HollowFrame: A Go-Based Modular Loader and Persistence Framework
HollowFrame is a previously undocumented Go-based loader framework used in a spear-phishing attack targeting a law firm. It is launched via DLL…
Tag: persistence
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its…
SmartLoader Malware: Persistence and Payload Delivery
SmartLoader is a malware family used in the FakeGit campaign to establish persistence on compromised systems and deploy secondary payloads like StealC.…
SleeperGem Attack: Three Malicious RubyGems Packages Target Developer Machines
Cybersecurity researchers have uncovered a sophisticated software supply chain attack dubbed 'SleeperGem' targeting the Ruby ecosystem. Three malicious gems were published to…
SleeperGem: RubyGems Supply Chain Attack
SleeperGem is a software supply chain attack targeting the Ruby ecosystem through three malicious RubyGems packages. The malware acts as a loader,…
ORANGETAIL: Custom Java Web Shell Deployed in SonicWall Attacks
ORANGETAIL is a Behinder-like custom Java web shell used by threat actors to maintain persistent access on compromised SonicWall SMA 1000 appliances.…
macOS LaunchAgent Persistence Mechanism
LaunchAgent is a macOS persistence mechanism used by the Node.js backdoor in the DPRK malvertising campaign to maintain access on infected systems.
Stupig Pre-Logon Backdoor: Novel Keyboard-Layout DLL Attack
Stupig (a.dll or kbdus1.dll) is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it…
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security,…
XEOX: Remote Monitoring and Management Tool Used for Persistence
XEOX is a remote monitoring and management (RMM) tool deployed by phishing operators for persistence on compromised systems, often installed at C:Program…