6 casos · pág. 1/1
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
ESET Research reports that the China-aligned APT group FamousSparrow has been using a new modular C++ backdoor, SparroWocky, since at least August 2025. The backdoor has replaced SparrowDoor as the group's main implant. From mid-2025 into 2026, about 90% of the group's targets in ESET telemetry were in Latin America, mostly governmental e…
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents.org, so trackers relyin…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…
BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…
Symantec reports that the Russia-linked APT28 (aka Swallowtail, Fancy Bear, Forest Blizzard, BlueDelta), which the U.S. government links to the GRU, targeted organizations in two NATO member states. Victims were a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency (thehackernews.com, cyberscoop.com…
