#plugx — Public Fediverse posts

CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

Pulse ID: 6a7ef2da146fb06724520eb4
Pulse Link: https://otx.alienvault.com/pulse/6a7ef2da146fb06724520eb4
Pulse Author: AlienVault
Created: 2026-08-14 10:50:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #Pakistan #PlugX #Proxy #Rootkit #Russia #SideLoading #Windows #bot #AlienVault

CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

Pulse ID: 6a7ef2da146fb06724520eb4
Pulse Link: https://otx.alienvault.com/pulse/6a7ef2da146fb06724520eb4
Pulse Author: AlienVault
Created: 2026-08-14 10:50:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #Pakistan #PlugX #Proxy #Rootkit #Russia #SideLoading #Windows #bot #AlienVault

CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

Pulse ID: 6a7ef2da146fb06724520eb4
Pulse Link: https://otx.alienvault.com/pulse/6a7ef2da146fb06724520eb4
Pulse Author: AlienVault
Created: 2026-08-14 10:50:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #Pakistan #PlugX #Proxy #Rootkit #Russia #SideLoading #Windows #bot #AlienVault

CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

Pulse ID: 6a7ef2da146fb06724520eb4
Pulse Link: https://otx.alienvault.com/pulse/6a7ef2da146fb06724520eb4
Pulse Author: AlienVault
Created: 2026-08-14 10:50:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #Pakistan #PlugX #Proxy #Rootkit #Russia #SideLoading #Windows #bot #AlienVault

CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

Pulse ID: 6a7ef2da146fb06724520eb4
Pulse Link: https://otx.alienvault.com/pulse/6a7ef2da146fb06724520eb4
Pulse Author: AlienVault
Created: 2026-08-14 10:50:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #Pakistan #PlugX #Proxy #Rootkit #Russia #SideLoading #Windows #bot #AlienVault

Analysis of a Modular Cyber Espionage Framework

Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk, targeting government and public-sector organizations across Central Asia and the Middle East. Both modular backdoors utilize victim-specific decryption mechanisms, extensive obfuscation, and in-memory execution to evade detection. The malware enables credential theft, remote access, network reconnaissance, and plugin-based expansion. Operations began in January 2025, affecting entities in Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, and Uzbekistan. Victims include government offices, foreign affairs ministries, law enforcement agencies, healthcare providers, logistics organizations, research institutions, urban planning facilities, and educational establishments. Attackers deployed additional tools including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX. A companion utility, LurkProxy, proxies a

Pulse ID: 6a75b204c9420179df545451
Pulse Link: https://otx.alienvault.com/pulse/6a75b204c9420179df545451
Pulse Author: AlienVault
Created: 2026-08-07 10:23:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #Browser #CentralAsia #CyberSecurity #Education #Espionage #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Malware #MiddleEast #OTX #Office #OpenThreatExchange #Password #PlugX #Proxy #RAT #RCE #SMS #Syria #WinRAR #Word #ZIP #bot #AlienVault

Analysis of a Modular Cyber Espionage Framework

Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk, targeting government and public-sector organizations across Central Asia and the Middle East. Both modular backdoors utilize victim-specific decryption mechanisms, extensive obfuscation, and in-memory execution to evade detection. The malware enables credential theft, remote access, network reconnaissance, and plugin-based expansion. Operations began in January 2025, affecting entities in Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, and Uzbekistan. Victims include government offices, foreign affairs ministries, law enforcement agencies, healthcare providers, logistics organizations, research institutions, urban planning facilities, and educational establishments. Attackers deployed additional tools including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX. A companion utility, LurkProxy, proxies a

Pulse ID: 6a75b204c9420179df545451
Pulse Link: https://otx.alienvault.com/pulse/6a75b204c9420179df545451
Pulse Author: AlienVault
Created: 2026-08-07 10:23:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #Browser #CentralAsia #CyberSecurity #Education #Espionage #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Malware #MiddleEast #OTX #Office #OpenThreatExchange #Password #PlugX #Proxy #RAT #RCE #SMS #Syria #WinRAR #Word #ZIP #bot #AlienVault

