/
ttps_attack:T1543.003 × latest_source_host:securelist.com × criticity:high × limpar

Resultados

2 casos · pág. 1/1

securelist.com · high

Toy Ghouls deploys custom backdoors using HiveMQ MQTT and Element/Matrix as C2 against Russian organizations

Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…

Toy Ghouls Bearlyfy
securelist.com · high

Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…

Lazarus Group software construction