MalwarePublished 8 May 2026

In Other News: Train Hacker Arrested, PamDOORa Linux Backdoor, New CISA Director Frontrunner

Source SecurityWeek

Description

Other noteworthy stories that might have slipped under the radar: US gov targets 72-hour patch cycles, malware uses Windows Phone Link to steal OTPs, spy operation targets Eurasian drone industry. The post In Other News: Train Hacker Arrested, PamDOORa Linux Backdoor, New CISA Director Frontrunner appeared first on SecurityWeek .

Impact

The PamDOORa backdoor enables attackers to maintain persistent unauthorized SSH access on Linux systems and harvest plaintext credentials, potentially compromising system integrity and confidentiality. The Windows Phone Link malware can intercept OTPs, undermining multi-factor authentication security. The train hacker's actions disrupted public transportation safety by triggering emergency stops, posing physical safety risks and operational disruption. The Firestarter implant on Cisco firewalls evades detection and persists through firmware patches, complicating incident response. The espionage campaigns target sensitive sectors such as drone technology and government infrastructure, indicating potential data theft and intelligence compromise. Collectively, these threats demonstrate significant risks to critical infrastructure, authentication security, and enterprise network defenses.

Defensive guidance

No specific vendor advisories or patches are referenced for these threats. For the PamDOORa Linux backdoor, organizations should monitor for unauthorized SSH access and consider enhanced PAM stack monitoring and credential protection measures. The Windows Phone Link malware requires vigilance around OTP interception vectors and endpoint detection improvements. The Firestarter implant on Cisco firewalls necessitates performing a hard power cycle (physically disconnecting power for at least one minute) to fully remove the malware after applying firmware patches. The train network incident underscores the need for securing radio communication channels and monitoring for signal spoofing. Organizations affected by espionage campaigns should apply targeted threat intelligence and phishing awareness.

Summary

The SecurityWeek article covers several cybersecurity incidents and emerging threats. A 23-year-old in Taiwan was arrested for infiltrating the high-speed rail network and sending fake General Alarm signals via cloned Tetra radio transmissions, causing emergency train stops. Cisco Talos identified a modular malware campaign using the CloudZ remote access tool with a plugin called Pheno that steals OTPs by targeting the Microsoft Phone Link app's synchronized SQLite databases. The PamDOORa Linux backdoor, marketed by the 'darkworm' actor on a Russian forum for $900, compromises the Linux PAM stack to enable persistent SSH access and harvest plaintext credentials, including those of incident responders. The ArcaneDoor group uses the Firestarter implant to persistently infect Cisco firewalls, requiring a hard power cycle to fully remove. Other stories include espionage targeting Eurasian drone industry participants and North Korean-linked cybercrime operations. No CVSS score is provided for these threats.

References

securityweek.com/in-other-news-train-hacker-arrested-pamdoora-linux-backdoor-new-cisa-director-frontrunner/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 14:36 UTC

References

Community reviews

Related threats