home.social

#https — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #https, aggregated by home.social.

  1. An article by TechTimes covers VPNs, password managers, HTTPS, secure DNS, and 2FA for reducing tracking and improving account security. 🔒
    It also highlights privacy-focused browsers, stricter permissions, and safer browsing habits that strengthen user control over online data. 🌐

    🔗 techtimes.com/articles/316454/

    #TechNews #Privacy #Cybersecurity #VPN #PasswordManager #2FA #HTTPS #DNS #OpenSource #Encryption #Security #FOSS #Tracking #Browsers #DigitalRights #Cybersecurity #Freedom #Surveillance

  2. remember to all users of our #hispagatos instance #hispagatos.space that announcements for downtime & support for all our services including but not limited to #mastodon like #matrix #reticulum #gemini #gopher and #https sites are in our #usenet newsgroups hierarchy under hispagatos.comunicados and hispagatos.ayuda & hispagatos.talk most usenet2.0 community servers carry them sybershock.com/#usenet ask your admin

    #HackerCulture #Decentralization #FreeSoftware #libreCulture #DigitalRights

  3. remember to all users of our #hispagatos instance #hispagatos.space that announcements for downtime & support for all our services including but not limited to #mastodon like #matrix #reticulum #gemini #gopher and #https sites are in our #usenet newsgroups hierarchy under hispagatos.comunicados and hispagatos.ayuda & hispagatos.talk most usenet2.0 community servers carry them sybershock.com/#usenet ask your admin

    #HackerCulture #Decentralization #FreeSoftware #libreCulture #DigitalRights

  4. remember to all users of our #hispagatos instance #hispagatos.space that announcements for downtime & support for all our services including but not limited to #mastodon like #matrix #reticulum #gemini #gopher and #https sites are in our #usenet newsgroups hierarchy under hispagatos.comunicados and hispagatos.ayuda & hispagatos.talk most usenet2.0 community servers carry them sybershock.com/#usenet ask your admin

    #HackerCulture #Decentralization #FreeSoftware #libreCulture #DigitalRights

  5. remember to all users of our #hispagatos instance #hispagatos.space that announcements for downtime & support for all our services including but not limited to #mastodon like #matrix #reticulum #gemini #gopher and #https sites are in our #usenet newsgroups hierarchy under hispagatos.comunicados and hispagatos.ayuda & hispagatos.talk most usenet2.0 community servers carry them sybershock.com/#usenet ask your admin

    #HackerCulture #Decentralization #FreeSoftware #libreCulture #DigitalRights

  6. remember to all users of our #hispagatos instance #hispagatos.space that announcements for downtime & support for all our services including but not limited to #mastodon like #matrix #reticulum #gemini #gopher and #https sites are in our #usenet newsgroups hierarchy under hispagatos.comunicados and hispagatos.ayuda & hispagatos.talk most usenet2.0 community servers carry them sybershock.com/#usenet ask your admin

    #HackerCulture #Decentralization #FreeSoftware #libreCulture #DigitalRights

  7. Por si alguien se ha instalado @forgejo y utiliza #Pangolin para acceder al servicio, si además quieres hacer un “git push” por #SSH en vez de #HTTPS, aquí hay un artículo que explica muy bien cómo crear un recurso #TCP: digitalquint.click/posts/acces. Pero es importante, que si en vuestro #Hosting tenéis un #Firewall (cortafuegos), abráis el puerto asignado al acceso SSH. (1/2)

  8. Por si alguien se ha instalado @forgejo y utiliza #Pangolin para acceder al servicio, si además quieres hacer un “git push” por #SSH en vez de #HTTPS, aquí hay un artículo que explica muy bien cómo crear un recurso #TCP: digitalquint.click/posts/acces. Pero es importante, que si en vuestro #Hosting tenéis un #Firewall (cortafuegos), abráis el puerto asignado al acceso SSH. (1/2)

