Threats tagged 'backdoor'

North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.

Campaign#macos#c2Germany+6

A North Korean malware was discovered in an Upwork cryptocurrency project, leading to a five-day investigation into active Lazarus Group infrastructure. The malware utilized three infection mechanisms: VSCode auto-execution, backend RCE via Function Constructor, and cookie payload delivery. The infrastructure included Vercel-hosted Stage 1 C2 servers and dedicated Stage 2 C2 servers. A timing oracle allowed for token enumeration, revealing three active campaigns. The payload chain consisted of various modules for data extraction, RAT functionality, and cryptocurrency mining. The investigation uncovered sophisticated persistence mechanisms, masquerading techniques, and a custom binary protocol. Real-time defensive responses from the operators were observed during reconnaissance. The infrastructure blended legitimate-looking development projects with malicious activities for cover.

Malware#beavertail#upworkGermany+5

A targeted malware campaign against U.S.government entities has been observed, utilizing a politically themed ZIP archive containing a loader executable and a malicious DLL. The DLL functions as a backdoor named LOTUSLITE, communicating with a hard-coded command-and-control server. The campaign demonstrates minimal technical sophistication but shows deliberate victim selection and use of geopolitical lures. Attribution analysis suggests moderate-confidence overlap with Mustang Panda tradecraft, including delivery style, loader-DLL separation, and infrastructure usage. The backdoor supports basic remote tasking and data exfiltration, indicating an espionage-focused capability. This activity reflects a trend of targeted spear phishing using geopolitical themes and reliable execution techniques like DLL sideloading.

Malware#dll sideloading#u.s. governmentUnited Kingdom+7

CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.

Campaign#notepad#seoGermany+6

ESET researchers have uncovered a new China-aligned APT group named LongNosedGoblin targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs a varied custom toolset of C#/.NET applications and abuses Group Policy for lateral movement. Key tools include NosyHistorian for collecting browser history, NosyDoor backdoor using cloud services as C&C, and NosyStealer for exfiltrating browser data. The attackers also utilize techniques like AppDomainManager injection and AMSI bypassing. LongNosedGoblin has been active since at least September 2023, showing ongoing campaigns throughout 2024 and 2025. The research provides detailed analysis of the group's malware and tactics, including potential sharing of the NosyDoor backdoor among multiple China-aligned actors.

Malware#nosyhistorian#southeast asiaJapan+5

DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.

Malware#backdoor#dll sideloadingGermany+6

HoneyMyte, also known as Mustang Panda, is deploying a new backdoor malware called ToneShell in targeted attacks primarily in South and East Asia. The ToneShell backdoor enables persistent unauthorized access to compromised systems, facilitating espionage and data exfiltration. Although currently observed mainly in Asian regions, the threat actor's history and malware capabilities suggest potential risks to European organizations with relevant geopolitical or business ties. The malware does not have publicly known exploits in the wild yet, but its deployment by a known advanced persistent threat (APT) group indicates a medium severity risk. European entities involved in sectors such as government, defense, or technology with connections to Asia should be vigilant. Mitigation requires enhanced network monitoring for unusual outbound connections, strict application whitelisting, and threat hunting for ToneShell indicators. Countries with strong economic or diplomatic links to South and East Asia, such as Germany, France, and the UK, are more likely to be targeted. The threat’s medium severity is due to its backdoor nature, moderate ease of exploitation by a skilled actor, and potential for significant confidentiality and integrity impacts without immediate widespread availability disruption.

Malware#infosecnews#redditGermany+5

Mustang Panda, a known threat actor, has deployed a signed kernel-mode rootkit to stealthily load the TONESHELL backdoor on targeted systems. This advanced malware leverages a legitimate digital signature to evade detection and gain deep system privileges, enabling persistent and covert access. The rootkit operates at the kernel level, allowing it to manipulate core OS functions and hide its presence effectively. Although no known exploits are currently observed in the wild, the sophistication and stealth capabilities of this threat pose a significant risk. European organizations, especially those in critical infrastructure and government sectors, could face severe confidentiality and integrity breaches if targeted. Mitigation requires advanced endpoint detection, strict driver signature enforcement, and continuous monitoring for anomalous kernel activity. Countries with high adoption of Windows systems and strategic geopolitical relevance are most likely to be affected. Given the high potential impact and complexity of exploitation, this threat is assessed as high severity. Defenders must prioritize detection of signed kernel drivers and implement layered security controls to prevent unauthorized kernel-level code execution.

