Backdooring Android APK: backdoor-apk

Backdooring Android APK backdoor-apk is a shell script that simplifies the process of adding a backdoor to any Android APK file. Users of this shell script should have working knowledge of Linux, Bash, Metasploit, Apktool, the Android SDK, smali, etc. This shell script is provided as-is without...

NetWire RAT Back, Stealing Payment Card Data

The remote access Trojan NetWire is back and this time making the rounds pilfering payment card data. The move is a shift for attackers behind notorious NetWire, that was once thought to be the first multi-platform RAT. Over the last couple of years payment card breaches have been mostly synonymo...

New Trojan SpyNote Installs Backdoor on Android Devices

A new Android Trojan called SpyNote has been identified by researchers who warn that attacks are forthcoming. The Trojan, found by Palo Alto Networks’ Unit 42 team, has not been spotted in any active campaigns, but it is now widely available on the Dark Web and that it will soon be used in a wave...

Adwind RAT Resurfaces, Targeting Danish Companies

The remote access Trojan Adwind has resurfaced and as of last weekend, is being used in spam emails targeting Danish companies, researchers said. In emails purporting to be order requests coming from either spoofed or fake return addresses, attackers are spreading malicious .jar, or Java archive...

Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)

include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...

Linux 64bit Ncat Shellcode SSL, MultiChannel, Persistant, Fork, IPv4/6, Password - 176 bytes

Linux 64bit Ncat Shellcode SSL, MultiChannel, Persistant, Fork, IPv4/6, Password - 176 bytes. Shellcode exploit for linx86-64 platform include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author:...

Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)

include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...

Vitaly Kamluk on the Adwind RAT

Mike Mimoso talks to Kaspersky Lab researcher Vitaly Kamluk who was critical in the discovery of the latest version of the cross-platform Adwind RAT. The remote access Trojan is unique in that it’s written in Java, giving this version—which is also known as Frutas, AlienSpy and JSocket—the...

Creator of MegalodonHTTP DDoS Botnet Arrested

Last month, the Norway police arrested five hackers accused of running the MegalodonHTTP Remote Access Trojan RAT. The arrests came as part of the joint operation between Norway’s Kripos National Criminal Investigation Service and Europol, codenamed "OP Falling sTAR." According to the United Stat...

LATENTBOT: Trace Me If You Can

FireEye Labs recently uncovered LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless...

Moker RAT Bypassing Security Measures, Evading Detection

Researchers warned Tuesday the latest APT to make the rounds features a remote access Trojan that can effectively mitigate security measures on machines and grant the attacker full access to the system. Experts with the Israeli cyber security start-up enSilo discovered the RAT – which they refer ...

Musical Chairs Campaign Found Deploying New Gh0st RAT Variant

Researchers have peeled back the layers on a new campaign that spans multiple years and involves a new variant of the ubiquitous Gh0st remote access tool RAT. The campaign, now believed to in its sixth year, is dubbed Musical Chairs, according to new research from Palo Alto Networks published...

FBI’s Cyber Task Force Identifies Stealthy FF-RATs used in Cyber Attack

In both April and June this year, a series of cyber attacks was conducted against the United States Office of Personnel Management OPM. These attacks resulted in 21 million current and former Federal government employees’ information being stolen. After months of investigation, the FBI’s Cyber Ta...

Researchers Outline New Italian RAT uWarrior

Details have come to light about a new remote access Trojan called uWarrior that arrives embedded in a rigged .RTF document. Researchers with Palo Alto Networks’ research division, Unit 42, described the malware and how it appears to have emanated from an “unknown actor of Italian origin,” in a...

Keeper IP Camera 3.2.2.10 - Authentication Bypass Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Keeper IP Camera - Authentication Bypass Date: 25/08/2015 Exploit Author: RAT - ThiefKing Vendor Homepage: http://www.keeper.cn/en/Camera-ip.asp Version: 3.2.2.10 WEB Version: 6.1.17.192 Tested on: QB200W, QB130W, QA130W,...

Keeper IP Camera 3.2.2.10 - Authentication Bypass

Keeper IP Camera 3.2.2.10 - Authentication Bypass Exploit Title: Keeper IP Camera - Authentication Bypass Date: 25/08/2015 Exploit Author: RAT - ThiefKing Vendor Homepage: http://www.keeper.cn/en/Camera-ip.asp Version: 3.2.2.10 WEB Version: 6.1.17.192 Tested on: QB200W, QB130W, QA130W,... Exploit...

Impero Education Pro - System Remote Command Execution

Impero Education Pro - System Remote Command Execution / If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftware.co.uk/ They recently were in the news about how they implemented "anti-radicalisation" shit or something. They had a boot...

New Evasion Techniques Help AlienSpy RAT Spread Citadel Malware

Hackers have co-opted AlienSpy, a remote access tool, to deliver the Citadel banking Trojan and establish backdoors inside a number of critical infrastructure operations. AlienSpy is a descendent of the Adwind, Unrecom and Frutas Java-based remote access Trojans, according to security company...

IcoScript RAT Malware Communicates Via Yahoo! Mail

A new remote administration Trojan RAT receives command and control instructions through Yahoo Mail, and could be easily modified to communicate with its authors through Gmail or other popular webmail providers. This new RAT’s significance stems primarily from its ability to elude the notice of...

Fedora Update for kernel FEDORA-2014-8487

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...