7 casos · pág. 1/1
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hosting panel identified by Forescout researchers on October 14 that…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
ESET Research reports that the China-aligned APT group FamousSparrow has been using a new modular C++ backdoor, SparroWocky, since at least August 2025. The backdoor has replaced SparrowDoor as the group's main implant. From mid-2025 into 2026, about 90% of the group's targets in ESET telemetry were in Latin America, mostly governmental e…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…
BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
