Cavalry Werewolf Hit Russian Government with New ShellNET Backdoor

Doctor Web uncovers a targeted cyberattack on a Russian government body by the Cavalry Werewolf group using a new ShellNET backdoor and Telegram-based control...

SesameOp Backdoor Abused OpenAI Assistants API for Remote Access

Microsoft researchers found the SesameOp backdoor using OpenAI’s Assistants API for remote access, data theft, and command communication...

Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors

Threat actors are leveraging weaponized attachments distributed via phishing emails to deliver malware likely targeting the defense sector in Russia and Belarus. According to multiple reports from Cyble and Seqrite Labs, the campaign is designed to deploy a persistent backdoor on compromised host...

Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel

Microsoft has disclosed details of a novel backdoor dubbed SesameOp that uses OpenAI Assistants Application Programming Interface API for command-and-control C2 communications. "Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as ...

SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

Microsoft Incident Response – Detection and Response Team DART researchers uncovered a new backdoor that is notable for its novel use of the OpenAI Assistants Application Programming Interface API as a mechanism for command-and-control C2 communications. Instead of relying on more traditional...

SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

Microsoft Incident Response – Detection and Response Team DART researchers uncovered a new backdoor that is notable for its novel use of the OpenAI Assistants Application Programming Interface API as a mechanism for command-and-control C2 communications. Instead of relying on more traditional...

⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & More

Cyberattacks are getting smarter and harder to stop. This week, hackers used sneaky tools, tricked trusted systems, and quickly took advantage of new security problems—some just hours after being found. No system was fully safe. From spying and fake job scams to strong ransomware and tricky...

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

The North Korea-linked threat actor known as Kimsuky has distributed a previously undocumented backdoor codenamed HttpTroy as part of a likely spear-phishing attack targeting a single victim in South Korea. Gen Digital, which disclosed details of the activity, did not reveal any details on when t...

China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems

The exploitation of a recently disclosed critical security flaw in Motex Lanscope Endpoint Manager has been attributed to a cyber espionage group known as Tick. The vulnerability, tracked as CVE-2025-61932 CVSS score: 9.3, allows remote attackers to execute arbitrary commands with SYSTEM privileg...

Malicious code in kingwork-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f5651b094b6f22f4f79f533c24bb398eb10ed340bfccdcdc75fa5dcfc98b8bf The package contains the same code to deobfuscate code as in previous packages, but the malicious code itself is missing --- Category: MALICIOUS - The campaign...

MAL-2025-191775 Malicious code in kingwork-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f5651b094b6f22f4f79f533c24bb398eb10ed340bfccdcdc75fa5dcfc98b8bf The package contains the same code to deobfuscate code as in previous packages, but the malicious code itself is missing --- Category: MALICIOUS - The campaign...

Malicious code in arno-baidu2-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 131a10e926c682b41b450810caef439af7c7137fa95422b58970a57ff2a2316d The package arno-baidu2-test was found to contain malicious code. Source: ghsa-malware 380635db26fa9fbaa70b78c6dba294a362a9342cb346a4f0542792c92b7cb7...

⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens

Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior. Each new breach proves a harsh truth: in...

MAL-2025-49377 Malicious code in github.com/boltdb-go/bolt (Git)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1cad7a46a80076eedc2c3c00be0d3215bdfed842f6cc04c238d3b2591b38e2ad This malicious git repository is a typosquat of the legitimate BoltDB Go package. It contains a backdoor that enables remote code executio...

Malicious code in github.com/boltdb-go/bolt (Git)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1cad7a46a80076eedc2c3c00be0d3215bdfed842f6cc04c238d3b2591b38e2ad This malicious git repository is a typosquat of the legitimate BoltDB Go package. It contains a backdoor that enables remote code executio...

Bitter APT Exploiting Old WinRAR Vulnerability in New Backdoor Attacks

South Asian hacking group Bitter APT-Q-37 is deploying a C backdoor using two new methods: a WinRAR flaw and malicious Office XLAM files, targeting government and military sectors...

Iran-Linked MuddyWater Targets 100+ Organizations in Global Espionage Campaign

The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa MENA region, including over 100 government entities. The...

PolarEdge Targets Cisco, ASUS, QNAP, Synology Routers in Expanding Botnet Campaign

Cybersecurity researchers have shed light on the inner workings of a botnet malware called PolarEdge. PolarEdge was first documented by Sekoia in February 2025, attributing it to a campaign targeting routers from Cisco, ASUS, QNAP, and Synology with the goal of corralling them into a network for ...

MAL-2025-48532 Malicious code in ggtech2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 402a2de5aff6b47fccb36fb23db1070eee17b8a098c87b256108ee8c7d793021 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Excellent Infotek Document Management System 代码问题漏洞

Excellent Infotek Document Management System is a document management system from Excellent Infotek Taiwan, China. A code issue vulnerability exists in the Excellent Infotek Document Management System that stems from an arbitrary file upload vulnerability that could allow an unauthenticated, remo...