10 casos · pág. 1/1
F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cybe…
SafeDep found a remote access implant in mathmain, an npm package that copies mathjs, and in two sibling packages, mathsbase and math-universe. The malicious code ships AES-256-GCM encrypted and activates only when lusolve() is called with matrix data whose LU lower factor serializes to a specific password. Once decrypted, the implant tak…
Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named PropositionProjet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts th…
ThreatFabric has documented Hirudo, an Android banking remote-access trojan that steals credentials and gives operators remote control of the phone. Its distinguishing feature is replacing selected genuine banking apps with modified copies that interfere with security checks from inside the app. Victims first install a lure app (Shopora, …
SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4 under v4.0, 6.7 under v3.1; CWE-427 uncontrolled DLL search path), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hos…
A cluster of unrelated but concurrent security events hit on 21 October 2026. Reuters reported government websites worldwide going offline after AI-discovered critical vulnerabilities in PHP, and the NSA advised organizations to update immediately or take PHP systems offline. The same day, Node.js patched four high-severity flaws, and Lit…
A ClickFix malvertising campaign uses sponsored Google results for "amazon business" to lure victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard that the victim is told to run in the Windows Run box. The command abuses the legacy finger.exe utility to fetch a …
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
