New Supermicro BMC flaws can create persistent backdoors
Source: https://www.bleepingcomputer.com/news/security/new-supermicro-bmc-flaws-can-create-persistent-backdoors/
A new multi-stage ClickFix campaign, attributed to the Russia-linked APT group COLDRIVER, has been discovered targeting Russian civil society members. The campaign employs social engineering techniques to trick users into executing malicious commands, leading to the deployment of two new malware families: BAITSWITCH (a downloader) and SIMPLEFIX (a PowerShell-based backdoor). The attack chain involves a fake Cloudflare Turnstile checkbox, persistence establishment, and data exfiltration. COLDRIVER's tactics include using server-side checks, obfuscation techniques, and targeting specific file types for intelligence collection. The group's focus on NGOs, human rights defenders, and Russian exiles aligns with their known victimology.
UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors
Source: https://thehackernews.com/2025/09/unc5221-uses-brickstorm-backdoor-to.html
New YiBackdoor Malware Shares Major Code Overlaps with IcedID and Latrodectus
Source: https://thehackernews.com/2025/09/new-yibackdoor-malware-shares-major.html
This report details a campaign involving NodeJS backdoors used to distribute proxyware and monetization schemes. The attackers employ Inno setup installers to drop PowerShell scripts that download and execute NodeJS packages with malicious JavaScript. The backdoors collect system information, communicate with command and control servers, and can execute various commands including PowerShell scripts and additional Node.js code. The campaign is associated with multiple proxyware applications like Infatica, Honeygain, earnFM, and PacketLab. The attackers also use browser extensions to track user navigation and potentially redirect to malicious URLs. The infrastructure involves numerous domains and cloud services for hosting malware and command and control.
Two malicious files were discovered on a compromised WordPress website, designed to manipulate administrator accounts and maintain unauthorized access. The first file, disguised as a plugin called 'DebugMaster Pro', created a secret admin user and communicated with a command and control server. The second file, 'wp-user.php', ensured a specific admin user with a known password was always present. Both files worked together to create a robust system for persistent access, allowing attackers to control the site, inject spam, redirect visitors, or steal information. The malware also injected malicious scripts for visitors and tracked admin IPs. Cleaning requires removing the files, auditing accounts, resetting credentials, and hardening the site against reinfection.
A 2D platformer game called BlockBlasters on Steam has been infected with malware disguised as a patch. The malicious update, released on August 30, 2025, contains files that exhibit multiple malicious behaviors, including stealing crypto wallet data and other sensitive information from users' PCs. The infection process involves multiple stages, including a trojan stealer batch file, VBS loaders, and the main payload consisting of a backdoor and the StealC stealer malware. The campaign affects hundreds of players who have installed the game. The malware collects IP and location information, detects installed antivirus products, gathers login credentials, and uploads data to command and control servers. The game has since been removed from Steam, but not before causing significant damage to unsuspecting users.
Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs
Source: https://thehackernews.com/2025/09/mustang-panda-deploys-snakedisk-usb.html
In mid-2025, China-aligned threat actor Hive0154 deployed new malware variants, including an updated Toneshell backdoor and a novel USB worm called SnakeDisk. Toneshell9 evades detection and supports C2 communication through local proxies. SnakeDisk only executes on devices in Thailand, propagating via USB drives and dropping the Yokai backdoor. The malware shows code overlaps with previous Tonedisk variants. Hive0154 continues to refine its large malware arsenal, targeting organizations worldwide with frequent development cycles. The group uses multiple custom loaders, backdoors, and USB worm families, showcasing advanced capabilities. Defenders should monitor for suspicious network activity, USB drives with hidden components, and implement recommended security measures to mitigate risks from this evolving threat.
A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core component, EggStremeAgent, is a full-featured backdoor enabling extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. The attack begins with EggStremeFuel deploying EggStremeLoader to set up a persistent service, which then executes EggStremeReflectiveLoader to launch EggStremeAgent. The framework's fileless nature and use of legitimate Windows processes make it difficult to detect, posing a significant and persistent threat.
ChillyHell is a sophisticated macOS backdoor discovered in 2021 that has evaded detection by antivirus vendors. It is a modular C++ malware targeting Intel architectures, using multiple persistence mechanisms and communication protocols. The backdoor performs host profiling, establishes persistence through LaunchAgents, LaunchDaemons, or shell profile injection, and communicates with command and control servers via DNS or HTTP. ChillyHell's modular structure allows for various capabilities, including reverse shell access, self-updating, payload execution, and local password cracking. The malware's flexibility, stealth techniques, and notarization status make it a significant threat in the macOS landscape.
New Buterat Backdoor Malware Found in Enterprise and Government Networks
Source: https://hackread.com/buterat-backdoor-malware-enterprise-govt-networks/
ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.
LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.
Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
Source: https://thehackernews.com/2025/09/researchers-warn-of-mystrodx-backdoor.html
A detailed analysis of a malicious PDF editor application called AppSuite PDF Editor reveals it to be a sophisticated backdoor. The software, masquerading as a legitimate productivity tool, is distributed through high-ranking websites. Once installed, it creates scheduled tasks and establishes persistence mechanisms. The backdoor communicates with command and control servers, allowing threat actors to execute arbitrary commands, exfiltrate data, and manipulate browser settings. It specifically targets Chromium-based browsers and other applications like Wave browser, Shift browser, and OneLaunch. The malware employs advanced techniques such as AES encryption, custom obfuscation, and event logging to evade detection. The analysis concludes that AppSuite PDF Editor is definitively malicious and should be classified as a trojan horse with backdoor capabilities.
MystRodX is a sophisticated backdoor discovered in June 2025, featuring stealth and flexibility. It uses multi-layer encryption for sensitive information and can operate in active or passive modes. The backdoor supports file management, port forwarding, reverse shell, and socket management. Its passive mode can be activated by specific DNS or ICMP packets. Analysis reveals a dual-process guardian mechanism and configurable communication protocols. Three active command and control servers were identified, indicating ongoing threat activity. The backdoor's low detection rate and long-term presence in networks since January 2024 highlight its effectiveness in evading security measures.
A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.
