reverse_ssh Backdoor Used for Persistent Access
The China-nexus APT used reverse_ssh binaries to maintain persistent access to compromised vCenter instances.
Tag: backdoor
GoReShell: Windows Backdoor Using Reverse SSH
GoReShell is a Windows backdoor used by the PurpleHaze threat cluster. It leverages functionalities from the reverse_ssh tool to establish reverse SSH…
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain attack targeting WordPress plugin vendor BdThemes, leading to the temporary suspension of several plugins from…
CVE-2026-18072: Advanced Responsive Video Embedder Backdoor
CVE-2026-18072 is a vulnerability in the Advanced Responsive Video Embedder WordPress plugin that was exploited in a supply chain attack to grant…
Magic-Login Backdoor: Unauthenticated Admin Access
The magic-login backdoor is a persistence module installed in the mu-plugins directory that allows unauthenticated administrative entry via a URL parameter targeting…
Head Mare Exploits TrueConf Server Flaws to Replace Client Installers with PhantomCore Backdoor
Russian cybersecurity vendor Kaspersky has uncovered a new attack campaign by the threat actor known as Head Mare, targeting unpatched TrueConf videoconferencing…
PhantomCore: Backdoor and RAT Delivered via TrueConf Installers
PhantomCore is a backdoor and remote access trojan (RAT) delivered through poisoned TrueConf client installers. It is part of an attack chain…
PhantomGraph: Backdoor with OneDrive C2
PhantomGraph is a backdoor that shares code overlap with PhantomCore. It consists of two DLL modules: SysExcSvc.dll for receiving commands and exfiltrating…
CanisterWorm: Backdoor Deployed on Kubernetes Nodes Outside Iran
CanisterWorm is a backdoor deployed by TeamPCP on Kubernetes nodes located outside Iran. It is part of the group's evolving malware arsenal,…
Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
Cybersecurity researchers have disclosed details of a factory-shipped backdoor implanted in at least 20 Chinese router models from Zbtlink. According to a…