/
ttps_attack:T1016 × criticity:high × limpar

Resultados

2 casos · pág. 1/1

securelist.com · high

Toy Ghouls deploys custom backdoors using HiveMQ MQTT and Element/Matrix as C2 against Russian organizations

Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…

Toy Ghouls Bearlyfy
thehackernews.com · · 2 fontes · 2 atualizações high

BRONZE SANDCASTLE: suspected China-based cluster uses Sandboxie DLL sideloading and custom backdoors to steal ntds.dit in Asia and Africa

BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…

BRONZE SANDCASTLE