Cybersecurity News
Filters
Filtered by tag: backdoor × Clear
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Matched: health
A Belarus-aligned hacker group called Partisan Zmiy spent nearly two years inside a Russian healthcare organization's network, concealing a backdoor called Vasilek within VMware Tools. Documented by Russian cybersecurity firm Solar, the group has been active since at least 2020 and has a history of targeting industrial and government entities in Russia.
Iran-Linked Hackers Expand Attacks With New Backdoor and Reverse SSH Tunnels
Matched: Australia
Iran-linked group Tortoiseshell has expanded espionage operations using a Windows backdoor and reverse SSH tunnelling tool. Both components masquerade as wtsapi32.dll and use DLL hijacking. The backdoor runs commands, transfers files and beacons via HTTPS; the tunnel routes attacker traffic through port 443 into victim networks. Group-IB identified additional infrastructure with country-themed subdomains suggesting targets across the Middle East and Europe.
New malware targets Microsoft Teams users by posing as your company's IT helpdesk
A new backdoor malware called SynkLoader is targeting Microsoft Teams users via fake IT helpdesk messages urging victims to install a malicious "PowerShell Cleaner" hosted on Azure. Key modules include PhishLocker, which displays a fake Windows login screen to steal passwords, and Interactive Shell, enabling full remote control. Organizations are advised to treat unsolicited Teams messages with suspicion and verify requests directly with IT.
Fake CAPTCHA Tricks Mac Users Into Installing a Backdoor That Steals Passwords and Mines Crypto
Matched: cryptocurrency
A ClickFix campaign is targeting Mac users with a fake CAPTCHA page styled as "TrustKey" that tricks victims into running a malicious Terminal command. The command fetches an AppleScript payload via Cloudflare Workers, installs a persistent LaunchAgent, and uses blockchain-based EtherHiding to locate its command server. The backdoor steals browser credentials, keychain data, and crypto wallet information, while also deploying XMRig to mine Monero. Any CAPTCHA requesting Terminal access should be treated as malicious.
North Korean Hackers Tied to Rust Supply Chain Attack
North Korean hackers have been linked to a supply chain attack targeting the Rust programming ecosystem. Researchers identified malicious backdoors embedded in compromised Rust packages, connecting the campaign to previously documented North Korean threat actors. The attack follows a pattern of supply chain intrusions attributed to the group, raising fresh concerns about open-source package repository security.