Analysis of a Modular Cyber Espionage Framework

Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk, targeting government and public-sector organizations across Central Asia and the Middle East. Both modular backdoors utilize victim-specific decryption mechanisms, extensive obfuscation, and in-memory execution to evade detection. The malware enables credential theft, remote access, network reconnaissance, and plugin-based expansion. Operations began in January 2025, affecting entities in Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, and Uzbekistan. Victims include government offices, foreign affairs ministries, law enforcement agencies, healthcare providers, logistics organizations, research institutions, urban planning facilities, and educational establishments. Attackers deployed additional tools including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX. A companion utility, LurkProxy, proxies a

Pulse ID: 6a75b204c9420179df545451
Pulse Link: https://otx.alienvault.com/pulse/6a75b204c9420179df545451
Pulse Author: AlienVault
Created: 2026-08-07 10:23:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #Browser #CentralAsia #CyberSecurity #Education #Espionage #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Malware #MiddleEast #OTX #Office #OpenThreatExchange #Password #PlugX #Proxy #RAT #RCE #SMS #Syria #WinRAR #Word #ZIP #bot #AlienVault

Analysis of a Modular Cyber Espionage Framework

Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk, targeting government and public-sector organizations across Central Asia and the Middle East. Both modular backdoors utilize victim-specific decryption mechanisms, extensive obfuscation, and in-memory execution to evade detection. The malware enables credential theft, remote access, network reconnaissance, and plugin-based expansion. Operations began in January 2025, affecting entities in Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, and Uzbekistan. Victims include government offices, foreign affairs ministries, law enforcement agencies, healthcare providers, logistics organizations, research institutions, urban planning facilities, and educational establishments. Attackers deployed additional tools including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX. A companion utility, LurkProxy, proxies a

Pulse ID: 6a75b204c9420179df545451
Pulse Link: https://otx.alienvault.com/pulse/6a75b204c9420179df545451
Pulse Author: AlienVault
Created: 2026-08-07 10:23:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #Browser #CentralAsia #CyberSecurity #Education #Espionage #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Malware #MiddleEast #OTX #Office #OpenThreatExchange #Password #PlugX #Proxy #RAT #RCE #SMS #Syria #WinRAR #Word #ZIP #bot #AlienVault

Analysis of a Modular Cyber Espionage Framework

Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk, targeting government and public-sector organizations across Central Asia and the Middle East. Both modular backdoors utilize victim-specific decryption mechanisms, extensive obfuscation, and in-memory execution to evade detection. The malware enables credential theft, remote access, network reconnaissance, and plugin-based expansion. Operations began in January 2025, affecting entities in Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, and Uzbekistan. Victims include government offices, foreign affairs ministries, law enforcement agencies, healthcare providers, logistics organizations, research institutions, urban planning facilities, and educational establishments. Attackers deployed additional tools including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX. A companion utility, LurkProxy, proxies a

Pulse ID: 6a75b204c9420179df545451
Pulse Link: https://otx.alienvault.com/pulse/6a75b204c9420179df545451
Pulse Author: AlienVault
Created: 2026-08-07 10:23:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #Browser #CentralAsia #CyberSecurity #Education #Espionage #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Malware #MiddleEast #OTX #Office #OpenThreatExchange #Password #PlugX #Proxy #RAT #RCE #SMS #Syria #WinRAR #Word #ZIP #bot #AlienVault

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

SentinelLABS found Chinese cyberespionage and India-nexus actors converging on Pakistani law enforcement, hitting Balochistan Police records and citizens.

#Cyberespionage #APT #BalochistanPolice #PlugX #ShadowPad

https://securityonline.info/balochistan-police-espionage/?utm_source=mastodon&utm_medium=jetpack_social

SentinelLABS found Chinese cyberespionage and India-nexus actors converging on Pakistani law enforcement, hitting Balochistan Police records and citizens.

#Cyberespionage #APT #BalochistanPolice #PlugX #ShadowPad

https://securityonline.info/balochistan-police-espionage/?utm_source=mastodon&utm_medium=jetpack_social

Life is full of paradoxes. We spend countless time discussing threat actors using AI and in 2026 some are still relying on PlugX.

#plugx #cybersecurity #threatintel

Life is full of paradoxes. We spend countless time discussing threat actors using AI and in 2026 some are still relying on PlugX.

#plugx #cybersecurity #threatintel

Life is full of paradoxes. We spend countless time discussing threat actors using AI and in 2026 some are still relying on PlugX.

