#threatresearch — Public Fediverse posts

New.

"The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected."

Rapid7: DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors/ @Rapid7Official #infosec #cybercrime #threatresearch #Linux

Note: the actor in question targets Russian organizations.

Kaspersky: Angry Birds: Toy Ghouls’ new toys https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ @Kaspersky #infosec #threatresearch #cybercrime

New.

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ #Microsoft #threatresearch #phishing

New.

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ #Microsoft #threatresearch #phishing

New.

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ #Microsoft #threatresearch #phishing

New.

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ #Microsoft #threatresearch #phishing

New.

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ #Microsoft #threatresearch #phishing

New.

"Huntress is observing the same anomalous pattern across unrelated endpoints in various organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to execute 1.vbs, 2.vbs, 3.vbs, and 4.vbs."

Huntress: Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity https://www.huntress.com/blog/rogue-screenconnect-installations @huntress #infosec #threatresearch

New.

Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action https://www.group-ib.com/blog/chenlun-outsider-phaas-kit/ #phishing #infosec #cybercrime #threatresearch

Microsoft posted this late yesterday.

Microsoft: Counterfeit installers to system compromise: Tracking a deceptive software download campaign https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/ #Microsoft #infosec #threatresearch #malware #cybercrime

New.

Threat Fabric: Uncovering StreamRat: From Meta Ads to Full Device Takeover https://www.threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat #infosec #threatresearch #Meta #Android #malware

NICKEL TAPESTRY expands fraudulent worker operations – Source: news.sophos.com https://ciso2ciso.com/nickel-tapestry-expands-fraudulent-worker-operations-source-news-sophos-com/ #DemocraticPeople’sRepublicofKorea #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #socialengineering #Socialengineering #employmentscam #nickeltapestry #ThreatResearch #nakedsecurity #nakedsecurity #NorthKorea #FEATURED #featured #fraud #ctu