  9. Por si alguien se ha instalado @forgejo y utiliza #Pangolin para acceder al servicio, si además quieres hacer un “git push” por #SSH en vez de #HTTPS, aquí hay un artículo que explica muy bien cómo crear un recurso #TCP: digitalquint.click/posts/acces. Pero es importante, que si en vuestro #Hosting tenéis un #Firewall (cortafuegos), abráis el puerto asignado al acceso SSH. (1/2)

  10. Por si alguien se ha instalado @forgejo y utiliza #Pangolin para acceder al servicio, si además quieres hacer un “git push” por #SSH en vez de #HTTPS, aquí hay un artículo que explica muy bien cómo crear un recurso #TCP: digitalquint.click/posts/acces. Pero es importante, que si en vuestro #Hosting tenéis un #Firewall (cortafuegos), abráis el puerto asignado al acceso SSH. (1/2)

  11. Por si alguien se ha instalado @forgejo y utiliza #Pangolin para acceder al servicio, si además quieres hacer un “git push” por #SSH en vez de #HTTPS, aquí hay un artículo que explica muy bien cómo crear un recurso #TCP: digitalquint.click/posts/acces. Pero es importante, que si en vuestro #Hosting tenéis un #Firewall (cortafuegos), abráis el puerto asignado al acceso SSH. (1/2)

  12. 📢🔔 Just 1 more month to submit your talk at Game Hacking Village - DEF CON 34 cc @https:x.comGameHackingGG! cfptime.org/cfps/3422/ #cfp #infosec #https:x.comGameHackingGG

  13. 📢🔔 Just 1 more month to submit your talk at Game Hacking Village - DEF CON 34 cc @https:x.comGameHackingGG! cfptime.org/cfps/3422/ #cfp #infosec #https:x.comGameHackingGG

  14. 📢🔔 Just 1 more month to submit your talk at Game Hacking Village - DEF CON 34 cc @https:x.comGameHackingGG! cfptime.org/cfps/3422/ #cfp #infosec #https:x.comGameHackingGG

  15. 📢🔔 Just 1 more month to submit your talk at Game Hacking Village - DEF CON 34 cc @https:x.comGameHackingGG! cfptime.org/cfps/3422/ #cfp #infosec #https:x.comGameHackingGG

  16. 📢🔔 Just 1 more month to submit your talk at Game Hacking Village - DEF CON 34 cc @https:x.comGameHackingGG! cfptime.org/cfps/3422/ #cfp #infosec #https:x.comGameHackingGG

  17. 💥 This is another tragedy from Gaza: when even basic sanitation systems are unavailable, people are forced to dig pits for sewage disposal.
    During the digging of a sewage pit by a young man from the Radwan family, the ground collapsed on him… and unfortunately, he passed away before Civil Defense teams were able to rescue him. 😢
    #https://gofund.me/2790a0f8
    #FreePalestine #Gaza #Palestine #Stopisrael #HumanitarianAid #genocide #ethnicCleansing #apartheid #settlerColonialism #support #iran #USmilitary #WarOnIran #USpol #us #eu #eupol #diplomacy #reactionary #rn
    #mutualaid #food #help #j

  18. I will legit setup Enabling HTTPS certs in Tailscale just to get this #$&%# icon to go away.

    I know the traffic is encrypted but stuff like this bugs me enough to take on a whole new project.

    #Tailscale #SelfHosted #Homelab #HTTPS #Privacy #FOSS #TrueNAS #SearXNG

  19. Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

    A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data breach dispute involving a Vietnamese citizen and Viettel, alongside fabricated whistleblower complaints targeting Philippine healthcare administrators. Attackers delivered malicious Windows LNK files within nested RAR archives, abusing native ftp.exe as a Living-off-the-Land dropper. Upon execution, the payload assembled polymorphic implants directly on disk from chunked .doc files, establishing persistence while displaying legitimate decoy PDFs. The malware enabled remote access through process injection, credential harvesting from browsers and remote access tools, screenshot capture, and file exfiltration via HTTPS C2 communication to infrastructure hosted on bulletproof Hong Kong servers.