#plugx #cybersecurity #threatintel

Life is full of paradoxes. We spend countless time discussing threat actors using AI and in 2026 some are still relying on PlugX.

#plugx #cybersecurity #threatintel

Life is full of paradoxes. We spend countless time discussing threat actors using AI and in 2026 some are still relying on PlugX.

#plugx #cybersecurity #threatintel

Fake Claude AI installer mimicking Anthropic spreads PlugX RAT on Windows, using DLL sideloading to gain persistent remote access to infected systems.

Read: https://hackread.com/fake-claude-ai-installer-plugx-malware-windows-users/

#CyberSecurity #ClaudeAI #Windows #PlugX #Malware

Fake Claude AI installer mimicking Anthropic spreads PlugX RAT on Windows, using DLL sideloading to gain persistent remote access to infected systems.

Read: https://hackread.com/fake-claude-ai-installer-plugx-malware-windows-users/

#CyberSecurity #ClaudeAI #Windows #PlugX #Malware

Fake Claude AI installer mimicking Anthropic spreads PlugX RAT on Windows, using DLL sideloading to gain persistent remote access to infected systems.

Read: https://hackread.com/fake-claude-ai-installer-plugx-malware-windows-users/

#CyberSecurity #ClaudeAI #Windows #PlugX #Malware

Fake Claude AI installer mimicking Anthropic spreads PlugX RAT on Windows, using DLL sideloading to gain persistent remote access to infected systems.

Read: https://hackread.com/fake-claude-ai-installer-plugx-malware-windows-users/

#CyberSecurity #ClaudeAI #Windows #PlugX #Malware

Fake Claude AI installer mimicking Anthropic spreads PlugX RAT on Windows, using DLL sideloading to gain persistent remote access to infected systems.

Read: https://hackread.com/fake-claude-ai-installer-plugx-malware-windows-users/

#CyberSecurity #ClaudeAI #Windows #PlugX #Malware

Cuidado: Sitio web falso de Claude distribuye el malware PlugX RAT

Investigadores de seguridad han alertado sobre una campaña de phishing que utiliza un sitio web fraudulento de la IA «Claude» para infectar computadoras con el troyano de acceso remoto PlugX, permitiendo el control total del equipo (Fuente Malwarebytes).

La popularidad de la inteligencia artificial está siendo explotada nuevamente por cibercriminales. Se ha detectado un sitio web que imita a la perfección la interfaz de Claude (la IA de Anthropic) para engañar a los usuarios y lograr que descarguen un archivo ejecutable malicioso. En lugar de ofrecer herramientas de IA, el instalador despliega una variante del conocido troyano de acceso remoto (RAT) denominado PlugX. Una vez instalado, este malware permite a los atacantes robar credenciales, registrar las pulsaciones del teclado (keylogging), acceder a archivos privados y utilizar la cámara o el micrófono del dispositivo infectado sin el consentimiento del usuario.

El método de distribución suele basarse en anuncios engañosos en motores de búsqueda o publicaciones en redes sociales que prometen «versiones de escritorio premium» o «funciones gratuitas ilimitadas» de Claude. El malware utiliza técnicas de carga lateral de DLL (DLL side-loading) para evadir los antivirus convencionales, ocultándose dentro de procesos legítimos del sistema operativo. Esta táctica es común entre grupos de amenazas persistentes avanzadas (APT) y subraya la sofisticación de los ataques dirigidos a usuarios que buscan herramientas de productividad basadas en inteligencia artificial.

Expertos en ciberseguridad recomiendan a los usuarios acceder a Claude y otras plataformas de IA exclusivamente a través de sus dominios oficiales verificados. Es vital desconfiar de instaladores de escritorio que no provengan de tiendas oficiales como la Mac App Store o Microsoft Store, y mantener siempre activadas las soluciones de seguridad con protección en tiempo real. Este incidente es un recordatorio de que, en el auge de la IA, el sentido común y la verificación de las fuentes siguen siendo las defensas más efectivas contra el secuestro digital de datos.

