Latest Backdoor news

New 'PowerDrop' PowerShell malware targets U.S. aerospace industry

A new PowerShell malware script named 'PowerDrop' has been discovered to be used in attacks targeting the U.S. aerospace defense industry.
- Bill Toulas
- June 06, 2023
- 09:00 AM
- 0
Dark Pink hackers continue to target govt and military organizations

The Dark Pink APT hacking group continues to be very active in 2023, observed targeting government, military, and education organizations in Indonesia, Brunei, and Vietnam.
- Bill Toulas
- May 31, 2023
- 04:00 AM
- 0
RomCom malware spread via Google Ads for ChatGPT, GIMP, more

A new campaign distributing the RomCom backdoor malware is impersonating the websites of well-known or fictional software, tricking users into downloading and launching malicious installers.
- Bill Toulas
- May 30, 2023
- 03:01 PM
- 2
‘Operation Magalenha’ targets credentials of 30 Portuguese banks

A Brazilian hacking group has been targeting thirty Portuguese government and private financial institutions since 2021 in a malicious campaign called 'Operation Magalenha.'
- Bill Toulas
- May 25, 2023
- 07:00 AM
- 0
New PowerExchange malware backdoors Microsoft Exchange servers

A new PowerShell-based malware dubbed PowerExchange was used in attacks linked to APT34 Iranian state hackers to backdoor on-premise Microsoft Exchange servers.
- Sergiu Gatlan
- May 24, 2023
- 03:17 PM
- 4
Cybercrime gang pre-infects millions of Android devices with malware

A cybercriminal tracked as the "Lemon Group" has been infecting millions of Android-based smartphones, watches, TVs, and TV boxes, with a malware strain named 'Guerilla.'
- Bill Toulas
- May 18, 2023
- 05:40 PM
- 4
Hackers infect TP-Link router firmware to attack EU entities

A Chinese state-sponsored hacking group named "Camaro Dragon" infects residential TP-Link routers with a custom "Horse Shell" malware used to attack European foreign affairs organizations.
- Bill Toulas
- May 16, 2023
- 12:25 PM
- 5
Stealthier version of Linux BPFDoor malware spotted in the wild

A new, stealthier variant of the Linux malware 'BPFDoor' has been discovered, featuring more robust encryption and reverse shell communications.
- Bill Toulas
- May 11, 2023
- 06:02 PM
- 0
Attackers use abandoned WordPress plugin to backdoor websites

Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors.
- Bill Toulas
- April 20, 2023
- 04:02 PM
- 2
Ex-Conti members and FIN7 devs team up to push new Domino malware

Ex-Conti ransomware members have teamed up with the FIN7 threat actors to distribute a new malware family named 'Domino' in attacks on corporate networks.
- Lawrence Abrams
- April 17, 2023
- 04:36 PM
- 0
3CX confirms North Korean hackers behind supply chain attack

VoIP communications company 3CX confirmed today that a North Korean hacking group was behind last month's supply chain attack.
- Sergiu Gatlan
- April 11, 2023
- 12:08 PM
- 1
WinRAR SFX archives can run PowerShell without being detected

Hackers are adding malicious functionality to WinRAR self-extracting archives that contain harmless decoy files, allowing them to plant backdoors without triggering the security agent on the target system.
- Bill Toulas
- April 03, 2023
- 02:20 PM
- 1
Cryptocurrency companies backdoored in 3CX supply chain attack

Some of the victims affected by the 3CX supply chain attack have also had their systems backdoored with Gopuram malware, with the threat actors specifically targeting cryptocurrency companies with this additional malicious payload.
- Sergiu Gatlan
- April 03, 2023
- 01:22 PM
- 1
Hackers exploit bug in Elementor Pro WordPress plugin

Hackers are actively exploiting a high-severity vulnerability in the popular Elementor Pro WordPress plugin to install backdoors on sites.
- Bill Toulas
- March 31, 2023
- 11:52 AM
- 2
Hackers use new PowerMagic and CommonMagic malware to steal data

Security researchers have discovered attacks from an advanced threat actor that used "a previously unseen malicious framework" called CommonMagic and a new backdoor called PowerMagic.
- Ionut Ilascu
- March 21, 2023
- 04:33 PM
- 0
New malware infects business routers for data theft, surveillance

An ongoing hacking campaign called 'Hiatus' targets DrayTek Vigor router models 2960 and 3900 to steal data from victims and build a covert proxy network.
- Bill Toulas
- March 06, 2023
- 10:03 AM
- 1
Chinese hackers use new custom backdoor to evade detection

The Chinese cyber espionage hacking group Mustang Panda was seen deploying a new custom backdoor named 'MQsTTang' in attacks starting this year.
- Bill Toulas
- March 02, 2023
- 03:09 PM
- 0
Ukraine says Russian hackers backdoored govt websites in 2021

The Computer Emergency Response Team of Ukraine (CERT-UA) says Russian state hackers have breached multiple government websites this week using backdoors planted as far back as December 2021.
- Sergiu Gatlan
- February 23, 2023
- 02:50 PM
- 0
Hackers now exploit critical Fortinet bug to backdoor servers

Threat actors are targeting Internet-exposed Fortinet appliances with exploits targeting CVE-2022-39952, an unauthenticated file path manipulation vulnerability in the FortiNAC webserver that can be abused for remote command execution.
- Sergiu Gatlan
- February 22, 2023
- 02:06 PM
- 0
Hackers backdoor Microsoft IIS servers with new Frebniis malware

Hackers are deploying a new malware named 'Frebniss' on Microsoft's Internet Information Services (IIS) that stealthily executes commands sent via web requests.
- Bill Toulas
- February 16, 2023
- 11:38 AM
- 0