Swarmer: Open-Source Tool for Stealthy Persistence
Swarmer, released by Praetorian, converts Windows Registry export files into hive files to replace NTUSER.MAN, enabling stealthy HKCU registry keys without admin…
Tag: persistence
VMware vCenter CVE-2026-59310 Exploited in the Wild for Persistent Remote Access
Threat actors are actively exploiting a critical directory-traversal vulnerability in Broadcom's VMware vCenter, tracked as CVE-2026-59310 (CVSS 9.8), to gain persistent remote…
Magic-Login Backdoor: Unauthenticated Admin Access
The magic-login backdoor is a persistence module installed in the mu-plugins directory that allows unauthenticated administrative entry via a URL parameter targeting…
Wukong Application Targeted for Malicious Code Injection
The backdoor used in the Alibaba supply chain attack targets Wukong, an enterprise collaboration application, by injecting malicious code to achieve persistence…
Qoder Application Targeted for Malicious Code Injection
The backdoor used in the Alibaba supply chain attack targets Qoder, an enterprise collaboration application, by injecting malicious code to maintain persistence…
Complex Backdoor with Lateral Movement Capabilities
The final-stage payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload/download, host reconnaissance, payload staging, and lateral movement…
DingTalk Targeted for Persistence
The final-stage backdoor in the Alibaba supply chain attack injects malicious code into DingTalk, a popular enterprise collaboration app, to maintain persistence…
Pandora RC: Remote Access Agent Used for Persistence
Pandora RC is a remote access tool used by the attackers to establish remote access to victim machines. It is a legitimate…
HollowFrame: A Go-Based Modular Loader and Persistence Framework
HollowFrame is a previously undocumented Go-based loader framework used in a spear-phishing attack targeting a law firm. It is launched via DLL…
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its…