I’d come running back to EU again: TA416 resumes European government espionage campaigns
#TA416 #PlugX #UNK_SteadySplit
https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage

I’d come running back to EU again: TA416 resumes European government espionage campaigns
#TA416 #PlugX #UNK_SteadySplit
https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage

I’d come running back to EU again: TA416 resumes European government espionage campaigns
#TA416 #PlugX #UNK_SteadySplit
https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage

I’d come running back to EU again: TA416 resumes European government espionage campaigns
#TA416 #PlugX #UNK_SteadySplit
https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage

I’d come running back to EU again: TA416 resumes European government espionage campaigns
#TA416 #PlugX #UNK_SteadySplit
https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage

China-linked hackers targeted #Qatar using fake war news to spread PlugX backdoors and launch cyber-espionage attacks on military and energy sectors.

https://hackread.com/china-hackers-qatar-backdoor-fake-war-news/

#CyberSecurity #China #PlugX #CyberAttack #Malware

China-linked hackers targeted #Qatar using fake war news to spread PlugX backdoors and launch cyber-espionage attacks on military and energy sectors.

https://hackread.com/china-hackers-qatar-backdoor-fake-war-news/

#CyberSecurity #China #PlugX #CyberAttack #Malware

China-linked hackers targeted #Qatar using fake war news to spread PlugX backdoors and launch cyber-espionage attacks on military and energy sectors.

https://hackread.com/china-hackers-qatar-backdoor-fake-war-news/

#CyberSecurity #China #PlugX #CyberAttack #Malware

China-linked hackers targeted #Qatar using fake war news to spread PlugX backdoors and launch cyber-espionage attacks on military and energy sectors.

https://hackread.com/china-hackers-qatar-backdoor-fake-war-news/

#CyberSecurity #China #PlugX #CyberAttack #Malware

China-linked hackers targeted #Qatar using fake war news to spread PlugX backdoors and launch cyber-espionage attacks on military and energy sectors.

https://hackread.com/china-hackers-qatar-backdoor-fake-war-news/

#CyberSecurity #China #PlugX #CyberAttack #Malware

#plugx targeting VN "evv.msi" -> famisu[.]com e0058681fabb8e49ec780fdd78ec01fd

#plugx targeting VN "evv.msi" -> famisu[.]com e0058681fabb8e49ec780fdd78ec01fd

#plugx targeting VN "evv.msi" -> famisu[.]com e0058681fabb8e49ec780fdd78ec01fd

#plugx targeting VN "evv.msi" -> famisu[.]com e0058681fabb8e49ec780fdd78ec01fd

#plugx targeting VN "evv.msi" -> famisu[.]com e0058681fabb8e49ec780fdd78ec01fd

Grupos Chinos explotan vulnerabilidades en Ivanti para desplegar malware MetaRAT https://blog.elhacker.net/2025/12/grupos-chinos-explotan-vulnerabilidades-ivanti-malware-metarat.html #vulnerabilidad #ciberataque #Malware #metarat #ivanti #china #plugx

Grupos Chinos explotan vulnerabilidades en Ivanti para desplegar malware MetaRAT https://blog.elhacker.net/2025/12/grupos-chinos-explotan-vulnerabilidades-ivanti-malware-metarat.html #vulnerabilidad #ciberataque #Malware #metarat #ivanti #china #plugx

Grupos Chinos explotan vulnerabilidades en Ivanti para desplegar malware MetaRAT https://blog.elhacker.net/2025/12/grupos-chinos-explotan-vulnerabilidades-ivanti-malware-metarat.html #vulnerabilidad #ciberataque #Malware #metarat #ivanti #china #plugx

Grupos Chinos explotan vulnerabilidades en Ivanti para desplegar malware MetaRAT https://blog.elhacker.net/2025/12/grupos-chinos-explotan-vulnerabilidades-ivanti-malware-metarat.html #vulnerabilidad #ciberataque #Malware #metarat #ivanti #china #plugx

Dwie groźne luki w Windows aktywnie wykorzystywane. Jedna to 8-letni zero-day bez łatki

Badacze bezpieczeństwa biją na alarm w sprawie dwóch poważnych luk w systemie Windows, które są obecnie aktywnie i na szeroką skalę wykorzystywane w atakach.

Jak donosi serwis ArsTechnica, jedna z luk to krytyczna podatność, którą Microsoft niedawno próbował nieudolnie załatać. Druga to zero-day, który był wykorzystywany przez grupy hakerskie powiązane z rządami od co najmniej… 2017 roku i do dziś nie ma na to stosownej poprawki!

