PhantomEnigma Backdoor: Modular Malware with Rotating C2 Infrastructure
PhantomEnigma is a modular backdoor built on Inno Setup and Node.js, hidden inside patched Electron applications like Boostnote. It collects system information,…
Tag: backdoor
goyim: Backdoor Component of ClickLock Stealer
goyim is a backdoor component used in ClickLock Stealer, largely a copy of the GSocket open-source tunneling toolkit. It provides an encrypted…
GSocket: Open-Source Tunneling Toolkit Used in ClickLock
GSocket is an open-source tunneling toolkit that provides encrypted reverse backdoor capabilities. Its gs-netcat component was copied in the ClickLock Stealer's goyim…
The Hacker’s Choice: Developer of GSocket Toolkit
The Hacker's Choice is the developer of the GSocket open-source tunneling toolkit, which was copied in the ClickLock Stealer's goyim backdoor.
macOS LaunchAgent Persistence Mechanism
LaunchAgent is a macOS persistence mechanism used by the Node.js backdoor in the DPRK malvertising campaign to maintain access on infected systems.
Daxin Rootkit Resurfaces in Taiwan Alongside Novel Stupig Pre-Logon Backdoor
An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm,…
Stupig Pre-Logon Backdoor: Novel Keyboard-Layout DLL Attack
Stupig (a.dll or kbdus1.dll) is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it…
Weekly Cybersecurity Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
This week's cybersecurity landscape is marked by a series of critical threats and vulnerabilities. Progress has urged ShareFile customers to shut down…
ABCDoor: Backdoor Malware
ABCDoor is a backdoor malware used by Silver Fox in their campaigns.
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
A cybercrime crew left its server exposed for three weeks, revealing the inner workings of a mass site-hacking operation tracked as WP-SHELLSTORM.…