CVE-2023-4467 Poly Trio 8800 Test Automation Mode backdoor

A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been...

CVE-2023-4467

CVE-2023-4467 affects Poly Trio 8800, version 7.2.6.0019, in the Test Automation Mode component. Multiple sources describe a backdoor that can be triggered on the physical device, with the exploit publicly disclosed. Red Hat and CVE listings corroborate the issue, and a PoC/exploit for Telnet/roo...

New Sneaky Xamalicious Android Malware Hits Over 327,000 Devices

A new Android backdoor has been discovered with potent capabilities to carry out a range of malicious actions on infected devices. Dubbed Xamalicious by the McAfee Mobile Research Team, the malware is so named for the fact that it's developed using an open-source mobile app framework called Xamar...

Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware

A new phishing campaign is leveraging decoy Microsoft Word documents as bait to deliver a backdoor written in the Nim programming language. "Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers' unfamiliarity can hamp...

Microsoft Warns of New 'FalseFont' Backdoor Targeting the Defense Sector

Organizations in the Defense Industrial Base DIB sector are in the crosshairs of an Iranian threat actor as part of a campaign designed to deliver a never-before-seen backdoor called FalseFont. The findings come from Microsoft, which is tracking the activity under its weather-themed moniker Peach...

Iran’s Peach Sandstorm Deploy FalseFont Backdoor in Defense Sector

By Waqas Peach Sandstorm, also recognized as HOLMIUM, has recently focused on global Defense Industrial Base DIB targets. This is a post from HackRead.com Read the original post: Irans Peach Sandstorm Deploy FalseFont Backdoor in Defense Sector...

New Malvertising Campaign Distributing PikaBot Disguised as Popular Software

The malware loader known as PikaBot is being distributed as part of a malvertising campaign targeting users searching for legitimate software like AnyDesk. "PikaBot was previously only distributed via malspam campaigns similarly to QakBot and emerged as one of the preferred payloads for a threat...

Gaza Cybergang’s Pierogi++ Upgrade Takes Center Stage

Summary: The Gaza Cybergang, a sophisticated threat actor, has recently intensified its attacks by deploying an advanced version of the Pierogi backdoor malware. This group focuses its cyber operations primarily on Palestinian entities and Israel, with a historical record of targeting entities...

116 Malware Packages Found on PyPI Repository Infecting Windows and Linux Systems

Cybersecurity researchers have identified a set of 116 malicious packages on the Python Package Index PyPI repository that are designed to infect Windows and Linux systems with a custom backdoor. "In some cases, the final payload is a variant of the infamous W4SP Stealer, or a simple clipboard...

Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol

During an incident response performed by Kasperskys Global Emergency Response Team GERT and GReAT, we uncovered a novel multiplatform threat named "NKAbuse". The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and...

The Unseen Thread Linking Sandman APT and KEYPLUG Backdoor

Summary: The Sandman Advanced Persistent Threat APT is closely linked to suspected threat clusters originating from China, specifically identified as Storm-0866, also known as Red Dev 40. Within the same victim environments, the Sandmans Lua-based malware, LuaDream, and the KEYPLUG backdoor have...

Fake Resumes, Real Malware: TA4557 Exploits Recruiters for Backdoor Access

By Waqas TA4557 is a financially motivated threat actor known to distribute the MoreEggs backdoor against recruiters on LinkedIn. This is a post from HackRead.com Read the original post: Fake Resumes, Real Malware: TA4557 Exploits Recruiters for Backdoor Access...

CVE-2023-6614

A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-6614 Typecho Page manage-pages.php backdoor

A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-6614

CVE-2023-6614 concerns Typecho 1.2.1. The vulnerability affects the file /admin/manage-pages.php in the Page Handler component, where manipulation can lead to a backdoor. Exploitation can be performed remotely, and the public exploit has been disclosed. Multiple references corroborate Typecho 1.2...

CVE-2023-6614 Typecho Page manage-pages.php backdoor

A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclos...

N. Korea's Kimsuky Targeting South Korean Research Institutes with Backdoor Attacks

The North Korean threat actor known as Kimsuky has been observed targeting research institutes in South Korea as part of a spear-phishing campaign with the ultimate goal of distributing backdoors on compromised systems. "The threat actor ultimately uses a backdoor to steal information and execute...

PT-2023-32716 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A vulnerability was found in the file /admin/manage-pages.php of the component Page Handler, which can lead to a backdoor. The attack can be launched remotely. The exploit has been disclosed to the public an...

Novel Tool Set Targeting Entities in the Middle East, Africa, and U.S.

Summary: An undisclosed threat actor has targeted organizations in the Middle East, Africa, and the U.S., deploying a newly identified backdoor named Agent Racoon. The attacker utilizes tools like Ntospy and a customized version of Mimikatz called Mimilite to carry out malicious activities. Threa...

PT-2023-29423 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress affected versions not specified Description: A phishing campaign is targeting WordPress administrators with fake security advisories regarding a non-existent vulnerability. The emails aim to trick users into installing a malicious...