Tag: kongtuke

2 Attack Reports | 0 Vulnerabilities

Attack reports

KongTuke FileFix Leads to New Interlock RAT Variant

A new and resilient variant of the Interlock ransomware group's remote access trojan (RAT) has been identified. This PHP-based malware, a shift from the previous JavaScript-based NodeSnake, is being used in a widespread campaign associated with the LandUpdate808 (KongTuke) web-inject threat cluster…
reconnaissance
interlock rat
cloudflare tunnel
kongtuke
2025-07-15
web-inject
filefix
nodesnake
Published: July 15, 2025
Downloadable IOCs: 12

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure…
backdoor
rat
persistence
captcha
anti-vm
xor encryption
system reconnaissance
2025-05-16
nodejs
socks5 proxy
nodejs rat
kongtuke
Published: May 16, 2025
Downloadable IOCs: 11
Click here to see more Attack Reports