Cybersecurity researchers have uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the…
A newly documented Windows backdoor named SLEEPWALKER has been detailed by independent malware researcher Dominik Reichel. The implant remains dormant in memory…
SLEEPWALKER is a Windows backdoor that remains dormant until receiving a crafted network packet. It executes commands in a custom 23-instruction bytecode…
BPFDoor is a passive backdoor used by the Red Menshen group in telecom networks. It waits for specific packets to activate and…
Red Menshen is a threat actor known for using passive backdoors like BPFDoor in telecom operator networks. Their activities were documented by…
QUICAgent is a Golang-based backdoor used in Operation QUICSILVER. It employs sandbox evasion, communicates via QUIC over UDP port 443, and supports…
RedShell is the Linux beacon component of RedC2 4.0, providing interactive shell access, system discovery, data collection, persistence, and network pivoting. It…
proc-macro1 is a typosquatted dependency of the legitimate proc-macro2 crate, used in a supply chain attack against Rust crates. Its build script…
BLOODALCHEMY is a C-based backdoor that is an updated version of Deed RAT, itself a successor to ShadowPad. It was first documented…
linuxFile (aka systemlog or linux_x86) is a backdoor deployed via cron on compromised VMware vCenter systems. It connects to a WebSocket endpoint…