CVE-2022-42044

The CVE-2022-42044 issue concerns the d8s-asns package for Python (PyPI), with a backdoor component democritus-html inserted by a third party in version 0.1.0. Affected component/file is the PyPI package content that includes the democritus-html backdoor, enabling potential code execution. Exploi...

CVE-2022-42038

CVE-2022-42038 affects the Python package d8s-ip-addresses on PyPI, with version 0.1.0 containing a backdoor (democritus-csv) inserted by a third party that can enable remote code execution. The issue is documented across multiple connected sources confirming a code-execution backdoor rather than...

CVE-2022-42040

The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0...

PT-2022-25835 · Pypi · D8S-Domains +1

Name of the Vulnerable Software and Affected Versions: d8s-domains version 0.1.0 Description: The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. Recommendations: For versi...

CVE-2022-42041

CVE-2022-42041 affects the Python d8s-file-system package distributed on PyPI (version 0.1.0). The incident involves a backdoor code path introduced by a third party, specifically the democritus-hashes package, enabling potential code execution. The available Connected documents confirm the backd...

CVE-2022-41387

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

CVE-2022-42042

The issue centers on d8s-networking for Python (PyPI): version 0.1.0 allegedly contains a third‑party backdoor, democritus-hashes, enabling potential code execution. Red Hat and CNVD entries reiterate the same description; Red Hat notes the affected version 0.1.0 and branding as a Python PyPI pac...

CVE-2022-41387

CVE-2022-41387 concerns the Python package d8s-pdfs distributed on PyPI. The description states that a potential code-execution backdoor was inserted by a third party, specifically via the backdoor package democritus-urls , affecting version 0.1.0. The incident implies that installing or using th...

CVE-2022-41382

The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

LofyGang Distributed ~200 Malicious NPM Packages to Steal Credit Card Data

Multiple campaigns that distributed trojanized and typosquatted packages on the NPM open source repository have been identified as the work of a single threat actor dubbed LofyGang. Checkmarx said it discovered 199 rogue packages totaling thousands of installations, with the group operating for...

Hundreds of Microsoft SQL servers found to be backdoored

Researchers at DCSO CyTec recently found a backdoor that specifically targets Microsoft SQL servers. The malware acts as an Extended Stored Procedure, which is a special type of extension used by Microsoft SQL servers. After scanning approximately 600,000 servers worldwide, they found 285 servers...

Comm100 Chat Provider Hijacked to Spread Malware in Supply Chain Attack

A threat actor likely with associations to China has been attributed to a new supply chain attack that involves the use of a trojanized installer for the Comm100 Live Chat application to distribute a JavaScript backdoor. Cybersecurity firm CrowdStrike said the attack made use of a signed Comm100...

Backdoor.Win32.NTRC MVID-2022-0646 Hardcoded Credential

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/273fd3f33279cc9c0378a49cf63d7a06.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.NTRC Vulnerability: Weak Hardcoded Credentials Family: NTRC Type: PE32 MD5:...

Prilex: the pricey prickle credit card complex

Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware. The group was behind one of the largest attacks on ATMs in the country, infecting and jackpotting more than 1,000 machines, while also cloning in excess of 28,000 credit cards that...

Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor

A China-aligned advanced persistent threat actor known as TA413 weaponized recently disclosed flaws in Sophos Firewall and Microsoft Office to deploy a never-before-seen backdoor called LOWZERO as part of an espionage campaign aimed at Tibetan entities. Targets primarily consisted of organization...

OSRipper - AV Evading OSX Backdoor And Crypter Framework

OSripper is a fully undetectable Backdoor generator and Crypter which specialises in OSX M1 malware. It will also work on windows but for now there is no support for it and it IS NOT FUD for windows yet at least and for now i will not focus on windows. You can also PM me on discord for support or...

Remote Code Execution

d8sipaddresses is vulnerable to remote code execution. The democritus-hypothesis is a potential code-execution backdoor inserted by a third party, which allows an attacker to upload and execute malicious code on the system under attack...

UNC4034 slips in a backdoor with trojanized PuTTY

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary UNC4034, a North Korean threat actor, uses a fake job posting to trick victims into downloading a trojanized version of PuTTY. When the malicious PuTTY binary is executed on the host, a backdoor named...

Remote Code Execution

d8sdicts is vulnerable to remote code execution. The democritus-hypothesis is a potential code-execution backdoor inserted by a third party, which allows an attacker to upload and execute malicious code on the system under attack...

Arbitrary Code Execution

d8s-urls is vulnerable to arbitrary code execution. The vulnerability exists because the democritus-networking package of a specific version of d8s-urls acts as a potential code execution third party backdoor which allows an attacker to inject and execute malicious codes in to the system...