Blog
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Kimsuky Hackers Deploy New Linux Backdoor in Attacks on South Korea
Gomir shares many similarities with GoBear and features direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands.
Tracking the Progression of Earth Hundun’s Cyberespionage Campaign in 2024
Deuterbear, while similar to Waterbear in many ways, shows advancements in capabilities such as including support for shellcode plugins, avoiding handshakes for RAT operation, and using HTTPS for C&C communication.
SugarGh0st RAT Variant Used in Targeted AI Industry Attacks
The May 2024 campaign, dubbed UNK_SweetSpecter, employs the SugarGh0st RAT, a remote access trojan tailored from the Gh0stRAT. This variant, historically linked to Chinese-speaking threat actors, has now been repurposed to target AI-related entities.
New Backdoors on a European Government’s Network Appear to be Russian
Researchers with the Slovak cybersecurity firm ESET published a technical analysis on Wednesday of the two backdoors by a suspected Russian threat group, which they named LunarWeb and LunarMail.
FREE GUIDE