Malware#infosecnews#redditGermany+8

The Evasive Panda cyberespionage campaign employs DNS poisoning techniques to deliver the MgBot backdoor malware. This campaign manipulates DNS responses to redirect victims to malicious servers, enabling stealthy installation of the backdoor without direct user interaction. MgBot provides persistent remote access, facilitating espionage activities by exfiltrating sensitive data and potentially enabling further network compromise. Although currently assessed as medium severity, the campaign’s use of DNS poisoning increases its stealth and difficulty to detect. European organizations, especially those in critical infrastructure and government sectors, face risks due to potential data breaches and operational disruptions. Mitigation requires enhanced DNS security measures, network monitoring for anomalous DNS activity, and endpoint detection capabilities tailored to identify MgBot behaviors. Countries with significant deployments of vulnerable DNS infrastructure and high-value targets, such as Germany, France, and the UK, are most likely to be affected. The threat’s exploitation does not require user interaction, increasing its risk profile. Defenders should prioritize DNS security hardening and incident response readiness to counter this evolving espionage threat.

Malware#infosecnews#redditGermany+4

A Chinese-nexus advanced persistent threat actor, UAT-9686, is actively targeting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The campaign, ongoing since late November 2025, exploits non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor called AquaShell. Additional tools observed include AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing. The attackers can execute encoded commands in the system shell and create reverse connections to attacker-controlled servers. This sophisticated attack aligns with tactics used by other Chinese APT groups, raising concerns about potential widespread impact on email security infrastructure.

Campaign#apt#backdoorGermany+7

Operation PCPcat is a large-scale credential theft campaign that compromised approximately 59,000 Next.js servers within 48 hours by exploiting two remote code execution vulnerabilities (CVE-2025-29927 and CVE-2025-66478). Attackers extracted sensitive files such as . env files, SSH keys, and cloud credentials, installed persistent backdoors, and operated a publicly exposed command and control infrastructure. The campaign involves exploitation, data exfiltration, and backdoor installation. Organizations running Next.js in production are advised to patch vulnerable systems immediately and rotate all potentially compromised credentials. The threat is assessed as medium severity with potentially widespread impact due to the scale and sensitivity of data targeted. European organizations using Next.js may be particularly at risk.

Fake installers for Microsoft Teams and Google Meet are being distributed to spread the Oyster backdoor malware. This threat involves social engineering where users are tricked into downloading malicious versions of popular collaboration tools. Once installed, the Oyster backdoor provides attackers with persistent remote access to compromised systems. Although no known exploits are currently active in the wild, the malware poses a medium severity risk due to its potential for espionage and data theft. European organizations relying heavily on these collaboration platforms for remote work are at risk, especially if users are not vigilant about download sources. The threat primarily targets endpoints through user deception rather than exploiting software vulnerabilities. Mitigation requires strict user education, use of official software distribution channels, and enhanced endpoint detection capabilities. Countries with high adoption of Microsoft Teams and Google Meet, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the medium severity, organizations should prioritize detection and prevention to avoid unauthorized access and data compromise.

Malware#infosecnews#redditGermany+5

WIRTE is a malware campaign that uses AshenLoader sideloading techniques to deploy the AshTag espionage backdoor. This attack vector involves abusing AshenLoader, a known malware loader, to stealthily install AshTag, which is designed for espionage activities. The threat is considered high severity due to its potential for covert data exfiltration and persistence within targeted environments. Although no known exploits in the wild have been reported yet, the combination of loader sideloading and a backdoor indicates a sophisticated threat. European organizations, especially those in critical infrastructure and government sectors, could face significant risks from espionage and data breaches. Mitigation requires advanced detection of loader sideloading behaviors and thorough endpoint monitoring. Countries with high adoption of Windows environments and strategic geopolitical importance are most at risk. The threat is assessed as high severity given its espionage nature, ease of sideloading exploitation, and potential impact on confidentiality and integrity without requiring user interaction. Defenders should prioritize monitoring for AshenLoader activity and implement strict application control policies to prevent unauthorized DLL sideloading.

Malware#infosecnews#redditGermany+7

UDPGangster, a UDP-based backdoor associated with the MuddyWater threat group, has been observed targeting users in Turkey, Israel, and Azerbaijan. The malware is delivered through malicious Microsoft Word documents with embedded VBA macros, employing sophisticated anti-analysis techniques to evade detection. The campaigns use phishing emails impersonating government entities and include decoy images to distract victims. UDPGangster installs persistence, collects system information, and communicates with its command and control server using UDP. The malware supports various commands for remote execution, file extraction, and payload deployment. Analysis reveals connections to previous MuddyWater operations and shared infrastructure with other known malware.

