#malware — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #malware, aggregated by home.social.
-
How to Investigate with Windows Prefetch Files
-
How to Investigate with Windows Prefetch Files
-
How to Investigate with Windows Prefetch Files
-
How to Investigate with Windows Prefetch Files
-
Kazuar: Anatomy of a nation-state botnet | Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/
Read on HackerWorkspace: https://hackerworkspace.com/article/kazuar-anatomy-of-a-nation-state-botnet-microsoft-security-blog
-
Kazuar: Anatomy of a nation-state botnet | Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/
Read on HackerWorkspace: https://hackerworkspace.com/article/kazuar-anatomy-of-a-nation-state-botnet-microsoft-security-blog
-
Kazuar: Anatomy of a nation-state botnet | Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/
Read on HackerWorkspace: https://hackerworkspace.com/article/kazuar-anatomy-of-a-nation-state-botnet-microsoft-security-blog
-
Kazuar: Anatomy of a nation-state botnet | Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/
Read on HackerWorkspace: https://hackerworkspace.com/article/kazuar-anatomy-of-a-nation-state-botnet-microsoft-security-blog
-
NATO Locked Shields 2026: RL Joins Live-Fire Cyber Event | RL Blog
https://www.reversinglabs.com/blog/locked-shields-2026
Read on HackerWorkspace: https://hackerworkspace.com/article/nato-locked-shields-2026-rl-joins-live-fire-cyber-event-rl-blog
-
NATO Locked Shields 2026: RL Joins Live-Fire Cyber Event | RL Blog
https://www.reversinglabs.com/blog/locked-shields-2026
Read on HackerWorkspace: https://hackerworkspace.com/article/nato-locked-shields-2026-rl-joins-live-fire-cyber-event-rl-blog
-
NATO Locked Shields 2026: RL Joins Live-Fire Cyber Event | RL Blog
https://www.reversinglabs.com/blog/locked-shields-2026
Read on HackerWorkspace: https://hackerworkspace.com/article/nato-locked-shields-2026-rl-joins-live-fire-cyber-event-rl-blog
-
NATO Locked Shields 2026: RL Joins Live-Fire Cyber Event | RL Blog
https://www.reversinglabs.com/blog/locked-shields-2026
Read on HackerWorkspace: https://hackerworkspace.com/article/nato-locked-shields-2026-rl-joins-live-fire-cyber-event-rl-blog
-
Mustang Panda Linked to FDMTP Backdoor in Asia-Pacific Espionage
https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
Read on HackerWorkspace: https://hackerworkspace.com/article/mustang-panda-linked-to-fdmtp-backdoor-in-asia-pacific-espionage
-
Mustang Panda Linked to FDMTP Backdoor in Asia-Pacific Espionage
https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
Read on HackerWorkspace: https://hackerworkspace.com/article/mustang-panda-linked-to-fdmtp-backdoor-in-asia-pacific-espionage
-
Mustang Panda Linked to FDMTP Backdoor in Asia-Pacific Espionage
https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
Read on HackerWorkspace: https://hackerworkspace.com/article/mustang-panda-linked-to-fdmtp-backdoor-in-asia-pacific-espionage
-
Mustang Panda Linked to FDMTP Backdoor in Asia-Pacific Espionage
https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
Read on HackerWorkspace: https://hackerworkspace.com/article/mustang-panda-linked-to-fdmtp-backdoor-in-asia-pacific-espionage
-
Hackers are using fake job interview apps to spread new #JobStealer malware across macOS and Windows systems, stealing crypto, browser credentials, and more disguising itself as a video meeting app.
Read more: https://hackread.com/fake-job-interview-jobstealer-malware-windows-macos/
-
Hackers are using fake job interview apps to spread new #JobStealer malware across macOS and Windows systems, stealing crypto, browser credentials, and more disguising itself as a video meeting app.
Read more: https://hackread.com/fake-job-interview-jobstealer-malware-windows-macos/
-
#Fragnesia Made Public As Latest #Linux Local Privilege Escalation Vulnerability
-
#Fragnesia Made Public As Latest #Linux Local Privilege Escalation Vulnerability
-
#Fragnesia Made Public As Latest #Linux Local Privilege Escalation Vulnerability
-
#Fragnesia Made Public As Latest #Linux Local Privilege Escalation Vulnerability
-
#Fragnesia Made Public As Latest #Linux Local Privilege Escalation Vulnerability
-
🚨 PHISHING DETECTED 🚨
🔗 Suspicious URL: seguritybandemo[.]vercel[.]app
🔍 Analysis at: https://phishdestroy.io/domain/seguritybandemo.vercel.app/ -
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
-
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
-
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
-
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
-
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
-
Foxconn-Werke in Nordamerika von Ransomware-Gruppe Nitrogen angegriffen
Der Auftragsfertiger bestätigt den Cyberangriff. Nitrogen prahlt damit, 11 Millionen Dateien zu Apple, Nvidia und weiteren Kunden gestohlen haben.