    Pulse ID: 69fc841d0cbc4c199d708315
    Pulse Link: otx.alienvault.com/pulse/69fc8
    Pulse Author: AlienVault
    Created: 2026-05-07 12:22:53

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #CredentialHarvesting #CyberSecurity #DataBreach #HTTP #HTTPS #Healthcare #HongKong #InfoSec #LNK #Malware #Military #OTX #OpenThreatExchange #PDF #Philippines #Phishing #RAT #SpearPhishing #Telecom #Telecommunication #UK #Vietnam #Windows #bot #AlienVault

  20. Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

    A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data breach dispute involving a Vietnamese citizen and Viettel, alongside fabricated whistleblower complaints targeting Philippine healthcare administrators. Attackers delivered malicious Windows LNK files within nested RAR archives, abusing native ftp.exe as a Living-off-the-Land dropper. Upon execution, the payload assembled polymorphic implants directly on disk from chunked .doc files, establishing persistence while displaying legitimate decoy PDFs. The malware enabled remote access through process injection, credential harvesting from browsers and remote access tools, screenshot capture, and file exfiltration via HTTPS C2 communication to infrastructure hosted on bulletproof Hong Kong servers.

    Pulse ID: 69fc841d0cbc4c199d708315
    Pulse Link: otx.alienvault.com/pulse/69fc8
    Pulse Author: AlienVault
    Created: 2026-05-07 12:22:53

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #CredentialHarvesting #CyberSecurity #DataBreach #HTTP #HTTPS #Healthcare #HongKong #InfoSec #LNK #Malware #Military #OTX #OpenThreatExchange #PDF #Philippines #Phishing #RAT #SpearPhishing #Telecom #Telecommunication #UK #Vietnam #Windows #bot #AlienVault

  21. Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

    A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data breach dispute involving a Vietnamese citizen and Viettel, alongside fabricated whistleblower complaints targeting Philippine healthcare administrators. Attackers delivered malicious Windows LNK files within nested RAR archives, abusing native ftp.exe as a Living-off-the-Land dropper. Upon execution, the payload assembled polymorphic implants directly on disk from chunked .doc files, establishing persistence while displaying legitimate decoy PDFs. The malware enabled remote access through process injection, credential harvesting from browsers and remote access tools, screenshot capture, and file exfiltration via HTTPS C2 communication to infrastructure hosted on bulletproof Hong Kong servers.

    Pulse ID: 69fc841d0cbc4c199d708315
    Pulse Link: otx.alienvault.com/pulse/69fc8
    Pulse Author: AlienVault
    Created: 2026-05-07 12:22:53

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #CredentialHarvesting #CyberSecurity #DataBreach #HTTP #HTTPS #Healthcare #HongKong #InfoSec #LNK #Malware #Military #OTX #OpenThreatExchange #PDF #Philippines #Phishing #RAT #SpearPhishing #Telecom #Telecommunication #UK #Vietnam #Windows #bot #AlienVault

  22. Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

    A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data breach dispute involving a Vietnamese citizen and Viettel, alongside fabricated whistleblower complaints targeting Philippine healthcare administrators. Attackers delivered malicious Windows LNK files within nested RAR archives, abusing native ftp.exe as a Living-off-the-Land dropper. Upon execution, the payload assembled polymorphic implants directly on disk from chunked .doc files, establishing persistence while displaying legitimate decoy PDFs. The malware enabled remote access through process injection, credential harvesting from browsers and remote access tools, screenshot capture, and file exfiltration via HTTPS C2 communication to infrastructure hosted on bulletproof Hong Kong servers.

