Threats Tagged 'targeted-attack'

In January 2026, a new variant of the PlugX malware was observed being used in targeted attacks. Analysis suggests involvement of the UNC6384 APT group, linked to Mustang Panda, targeting government agencies in Southeast Asia. The malware uses a browser updater disguise to download and execute a malicious MSI file, leading to PlugX infection. The STATICPLUGIN downloader uses a revoked code-signing certificate from a Chinese company. The PlugX variant employs DLL sideloading and shellcode execution techniques. Its configuration is encrypted using RC4 and custom encoding. C2 servers were identified as fruitbrat[.]com and 108.165.255[.]97:443. The ongoing improvements to PlugX indicate its continued use in targeted attacks by APT groups.

MediumMalwareVietnamThailandMalaysia+3#rc4-encryption#apt#targeted-attack

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.

MediumMalwareRussiaGermanyUnited Kingdom+4#russian#mobile-malware#spyware

Apple fixes new zero-day flaw exploited in targeted attacks Source: https://www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-new-actively-exploited-zero-day/

CriticalVulnerabilityGermanyFranceNetherlands+7#infosecnews#reddit#high-priority

SonicWall Investigating Potential SSL VPN Zero-Day After 20+ Targeted Attacks Reported Source: https://thehackernews.com/2025/08/sonicwall-investigating-potential-ssl.html

CriticalVulnerabilityGermanyFranceItaly+7#infosecnews#reddit#high-priority