-
Foxconn-Werke in Nordamerika von Ransomware-Gruppe Nitrogen angegriffen
Der Auftragsfertiger bestätigt den Cyberangriff. Nitrogen prahlt damit, 11 Millionen Dateien zu Apple, Nvidia und weiteren Kunden gestohlen haben.
-
Foxconn-Werke in Nordamerika von Ransomware-Gruppe Nitrogen angegriffen
Der Auftragsfertiger bestätigt den Cyberangriff. Nitrogen prahlt damit, 11 Millionen Dateien zu Apple, Nvidia und weiteren Kunden gestohlen haben.
-
Foxconn-Werke in Nordamerika von Ransomware-Gruppe Nitrogen angegriffen
Der Auftragsfertiger bestätigt den Cyberangriff. Nitrogen prahlt damit, 11 Millionen Dateien zu Apple, Nvidia und weiteren Kunden gestohlen haben.
-
📢⚠️ A new China-linked #TwillTyphoon hacking group is using fake Apple and Yahoo domains along with trusted #Windows tools to spy on organizations across Japan and the Asia-Pacific region.
Read: https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
-
📢⚠️ A new China-linked #TwillTyphoon hacking group is using fake Apple and Yahoo domains along with trusted #Windows tools to spy on organizations across Japan and the Asia-Pacific region.
Read: https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
-
📢⚠️ A new China-linked #TwillTyphoon hacking group is using fake Apple and Yahoo domains along with trusted #Windows tools to spy on organizations across Japan and the Asia-Pacific region.
Read: https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
-
📢⚠️ A new China-linked #TwillTyphoon hacking group is using fake Apple and Yahoo domains along with trusted #Windows tools to spy on organizations across Japan and the Asia-Pacific region.
Read: https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
-
📢⚠️ A new China-linked #TwillTyphoon hacking group is using fake Apple and Yahoo domains along with trusted #Windows tools to spy on organizations across Japan and the Asia-Pacific region.
Read: https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
-
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
Pulse ID: 6a04a9a090a64de310cb0568
Pulse Link: https://otx.alienvault.com/pulse/6a04a9a090a64de310cb0568
Pulse Author: AlienVault
Created: 2026-05-13 16:41:04Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault
-
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
Pulse ID: 6a04a9a090a64de310cb0568
Pulse Link: https://otx.alienvault.com/pulse/6a04a9a090a64de310cb0568
Pulse Author: AlienVault
Created: 2026-05-13 16:41:04Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault
-
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
Pulse ID: 6a04a9a090a64de310cb0568
Pulse Link: https://otx.alienvault.com/pulse/6a04a9a090a64de310cb0568
Pulse Author: AlienVault
Created: 2026-05-13 16:41:04Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault
-
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
Pulse ID: 6a04a9a090a64de310cb0568
Pulse Link: https://otx.alienvault.com/pulse/6a04a9a090a64de310cb0568
Pulse Author: AlienVault
Created: 2026-05-13 16:41:04Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault
-
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
Pulse ID: 6a04a9a090a64de310cb0568
Pulse Link: https://otx.alienvault.com/pulse/6a04a9a090a64de310cb0568
Pulse Author: AlienVault
Created: 2026-05-13 16:41:04Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault
-
The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
https://schulz.dk/2026/05/14/the-wordpress-backdoor-that-forgot-to-be-php/
WP is great for many things but so wide-spread that bad actors will try to find holes in it.
#wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough -
The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
https://schulz.dk/2026/05/14/the-wordpress-backdoor-that-forgot-to-be-php/
WP is great for many things but so wide-spread that bad actors will try to find holes in it.
#wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough -
The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
https://schulz.dk/2026/05/14/the-wordpress-backdoor-that-forgot-to-be-php/
WP is great for many things but so wide-spread that bad actors will try to find holes in it.
#wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough -
The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
https://schulz.dk/2026/05/14/the-wordpress-backdoor-that-forgot-to-be-php/
WP is great for many things but so wide-spread that bad actors will try to find holes in it.
#wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough -
The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
https://schulz.dk/2026/05/14/the-wordpress-backdoor-that-forgot-to-be-php/
WP is great for many things but so wide-spread that bad actors will try to find holes in it.
#wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough -
Dobrindt: „Abschrecken, abwehren und abschalten“ in Kürze | heise online https://www.heise.de/news/Dobrindt-Abschrecken-abwehren-und-abschalten-in-Kuerze-11292023.html #CyberCrime #Hackback #hacking #Malware #DSA #DigitalServicesAct #Ransomware
-
🚨 PHISHING DETECTED 🚨
🔗 Suspicious URL: www[.]darknetwiki[.]com
🔍 Analysis at: https://phishdestroy.io/domain/www.darknetwiki.com/#PhishingWarning #CyberFraud #malware #CryptoProtection #fake #DigitalFraud