VulnHub

Real-time Cybersecurity News

Critical

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

The Hacker News
Actively Exploited
LinuxMalwareTrend Micro

Overview

Researchers have identified 14 malicious npm packages disguised as calendar and streak utilities that deliver a Linux backdoor known as RedC2 4.0. When these trojanized packages are activated, they execute a bundled binary in the background, allowing attackers to control compromised systems. This type of threat is particularly concerning because it targets developers and users who rely on npm for legitimate software, potentially leading to widespread system vulnerabilities. Users of affected systems need to be cautious and ensure they are not using these harmful packages. The incident serves as a reminder for developers to vet their dependencies carefully and for organizations to monitor their environments for any unauthorized software.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: npm packages, Linux systems
  • Action Required: Users should remove any suspicious npm packages and monitor for unusual activity on their systems.
  • Timeline: Newly disclosed

Original Article Summary

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's

Impact

npm packages, Linux systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should remove any suspicious npm packages and monitor for unusual activity on their systems. Regularly updating software dependencies and utilizing security tools to scan for vulnerabilities is also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Malware, Trend Micro.

Read Original Article

Related Coverage

Navy warns of multi-pronged adversary campaign targeting personnel and installations

SCM feed for Latest

The U.S. Navy has issued a warning about a concerted campaign targeting its personnel and installations. This campaign involves a variety of tactics, including harassment on social media, doxing, surveillance activities, and even physical attacks. These actions pose significant risks to both the safety of Navy members and the security of military assets. As adversaries explore multiple methods to gather intelligence and disrupt operations, the Navy is urging personnel to remain vigilant and report any suspicious activity. This situation illustrates the evolving nature of threats faced by military organizations today.

Aug 21, 2026

Army seeks AI agents for cyber defense amid evolving threats

SCM feed for Latest

The U.S. Army is launching a pilot program called Project Griffin, which aims to develop a network of AI agents designed for cyber defense. These AI agents will analyze data from the Army's extensive network sensors and can take defensive actions autonomously. This initiative is a response to the increasing complexity of cyber threats that military networks face. By integrating AI into their cybersecurity efforts, the Army hopes to enhance its ability to protect critical systems and respond to incidents more effectively. This move is significant as it reflects the military's commitment to adopting advanced technologies to counter evolving cyber risks.

Aug 21, 2026

Senator Wyden seeks review of federal law enforcement hacking tools

SCM feed for Latest

Senator Ron Wyden has requested the U.S. Government Accountability Office (GAO) to investigate how federal law enforcement agencies, including the FBI, DEA, ICE Homeland Security Investigations, and the Secret Service, are using advanced hacking tools for surveillance. This inquiry aims to understand the extent and implications of these technologies on privacy and civil liberties. With concerns rising over government overreach and the potential misuse of such tools, Wyden's actions seek to ensure accountability and transparency in law enforcement practices. The outcome of this investigation could lead to significant policy changes regarding how surveillance technologies are deployed and regulated. It also raises questions about the balance between public safety and individual privacy rights.

Aug 21, 2026

OWASP Flags Top AI Skill Risks in New Security Blueprint

darkreading

The Open Worldwide Application Security Project (OWASP) has released a new top 10 list focused on the security risks associated with artificial intelligence. This list is part of a broader initiative to create a Universal Skill Format aimed at ensuring consistent security practices for AI applications. The new guidelines address various vulnerabilities that developers and organizations may face as they integrate AI technologies into their systems. By identifying these risks, OWASP hopes to help companies better prepare and protect their applications from potential threats. This is significant as more businesses adopt AI, making it crucial to understand and mitigate the associated security challenges.

Aug 21, 2026

The Taiwan attack was built with two free downloads from vendors nobody rates

SCM feed for Latest

A recent attack in Taiwan was reportedly facilitated by two free downloads from lesser-known vendors, raising concerns about the security of AI agent frameworks. Organizations need to scrutinize which frameworks are integrated into their systems, who developed them, and whether these vendors have any track record or ratings. This incident serves as a wake-up call for companies to assess their use of third-party software, especially those that may not have established reputations. The lack of oversight and accountability in these downloads can expose businesses to significant risks, making it crucial for teams to implement stricter evaluation processes for their tech stack. As the reliance on AI technologies grows, understanding the origins and security of these tools becomes increasingly important.

Aug 21, 2026

In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug

SecurityWeek

Several notable cybersecurity incidents have emerged recently. The Threema messaging platform experienced a distributed denial-of-service (DDoS) attack, disrupting its services and potentially affecting user communications. In another development, the Evooo1Bot Linux botnet has been identified, which may pose risks to Linux-based systems by allowing attackers to execute commands remotely. Additionally, Crypto4A has achieved a significant milestone by securing top-tier certification from NIST, highlighting its commitment to cybersecurity standards. These incidents illustrate ongoing challenges in the digital landscape and the constant need for vigilance among users and organizations alike.

Aug 21, 2026