North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
Tag: remote access
Go2Tunnel: Remote Access and Network Tunneling Tool
Go2Tunnel is a tool used by Armored Likho for remote access and network tunneling, establishing reverse SSH tunnels to C2 servers. It…
Visual Studio Code: SSH Connections Configured by Storm-2603
Storm-2603 configured SSH connections through Visual Studio Code as part of multiple remote access channels during attacks.
NetScaler Gateway: Secure Remote Access Solution
NetScaler Gateway (formerly Citrix Gateway) is a secure remote access solution that provides VPN and application access for users.
Zoho Assist: Remote Access Tool Abused by Storm-2603
Zoho Assist was used by Storm-2603 as one of multiple remote access channels during ransomware attacks, alongside Cloudflare tunneling and SSH.
Citrix Receiver: Remote Access Client
Citrix Receiver is a remote access client whose signed binary was abused for DLL sideloading by Mustang Panda.
DEV#POPPER RAT: Remote Access Trojan in PolinRider Campaign
A remote access trojan delivered as a second-stage payload in the PolinRider campaign. Unpacked from encrypted payloads fetched via blockchain services like…
OtterCookie: JavaScript Malware for Remote Control and Data Theft
OtterCookie is a JavaScript malware family linked to North Korean campaigns, capable of remote access, command execution, screenshot capture, and data theft…
Gh0st RAT: Remote Access Trojan Used in Targeted Attacks
Gh0st RAT is a remote access trojan (RAT) that has been used in various cyber espionage campaigns. It allows attackers to remotely…
ValleyRAT: Malware Family Linked to Chinese Cyber Operations
ValleyRAT is a malware family associated with Chinese cyber espionage groups. It is used for remote access and data theft, often delivered…