Groźniejsza i bardziej niepokojąca jest podatność zero-day, śledzona obecnie jako CVE-2025-9491. To błąd w obsłudze formatu skrótów Windows (.lnk). Luka została publicznie ujawniona w marcu 2025 roku przez Trend Micro, które odkryło, że była ona aktywnie wykorzystywana przez co najmniej 11 różnych grup hakerskich (APT) od 2017 roku do instalowania trojanów i oprogramowania szpiegującego. Mimo że od odkrycia minęło siedem miesięcy, Microsoft wciąż nie wydał na nią oficjalnej łaty bezpieczeństwa.

W ostatnich dniach firma Arctic Wolf zgłosiła nową, zmasowaną kampanię wykorzystującą właśnie tę lukę. Atakujący, prawdopodobnie powiązani z Chinami, używają jej do infekowania celów w Europie popularnym trojanem zdalnego dostępu (RAT) o nazwie PlugX. Z powodu braku łatki, jedyną skuteczną metodą obrony jest ręczne blokowanie lub ograniczanie przez administratorów użycia plików .lnk z niezaufanych źródeł.

Druga aktywnie wykorzystywana podatność to CVE-2025-59287, krytyczna (9.8/10) luka w usłudze Windows Server Update Services (WSUS), czyli narzędziu, którego administratorzy używają do zarządzania aktualizacjami w firmach. Błąd ten umożliwia zdalne wykonanie kodu (RCE) i jest potencjalnie zdolny do samodzielnego rozprzestrzeniania się w sieci.

Problem w tym, że Microsoft próbował załatać tę dziurę podczas październikowego „Patch Tuesday”, ale zrobił to nieskutecznie. Publicznie dostępny kod (PoC) szybko udowodnił, że poprawka jest niekompletna. Hakerzy natychmiast to wykorzystali. Firmy bezpieczeństwa, jak Huntress i Sophos, potwierdziły, że obserwują masowe ataki na serwery WSUS od 23-24 października. Microsoft był zmuszony do wydania drugiej, awaryjnej łatki poza standardowym harmonogramem, aby ostatecznie zamknąć dziurę.

Administratorzy systemów Windows powinni natychmiast zweryfikować, czy ich serwery WSUS mają zainstalowaną drugą, poprawną aktualizację. W przypadku luki zero-day w plikach .lnk, zarówno administratorzy, jak i zwykli użytkownicy, muszą zachować szczególną ostrożność i czekać na ruch ze strony Microsoftu, który do tej pory nie podał daty wydania poprawki.

Koniec z technicznym bełkotem. Aktualizacje Windows 11 będą bardziej zrozumiałe

#0Day #ArsTechnica #CVE202559287 #CVE20259491 #cyberbezpieczeństwo #lukaWZabezpieczeniach #Microsoft #news #PlugX #TrendMicro #windows #WSUS #zeroDay

Dwie groźne luki w Windows aktywnie wykorzystywane. Jedna to 8-letni zero-day bez łatki

Badacze bezpieczeństwa biją na alarm w sprawie dwóch poważnych luk w systemie Windows, które są obecnie aktywnie i na szeroką skalę wykorzystywane w atakach.

Jak donosi serwis ArsTechnica, jedna z luk to krytyczna podatność, którą Microsoft niedawno próbował nieudolnie załatać. Druga to zero-day, który był wykorzystywany przez grupy hakerskie powiązane z rządami od co najmniej… 2017 roku i do dziś nie ma na to stosownej poprawki!

Groźniejsza i bardziej niepokojąca jest podatność zero-day, śledzona obecnie jako CVE-2025-9491. To błąd w obsłudze formatu skrótów Windows (.lnk). Luka została publicznie ujawniona w marcu 2025 roku przez Trend Micro, które odkryło, że była ona aktywnie wykorzystywana przez co najmniej 11 różnych grup hakerskich (APT) od 2017 roku do instalowania trojanów i oprogramowania szpiegującego. Mimo że od odkrycia minęło siedem miesięcy, Microsoft wciąż nie wydał na nią oficjalnej łaty bezpieczeństwa.

