Latest Backdoor news

New stealthy and modular Deadglyph malware used in govt attacks

A novel and sophisticated backdoor malware named 'Deadglyph' was seen used in a cyberespionage attack against a government agency in the Middle East.
- Bill Toulas
- September 23, 2023
- 05:00 PM
- 0
Hackers backdoor telecom providers with new HTTPSnoop malware

New malware named HTTPSnoop and PipeSnoop are used in cyberattacks on telecommunication service providers in the Middle East, allowing threat actors to remotely execute commands on infected devices.
- Bill Toulas
- September 19, 2023
- 11:14 AM
- 0
Iranian hackers backdoor 34 orgs with new Sponsor malware

A nation-state threat actor known as 'Charming Kitten' (Phosphorus, TA453, APT35/42) has been observed deploying a previously unknown backdoor malware named 'Sponsor' against 34 companies around the globe.
- Bill Toulas
- September 11, 2023
- 12:19 PM
- 0
Almost 2,000 Citrix NetScaler servers backdoored in hacking campaign

A threat actor has compromised close to 2,000 thousand Citrix NetScaler servers in a massive campaign exploiting the critical-severity remote code execution tracked as CVE-2023-3519.
- Ionut Ilascu
- August 15, 2023
- 03:41 PM
- 1
CISA: New Whirlpool backdoor used in Barracuda ESG hacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has discovered a new backdoor malware named 'Whirlpool' used in attacks on compromised Barracuda Email Security Gateway (ESG) devices.
- Bill Toulas
- August 10, 2023
- 12:06 PM
- 3
Fake VMware vConnector package on PyPI targets IT pros

A malicious package that mimics the VMware vSphere connector module 'vConnector' was uploaded on the Python Package Index (PyPI) under the name 'VMConnect,' targeting IT professionals.
- Bill Toulas
- August 04, 2023
- 07:37 AM
- 0
CISA: New Submarine malware found on hacked Barracuda ESG appliances

CISA says new malware known as Submarine was used to backdoor Barracuda ESG (Email Security Gateway) appliances on federal agencies' networks by exploiting a now-patched zero-day bug.
- Sergiu Gatlan
- July 28, 2023
- 05:27 PM
- 0
FIN8 deploys ALPHV ransomware using Sardonic malware variant

A financially motivated cybercrime gang has been observed deploying BlackCat ransomware payloads on networks backdoored using a revamped Sardonic malware version.
- Sergiu Gatlan
- July 18, 2023
- 09:15 AM
- 0
RomCom hackers target NATO Summit attendees in phishing attacks

A threat actor referred to as 'RomCom' has been targeting organizations supporting Ukraine and guests of the upcoming NATO Summit set to start tomorrow in Vilnius, Lithuania.
- Bill Toulas
- July 10, 2023
- 04:44 PM
- 0
Microsoft: Hackers hijack Linux systems using trojanized OpenSSH version

Microsoft says Internet-exposed Linux and Internet of Things (IoT) devices are being hijacked in brute-force attacks as part of a recently observed cryptojacking campaign.
- Sergiu Gatlan
- June 22, 2023
- 01:33 PM
- 3
Chinese APT15 hackers resurface with new Graphican malware

The Chinese state-sponsored hacking group tracked as APT15 has been observed using a novel backdoor named 'Graphican' in a new campaign between late 2022 and early 2023.
- Bill Toulas
- June 21, 2023
- 06:00 AM
- 0
New RDStealer malware steals from drives shared over Remote Desktop

A cyberespionage and hacking campaign tracked as 'RedClouds' uses the custom 'RDStealer' malware to automatically steal data from drives shared through Remote Desktop connections.
- Bill Toulas
- June 20, 2023
- 09:00 AM
- 0
Russian hackers use PowerShell USB malware to drop backdoors

The Russian state-sponsored hacking group Gamaredon (aka Armageddon, or Shuckworm) continues to target critical organizations in Ukraine's military and security intelligence sectors, employing a refreshed toolset and new infection tactics.
- Bill Toulas
- June 15, 2023
- 06:00 AM
- 0
New 'PowerDrop' PowerShell malware targets U.S. aerospace industry

A new PowerShell malware script named 'PowerDrop' has been discovered to be used in attacks targeting the U.S. aerospace defense industry.
- Bill Toulas
- June 06, 2023
- 09:00 AM
- 0
Dark Pink hackers continue to target govt and military organizations

The Dark Pink APT hacking group continues to be very active in 2023, observed targeting government, military, and education organizations in Indonesia, Brunei, and Vietnam.
- Bill Toulas
- May 31, 2023
- 04:00 AM
- 0
RomCom malware spread via Google Ads for ChatGPT, GIMP, more

A new campaign distributing the RomCom backdoor malware is impersonating the websites of well-known or fictional software, tricking users into downloading and launching malicious installers.
- Bill Toulas
- May 30, 2023
- 03:01 PM
- 2
‘Operation Magalenha’ targets credentials of 30 Portuguese banks

A Brazilian hacking group has been targeting thirty Portuguese government and private financial institutions since 2021 in a malicious campaign called 'Operation Magalenha.'
- Bill Toulas
- May 25, 2023
- 07:00 AM
- 0
New PowerExchange malware backdoors Microsoft Exchange servers

A new PowerShell-based malware dubbed PowerExchange was used in attacks linked to APT34 Iranian state hackers to backdoor on-premise Microsoft Exchange servers.
- Sergiu Gatlan
- May 24, 2023
- 03:17 PM
- 4
Cybercrime gang pre-infects millions of Android devices with malware

A cybercriminal tracked as the "Lemon Group" has been infecting millions of Android-based smartphones, watches, TVs, and TV boxes, with a malware strain named 'Guerilla.'
- Bill Toulas
- May 18, 2023
- 05:40 PM
- 4
Hackers infect TP-Link router firmware to attack EU entities

A Chinese state-sponsored hacking group named "Camaro Dragon" infects residential TP-Link routers with a custom "Horse Shell" malware used to attack European foreign affairs organizations.
- Bill Toulas
- May 16, 2023
- 12:25 PM
- 5