A suspected Chinese-speaking threat actor has been conducting a series of cyber attacks against government organizations in Central Asia since January 2025.…
OctLurk is a sophisticated backdoor used in attacks on Central Asian governments. It is injected into memory via a loader and communicates…
SilkLurk is a backdoor deployed via DLL side-loading. It connects to a C2 server, collects victim information, and can execute commands, update…
A Node.js backdoor deployed via fake macOS updates, using LaunchAgent for persistence and Ethereum smart contracts for C2 communication. It polls the…
WAVESHAPER.V2 is a backdoor malware used by UNC1069/Sapphire Sleet, identified in the axios npm compromise. It provides remote access and data exfiltration…
NightLedger is a Windows backdoor used by Nimbus Manticore, as detailed in a Kaspersky report. It is used to maintain persistent access…
TWOSTROKE is a C++ backdoor attributed to Iranian threat actors, particularly Tortoiseshell and Nimbus Manticore. It allows system information collection, DLL loading,…
TELESHIM is a 32-bit Windows backdoor that abuses the Telegram API for command-and-control communication. It uses DLL side-loading via RegSchdTask.exe and AsTaskSched.dll,…
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are…
TinyEgg is a lightweight initial-access backdoor that provides host profiling, interactive shell access, and persistence management. It is deployed via ClickFix social…