W ostatnich dniach firma Arctic Wolf zgłosiła nową, zmasowaną kampanię wykorzystującą właśnie tę lukę. Atakujący, prawdopodobnie powiązani z Chinami, używają jej do infekowania celów w Europie popularnym trojanem zdalnego dostępu (RAT) o nazwie PlugX. Z powodu braku łatki, jedyną skuteczną metodą obrony jest ręczne blokowanie lub ograniczanie przez administratorów użycia plików .lnk z niezaufanych źródeł.

Druga aktywnie wykorzystywana podatność to CVE-2025-59287, krytyczna (9.8/10) luka w usłudze Windows Server Update Services (WSUS), czyli narzędziu, którego administratorzy używają do zarządzania aktualizacjami w firmach. Błąd ten umożliwia zdalne wykonanie kodu (RCE) i jest potencjalnie zdolny do samodzielnego rozprzestrzeniania się w sieci.

Problem w tym, że Microsoft próbował załatać tę dziurę podczas październikowego „Patch Tuesday”, ale zrobił to nieskutecznie. Publicznie dostępny kod (PoC) szybko udowodnił, że poprawka jest niekompletna. Hakerzy natychmiast to wykorzystali. Firmy bezpieczeństwa, jak Huntress i Sophos, potwierdziły, że obserwują masowe ataki na serwery WSUS od 23-24 października. Microsoft był zmuszony do wydania drugiej, awaryjnej łatki poza standardowym harmonogramem, aby ostatecznie zamknąć dziurę.

Administratorzy systemów Windows powinni natychmiast zweryfikować, czy ich serwery WSUS mają zainstalowaną drugą, poprawną aktualizację. W przypadku luki zero-day w plikach .lnk, zarówno administratorzy, jak i zwykli użytkownicy, muszą zachować szczególną ostrożność i czekać na ruch ze strony Microsoftu, który do tej pory nie podał daty wydania poprawki.

Koniec z technicznym bełkotem. Aktualizacje Windows 11 będą bardziej zrozumiałe

#0Day #ArsTechnica #CVE202559287 #CVE20259491 #cyberbezpieczeństwo #lukaWZabezpieczeniach #Microsoft #news #PlugX #TrendMicro #windows #WSUS #zeroDay

Dwie groźne luki w Windows aktywnie wykorzystywane. Jedna to 8-letni zero-day bez łatki

Badacze bezpieczeństwa biją na alarm w sprawie dwóch poważnych luk w systemie Windows, które są obecnie aktywnie i na szeroką skalę wykorzystywane w atakach.

Jak donosi serwis ArsTechnica, jedna z luk to krytyczna podatność, którą Microsoft niedawno próbował nieudolnie załatać. Druga to zero-day, który był wykorzystywany przez grupy hakerskie powiązane z rządami od co najmniej… 2017 roku i do dziś nie ma na to stosownej poprawki!

Groźniejsza i bardziej niepokojąca jest podatność zero-day, śledzona obecnie jako CVE-2025-9491. To błąd w obsłudze formatu skrótów Windows (.lnk). Luka została publicznie ujawniona w marcu 2025 roku przez Trend Micro, które odkryło, że była ona aktywnie wykorzystywana przez co najmniej 11 różnych grup hakerskich (APT) od 2017 roku do instalowania trojanów i oprogramowania szpiegującego. Mimo że od odkrycia minęło siedem miesięcy, Microsoft wciąż nie wydał na nią oficjalnej łaty bezpieczeństwa.

W ostatnich dniach firma Arctic Wolf zgłosiła nową, zmasowaną kampanię wykorzystującą właśnie tę lukę. Atakujący, prawdopodobnie powiązani z Chinami, używają jej do infekowania celów w Europie popularnym trojanem zdalnego dostępu (RAT) o nazwie PlugX. Z powodu braku łatki, jedyną skuteczną metodą obrony jest ręczne blokowanie lub ograniczanie przez administratorów użycia plików .lnk z niezaufanych źródeł.

Druga aktywnie wykorzystywana podatność to CVE-2025-59287, krytyczna (9.8/10) luka w usłudze Windows Server Update Services (WSUS), czyli narzędziu, którego administratorzy używają do zarządzania aktualizacjami w firmach. Błąd ten umożliwia zdalne wykonanie kodu (RCE) i jest potencjalnie zdolny do samodzielnego rozprzestrzeniania się w sieci.