    Pulse ID: 69fc841d0cbc4c199d708315
    Pulse Link: otx.alienvault.com/pulse/69fc8
    Pulse Author: AlienVault
    Created: 2026-05-07 12:22:53

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #CredentialHarvesting #CyberSecurity #DataBreach #HTTP #HTTPS #Healthcare #HongKong #InfoSec #LNK #Malware #Military #OTX #OpenThreatExchange #PDF #Philippines #Phishing #RAT #SpearPhishing #Telecom #Telecommunication #UK #Vietnam #Windows #bot #AlienVault

  23. Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

    A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data breach dispute involving a Vietnamese citizen and Viettel, alongside fabricated whistleblower complaints targeting Philippine healthcare administrators. Attackers delivered malicious Windows LNK files within nested RAR archives, abusing native ftp.exe as a Living-off-the-Land dropper. Upon execution, the payload assembled polymorphic implants directly on disk from chunked .doc files, establishing persistence while displaying legitimate decoy PDFs. The malware enabled remote access through process injection, credential harvesting from browsers and remote access tools, screenshot capture, and file exfiltration via HTTPS C2 communication to infrastructure hosted on bulletproof Hong Kong servers.

    Pulse ID: 69fc841d0cbc4c199d708315
    Pulse Link: otx.alienvault.com/pulse/69fc8
    Pulse Author: AlienVault
    Created: 2026-05-07 12:22:53

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #CredentialHarvesting #CyberSecurity #DataBreach #HTTP #HTTPS #Healthcare #HongKong #InfoSec #LNK #Malware #Military #OTX #OpenThreatExchange #PDF #Philippines #Phishing #RAT #SpearPhishing #Telecom #Telecommunication #UK #Vietnam #Windows #bot #AlienVault

  24. Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit

    A sophisticated spear phishing campaign targets professionals in the Eurasian unmanned aviation sector, timed to coincide with the XIII Eurasian International Forum 'Unmanned Aviation 2026' in Moscow. The attack delivers malicious archives containing Rust-based executables disguised as legitimate documents from the Russian Aeronautical Information Center. The malware displays aviation-themed decoy documents in Russian while collecting system information including hostnames, volume serial numbers, network adapter details, and environment variables. Collected data is encrypted via XOR and exfiltrated to a C2 server over HTTPS. The malware subsequently downloads and executes a second-stage payload using AES-256 decryption. The campaign demonstrates targeted social engineering with realistic aviation order documents, translation certificates, and product summaries to compromise victims in Russia, Tajikistan, Central Asia, Middle East and Europe.

    Pulse ID: 69fb57e600c03f5a6ac63de0
    Pulse Link: otx.alienvault.com/pulse/69fb5
    Pulse Author: AlienVault
    Created: 2026-05-06 15:01:58

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #CentralAsia #CyberSecurity #Europe #HTTP #HTTPS #InfoSec #Malware #MiddleEast #OTX #OpenThreatExchange #Phishing #RAT #Russia #Rust #SocialEngineering #SpearPhishing #bot #AlienVault

  25. Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit

    A sophisticated spear phishing campaign targets professionals in the Eurasian unmanned aviation sector, timed to coincide with the XIII Eurasian International Forum 'Unmanned Aviation 2026' in Moscow. The attack delivers malicious archives containing Rust-based executables disguised as legitimate documents from the Russian Aeronautical Information Center. The malware displays aviation-themed decoy documents in Russian while collecting system information including hostnames, volume serial numbers, network adapter details, and environment variables. Collected data is encrypted via XOR and exfiltrated to a C2 server over HTTPS. The malware subsequently downloads and executes a second-stage payload using AES-256 decryption. The campaign demonstrates targeted social engineering with realistic aviation order documents, translation certificates, and product summaries to compromise victims in Russia, Tajikistan, Central Asia, Middle East and Europe.