Malware#vba macros#udpgangsterTurkey+6

Matanbuchus 3.0 is a sophisticated C++ malware downloader offered as Malware-as-a-Service since 2020, designed to deliver additional malicious payloads including ransomware and remote access trojans like Rhadamanthys and NetSupport RAT. It employs advanced obfuscation techniques such as junk code insertion, encrypted strings, and API hashing to evade detection. The malware features anti-analysis mechanisms including an expiration date and persistence via scheduled tasks. It communicates with its command and control servers using encrypted Protocol Buffers over HTTP(S), supporting a wide range of commands for payload execution, data collection, and system manipulation. While no known exploits are currently reported in the wild, its modular design and use in ransomware campaigns make it a medium-severity threat. European organizations are at risk due to the malware’s capability to facilitate ransomware attacks and backdoor access, potentially leading to data breaches and operational disruption. Mitigation requires targeted detection of its persistence mechanisms, network traffic analysis for encrypted C2 communications, and blocking associated domains and URLs. Countries with high technology adoption and ransomware targeting history, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected.

Malware#netsupport rat#backdoorGermany+6

Shai-Hulud V2 is an advanced malware campaign targeting the npm software supply chain, compromising over 700 npm packages and creating more than 27,000 malicious GitHub repositories. It introduces sophisticated techniques including pre-install phase execution, persistent backdoors via self-hosted GitHub Actions runners, credential harvesting and recycling across victims, and a destructive failsafe mechanism. The malware exfiltrates data through GitHub and propagates within the npm ecosystem, also exploiting Azure DevOps build agents. This supply chain attack enables persistent remote code execution and widespread credential theft without requiring user interaction. European organizations relying on npm packages and GitHub Actions for CI/CD pipelines face significant risks of data breaches, system compromise, and operational disruption. Mitigation requires enhanced supply chain security practices, strict GitHub Actions runner controls, credential hygiene, and proactive monitoring for anomalous activity. Countries with strong software development sectors and high npm usage, such as Germany, France, the UK, and the Netherlands, are particularly vulnerable. Given its broad impact and advanced persistence mechanisms, the threat severity is assessed as high.

Malware#exfiltration#githubGermany+6

ESET researchers have identified a new cyberespionage campaign by the Iran-aligned MuddyWater group targeting organizations in Israel and Egypt. The group uses custom malware tools, including a Fooder loader and the MuddyViper backdoor, employing advanced techniques such as CNG cryptography and reflective loading. The campaign focuses on critical infrastructure sectors and uses spearphishing emails with links to remote monitoring and management software to deliver its payloads. MuddyWater's toolset includes browser data stealers, credential stealers, and reverse tunneling tools, indicating enhanced stealth and credential harvesting capabilities.

Malware#israel#defense evasionIsrael+1

The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.

Malware#backdoor#pythonPortugal+6

Shai-Hulud 2.0 is a highly aggressive and automated supply-chain malware targeting the npm ecosystem, identified in November 2025. It rapidly compromises hundreds of npm packages within hours, behaving like a worm that harvests credentials and cloud secrets. The malware leverages GitHub Actions as a persistent backdoor and creates public repositories to exfiltrate stolen data. This attack represents a significant escalation in supply-chain attack sophistication, affecting major projects and organizations globally. It results in tens of thousands of attacker-created GitHub repositories, facilitating widespread propagation. The malware automates spreading to new npm accounts, increasing infection speed and scale. It does not require user interaction once initial compromise occurs and exploits trusted software supply chains. No CVE or patch is currently available, and no known exploits in the wild have been reported yet. The attack’s medium severity rating may underestimate its potential impact given its worm-like behavior and credential theft capabilities.

Malware#supply-chain attack#npmGermany+8

The NKNShell malware campaign involves a compromised South Korean VPN provider website used to distribute a multi-stage malware payload. The threat actor Larva-24010 deploys several backdoors including MeshAgent, gs-netcat, and a novel Go-based backdoor called NKNShell, which leverages NKN and MQTT protocols for command and control. The infection chain uses trojanized installers and PowerShell scripts, employing advanced evasion techniques such as AMSI and UAC bypasses. Additional tools like SQLMap are deployed to facilitate further exploitation. While primarily targeting Korean VPN users, the sophisticated use of blockchain-based networking protocols and multiple backdoors poses risks to any users of the compromised VPN service. The campaign's medium severity reflects its complexity and targeted nature, but it has not yet been observed exploiting widespread vulnerabilities or causing large-scale impact beyond South Korea.

Campaign#nknshell#nknGermany+4