distribution of RansomHub Ransomware

BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

Stealers and backdoors are spreading under the guise of a DeepSeek client

Call It What You Want: Threat Actor Delivers Highly Targeted Multistage Polyglot Malware

Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations

Auto-Color: An Emerging and Evasive Linux Backdoor

Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors

Don't Ghost the SocGholish: GhostWeaver Backdoor

The Anatomy of Abyss Locker Ransomware Attack

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

New TorNet backdoor seen in widespread campaign

Supply chain of Korean VPN service compromised

Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software

New Yokai Side-loaded Backdoor Targets Thai Officials

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Black and White Domination: Glutton Trojan Lurks in Mainstream PHP Frameworks

Intensifies Attacks On Russia With PhantomCore

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malware Spotlight: A Deep-Dive Analysis of WezRat

PHP Reinfector and Backdoor Malware Target WordPress Sites

WINELOADER Analysis

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

CoreWarrior Spreader Malware Surge

Rhysida Ransomware: Multi-Tiered Infrastructure and Early Detection Analysis

MDR in Action: Preventing The More_eggs Backdoor From Hatching

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Analyzing the Newest Turla Backdoor

An Offer You Can Refuse: Backdoor Deployment Using Trojanized PDF Reader

Observes Targeted Attacks Amid FBI Warnings

New macOS malware gives attackers backdoor access to Macs

Hadooken Malware Targets Weblogic Applications

Targeted Iranian Attacks Against Iraqi Government Infrastructure

Loki: a new private agent for the popular Mythic framework

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk

A Dive into Latest Campaign

Hackers Leveraging OneDrive Or Google Drive To Hide Malicious Traffic

Fighting Ursa Luring Targets With Car for Sale

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Patch or Peril: A Veeam vulnerability incident

MoonWalk

Turla: A Master of Deception

Attack Case against HFS (HTTP File Server) Server (Suspected CVE-2024-23692)

Appearance of Kimsuky group's new backdoor (HappyDoor)

Malicious npm package targets AWS users

North Korean based backdoor packs a punch

Sustained Campaign Using Chinese Espionage Tools Targets Telcos

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework

SolarMarker Impersonates Job Employment Website

Dipping into Danger: The WARMCOOKIE backdoor

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Fake Advanced IP Scanner Installer Delivers Dangerous Backdoor

Wineloader - Analysis of the Infection Chain

CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack

Springtail: New Linux Backdoor Added to Toolkit

To the Moon and back(doors): Lunar landing in diplomatic missions

LNK File Disguised as Certificate Distributing RokRAT Malware

Playing Possum: What's the Backdoor Up To?