TONESHELL: Kernel-Mode Enhanced Backdoor
TONESHELL is a backdoor associated with China-nexus threat actors, notable for its kernel-mode driver enhancements that improve stealth and persistence. It has…
Tag: backdoor
LOTUSLITE: Backdoor Malware
LOTUSLITE is a backdoor used by Mustang Panda in attacks on India's banking sector and South Korean policy circles, staged through legitimate…
ShadowPad: Modular Backdoor Used by Chinese Groups
ShadowPad is a modular backdoor that evolved from PlugX. It is widely used by Chinese hacking groups and is part of the…
TinyRCT: New Custom Backdoor Used by CL-STA-1062
TinyRCT is a previously undocumented .NET backdoor discovered by Palo Alto Networks Unit 42. It is a lightweight remote access trojan capable…
STOCKSTAY Backdoor Used by Turla in Targeted Attacks
STOCKSTAY is a previously undocumented .NET backdoor used by the Russian threat actor Turla. It shares significant code overlaps with Kazuar and…
Turla Backdoor Activity Resurfaces in Recent Campaigns
The Russian-linked Turla APT group has been deploying backdoors in new campaigns, continuing its long-standing espionage operations.
OceanLotus Targets Vietnam Investors With SPECTRALVIPER in FireAnt Supply Chain Attack
ESET has uncovered two campaigns by the Vietnam-aligned threat actor OceanLotus (APT32) targeting domestic entities and stock investors with the SPECTRALVIPER backdoor.…
SPECTRALVIPER Backdoor Analysis
SPECTRALVIPER is a backdoor used by OceanLotus, first documented by Elastic Security Labs in June 2023. It is deployed via DLL side-loading,…
China-Linked Velvet Ant Backdoored Linux PAM and OpenSSH for Nearly a Decade
Sygnia, tracking the China-nexus group as Velvet Ant, discovered that the group backdoored Linux PAM and OpenSSH components to maintain persistent access…
CVE-2024-20399: Cisco NX-OS Flaw Exploited by Velvet Ant
CVE-2024-20399 is a vulnerability in Cisco NX-OS that requires admin access and was exploited by the China-linked group Velvet Ant to plant…