Threats tagged 'prc-nexus'

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.

A sophisticated cyber espionage campaign attributed to the PRC-nexus threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The attack chain involved hijacking web traffic through a captive portal redirect to deliver malware disguised as software updates. The multi-stage attack utilized advanced social engineering, adversary-in-the-middle techniques, and evasion tactics. The malware payload, SOGU.SEC backdoor, was deployed through a digitally signed downloader (STATICPLUGIN) and a side-loaded DLL (CANONSTAGER). The campaign demonstrated the evolving capabilities of PRC-nexus threat actors, employing stealthy tactics to avoid detection and leveraging legitimate Windows features for malicious purposes.

Malware#prc-nexus#social engineeringUnited Kingdom+7