    Pulse ID: 69fb57e600c03f5a6ac63de0
    Pulse Link: otx.alienvault.com/pulse/69fb5
    Pulse Author: AlienVault
    Created: 2026-05-06 15:01:58

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #CentralAsia #CyberSecurity #Europe #HTTP #HTTPS #InfoSec #Malware #MiddleEast #OTX #OpenThreatExchange #Phishing #RAT #Russia #Rust #SocialEngineering #SpearPhishing #bot #AlienVault

  26. Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit

    A sophisticated spear phishing campaign targets professionals in the Eurasian unmanned aviation sector, timed to coincide with the XIII Eurasian International Forum 'Unmanned Aviation 2026' in Moscow. The attack delivers malicious archives containing Rust-based executables disguised as legitimate documents from the Russian Aeronautical Information Center. The malware displays aviation-themed decoy documents in Russian while collecting system information including hostnames, volume serial numbers, network adapter details, and environment variables. Collected data is encrypted via XOR and exfiltrated to a C2 server over HTTPS. The malware subsequently downloads and executes a second-stage payload using AES-256 decryption. The campaign demonstrates targeted social engineering with realistic aviation order documents, translation certificates, and product summaries to compromise victims in Russia, Tajikistan, Central Asia, Middle East and Europe.

    Pulse ID: 69fb57e600c03f5a6ac63de0
    Pulse Link: otx.alienvault.com/pulse/69fb5
    Pulse Author: AlienVault
    Created: 2026-05-06 15:01:58

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #CentralAsia #CyberSecurity #Europe #HTTP #HTTPS #InfoSec #Malware #MiddleEast #OTX #OpenThreatExchange #Phishing #RAT #Russia #Rust #SocialEngineering #SpearPhishing #bot #AlienVault

  27. Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit

    A sophisticated spear phishing campaign targets professionals in the Eurasian unmanned aviation sector, timed to coincide with the XIII Eurasian International Forum 'Unmanned Aviation 2026' in Moscow. The attack delivers malicious archives containing Rust-based executables disguised as legitimate documents from the Russian Aeronautical Information Center. The malware displays aviation-themed decoy documents in Russian while collecting system information including hostnames, volume serial numbers, network adapter details, and environment variables. Collected data is encrypted via XOR and exfiltrated to a C2 server over HTTPS. The malware subsequently downloads and executes a second-stage payload using AES-256 decryption. The campaign demonstrates targeted social engineering with realistic aviation order documents, translation certificates, and product summaries to compromise victims in Russia, Tajikistan, Central Asia, Middle East and Europe.

    Pulse ID: 69fb57e600c03f5a6ac63de0
    Pulse Link: otx.alienvault.com/pulse/69fb5
    Pulse Author: AlienVault
    Created: 2026-05-06 15:01:58

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #CentralAsia #CyberSecurity #Europe #HTTP #HTTPS #InfoSec #Malware #MiddleEast #OTX #OpenThreatExchange #Phishing #RAT #Russia #Rust #SocialEngineering #SpearPhishing #bot #AlienVault

  28. Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit

    A sophisticated spear phishing campaign targets professionals in the Eurasian unmanned aviation sector, timed to coincide with the XIII Eurasian International Forum 'Unmanned Aviation 2026' in Moscow. The attack delivers malicious archives containing Rust-based executables disguised as legitimate documents from the Russian Aeronautical Information Center. The malware displays aviation-themed decoy documents in Russian while collecting system information including hostnames, volume serial numbers, network adapter details, and environment variables. Collected data is encrypted via XOR and exfiltrated to a C2 server over HTTPS. The malware subsequently downloads and executes a second-stage payload using AES-256 decryption. The campaign demonstrates targeted social engineering with realistic aviation order documents, translation certificates, and product summaries to compromise victims in Russia, Tajikistan, Central Asia, Middle East and Europe.

    Pulse ID: 69fb57e600c03f5a6ac63de0
    Pulse Link: otx.alienvault.com/pulse/69fb5
    Pulse Author: AlienVault
    Created: 2026-05-06 15:01:58

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #CentralAsia #CyberSecurity #Europe #HTTP #HTTPS #InfoSec #Malware #MiddleEast #OTX #OpenThreatExchange #Phishing #RAT #Russia #Rust #SocialEngineering #SpearPhishing #bot #AlienVault

  29. I still need to work on automating the process, but it only took me like 10 minutes to renew my TLS cert for my selfhosted services, and I had budgeted way longer for it. Now I feel like I have a whole evening of free time :D