Problem w tym, że Microsoft próbował załatać tę dziurę podczas październikowego „Patch Tuesday”, ale zrobił to nieskutecznie. Publicznie dostępny kod (PoC) szybko udowodnił, że poprawka jest niekompletna. Hakerzy natychmiast to wykorzystali. Firmy bezpieczeństwa, jak Huntress i Sophos, potwierdziły, że obserwują masowe ataki na serwery WSUS od 23-24 października. Microsoft był zmuszony do wydania drugiej, awaryjnej łatki poza standardowym harmonogramem, aby ostatecznie zamknąć dziurę.

Administratorzy systemów Windows powinni natychmiast zweryfikować, czy ich serwery WSUS mają zainstalowaną drugą, poprawną aktualizację. W przypadku luki zero-day w plikach .lnk, zarówno administratorzy, jak i zwykli użytkownicy, muszą zachować szczególną ostrożność i czekać na ruch ze strony Microsoftu, który do tej pory nie podał daty wydania poprawki.

Koniec z technicznym bełkotem. Aktualizacje Windows 11 będą bardziej zrozumiałe

#0Day #ArsTechnica #CVE202559287 #CVE20259491 #cyberbezpieczeństwo #lukaWZabezpieczeniach #Microsoft #news #PlugX #TrendMicro #windows #WSUS #zeroDay

China-linked UNC6384 group targets European diplomats via spear-phishing & PlugX malware.
Attack exploited Windows flaw ZDI-CAN-25373.
Full story 👉 https://www.technadu.com/china-linked-hacking-group-targets-european-diplomatic-entities-in-espionage-campaign/612350/

#CyberSecurity #APT #PlugX #UNC6384 #CyberEspionage

China-linked UNC6384 group targets European diplomats via spear-phishing & PlugX malware.
Attack exploited Windows flaw ZDI-CAN-25373.
Full story 👉 https://www.technadu.com/china-linked-hacking-group-targets-european-diplomatic-entities-in-espionage-campaign/612350/

#CyberSecurity #APT #PlugX #UNC6384 #CyberEspionage

China-linked UNC6384 group targets European diplomats via spear-phishing & PlugX malware.
Attack exploited Windows flaw ZDI-CAN-25373.
Full story 👉 https://www.technadu.com/china-linked-hacking-group-targets-european-diplomatic-entities-in-espionage-campaign/612350/

#CyberSecurity #APT #PlugX #UNC6384 #CyberEspionage

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

UNC6384 Attack Detection: China-Linked Group Targets Diplomats and Hijacks Web Traffic Spreading a PlugX Variant – Source: socprime.com https://ciso2ciso.com/unc6384-attack-detection-china-linked-group-targets-diplomats-and-hijacks-web-traffic-spreading-a-plugx-variant-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CyberEspionage #Latestthreats #socprimecom #socprime #PlugX #Blog #APT

UNC6384 Attack Detection: China-Linked Group Targets Diplomats and Hijacks Web Traffic Spreading a PlugX Variant – Source: socprime.com https://ciso2ciso.com/unc6384-attack-detection-china-linked-group-targets-diplomats-and-hijacks-web-traffic-spreading-a-plugx-variant-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CyberEspionage #Latestthreats #socprimecom #socprime #PlugX #Blog #APT

UNC6384 Attack Detection: China-Linked Group Targets Diplomats and Hijacks Web Traffic Spreading a PlugX Variant – Source: socprime.com https://ciso2ciso.com/unc6384-attack-detection-china-linked-group-targets-diplomats-and-hijacks-web-traffic-spreading-a-plugx-variant-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CyberEspionage #Latestthreats #socprimecom #socprime #PlugX #Blog #APT

UNC6384 Attack Detection: China-Linked Group Targets Diplomats and Hijacks Web Traffic Spreading a PlugX Variant – Source: socprime.com https://ciso2ciso.com/unc6384-attack-detection-china-linked-group-targets-diplomats-and-hijacks-web-traffic-spreading-a-plugx-variant-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CyberEspionage #Latestthreats #socprimecom #socprime #PlugX #Blog #APT