China-nexus APT Exploits vCenter Vulnerability
A suspected China-nexus advanced persistent threat actor exploited CVE-2026-59310 to deploy backdoors and reverse_ssh binaries, leading to Babuk ransomware in some cases.
Tag: backdoor
Auto-Color: Backdoor Deployed via SAP NetWeaver Exploit
Auto-Color is a backdoor that was deployed in an attack against a U.S.-based chemicals company in April 2025, exploiting the critical SAP…
CVE-2025-31324: SAP NetWeaver Vulnerability Exploited by Multiple Threat Actors
CVE-2025-31324 is a critical vulnerability in SAP NetWeaver that has been weaponized by China-nexus espionage clusters such as UNC5221, UNC5174, and CL-STA-0048,…
Mustang Panda Deploys Signed Windows Rootkit in Updated CoolClient Backdoor
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
COOLCLIENT: Updated Backdoor with Kernel-Mode Driver
COOLCLIENT is a backdoor used by Mustang Panda. An updated variant deploys a signed kernel-mode driver (Msagent.sys) to hide processes and protect…
PATCHCORD Backdoor: New Implant Targets Afghan Telecom and Indian Energy Sector
PATCHCORD is a previously undocumented C/C++ backdoor delivered via fake VPN installers and telecom management tools. It establishes persistence by hijacking browser…
SHEETCORD: Go-Based Backdoor Uses Google Sheets for C2
SHEETCORD is a Go-based backdoor that uses Google Sheets API for command-and-control. It is delivered via a fake NIC website and combines…
Lazarus Group Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job Attacks
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…
Troy Backdoor: New Malware Used by Lazarus Group
Troy is a previously unseen backdoor deployed by the Lazarus Group in Operation Dream Job attacks. It is loaded directly into memory…
ForestTiger (ScoringMathTea) Backdoor
ForestTiger, also known as ScoringMathTea, is a backdoor used by Lazarus Group to provide remote access to compromised hosts. It is deployed…