    #Selfhosting #HTTPS #Certbot #NGINX

  30. That AI Extension Helping You Write Emails? It's Reading Them First

    Researchers discovered 18 malicious AI browser extensions masquerading as productivity tools that deliver remote access trojans, meddler-in-the-middle attacks, and infostealers. These extensions exploit the rise of generative AI to target prompts, user behavior, and browser sessions through API interception, passive DOM observation, traffic proxying, and HTTPS response decryption. Examples include extensions that surveil emails during composition, intercept ChatGPT prompts, and exfiltrate passwords. Multiple samples contained AI-generated code indicating threat actors employed large language models to accelerate production. Google removed or issued warnings for all 18 reported extensions. These malicious tools specifically target sensitive data including AI API keys, authentication credentials, email content, and proprietary session information by exploiting user trust in AI-branded applications.

    Pulse ID: 69f3e871eb2a73cd5c8bee7e
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:33

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #ChatGPT #CyberSecurity #Email #Google #HTTP #HTTPS #InfoSec #InfoStealer #OTX #OpenThreatExchange #Password #Passwords #Proxy #RAT #RCE #RemoteAccessTrojan #Rust #Trojan #Word #bot #AlienVault

  31. Un outil pour exposer une app locale en HTTPS avec un nom de domaine (local également).

    🔗 github.com/vercel-labs/portless

    #https #localhost #dev #proxy

  32. The npm Threat Landscape: Attack Surface and Mitigations

    The npm ecosystem experienced a critical shift in September 2025 with the Shai-Hulud worm, marking the transition from isolated attacks to systematic supply chain compromises. In April 2026, TeamPCP launched a coordinated campaign through a malicious @bitwarden/cli package targeting multiple distribution channels including Docker Hub, GitHub Actions, and VS Code extensions. The multi-stage payload employs advanced obfuscation, harvests credentials from cloud providers and developer workstations, exfiltrates data through encrypted HTTPS and GitHub repositories, and self-propagates by backdooring npm packages using stolen tokens. The malware implements GitHub's search API as a resilient command-and-control fallback mechanism and features anti-detection measures including Russian locale killswitches. This represents an evolution toward wormable propagation, infrastructure-level persistence, and dormant payloads that activate under specific conditions.

    Pulse ID: 69ec0475e74facdf3bf89ce1
    Pulse Link: otx.alienvault.com/pulse/69ec0
    Pulse Author: AlienVault
    Created: 2026-04-25 00:01:57

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #Cloud #CyberSecurity #Docker #ELF #GitHub #HTTP #HTTPS #InfoSec #Malware #NPM #OTX #OpenThreatExchange #RAT #Russia #SupplyChain #Worm #bot #AlienVault

  33. Same packet, different magic: Hits India's banking sector and Korea geopolitics

    A new variant of the LOTUSLITE backdoor, version 1.1, has been identified targeting India's banking sector and South Korean diplomatic circles. The backdoor is delivered via DLL sideloading using legitimate Microsoft-signed executables and initially through CHM files containing malicious JavaScript. It communicates with dynamic DNS-based command-and-control servers over HTTPS, supporting remote shell access, file operations and session management. Code-level analysis reveals direct lineage to LOTUSLITE v1.0, including identical command structures, shared persistence mechanisms, and residual exports from the original codebase. The campaign demonstrates incremental improvements including updated magic values, API resolution techniques, and delivery mechanisms evolving from CHM-based to JavaScript loaders to DLL sideloading. Infrastructure hosted under Dynu Systems shows continuity with previous operations.

    Pulse ID: 69e827168edcf67707285b4e
    Pulse Link: otx.alienvault.com/pulse/69e82
    Pulse Author: AlienVault
    Created: 2026-04-22 01:40:38

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #Bank #CyberSecurity #DNS #HTTP #HTTPS #ICS #India #InfoSec #Java #JavaScript #Korea #Microsoft #OTX #OpenThreatExchange #RAT #SMS #SideLoading #SouthKorea #bot #AlienVault