VulnHub

A new backdoor called PATCHCORD has been identified, targeting telecommunications and infrastructure in Afghanistan and South Asia. This malware uses a clever method to maintain persistence by hijacking shortcuts for popular web browsers, including Edge, Chrome, and Firefox. By doing this, it ensures that the malicious code runs before the legitimate application starts. This poses a significant risk to users, as it could allow attackers to gain unauthorized access to sensitive information and disrupt services. The implications of this threat are serious, considering the critical role of telecommunications in these regions. Organizations in the affected areas need to be vigilant and implement strong security measures to mitigate potential impacts.

The LiteLLM supply-chain attack, linked to a malware known as 'SANDCLOCK,' has compromised credentials in over 2,000 code repositories, significantly impacting sectors such as technology, banking, healthcare, and retail. Researchers from Resecurity estimate that this breach has caused serious security concerns across these industries, as the backdoor allows attackers to manipulate or access sensitive data. The attack's implications are expected to linger, raising alarms about the security of software supply chains. Companies in the affected sectors are urged to assess their security measures and update their systems to prevent further exploitation. The depth of this breach underscores the vulnerabilities inherent in code repositories used by many organizations today.

Researchers have discovered a new Linux botnet called Evooo1Bot, which builds upon the Mirai botnet's source code. This botnet can exploit known vulnerabilities to convert internet-facing devices into SOCKS5 proxies. The malware not only incorporates the DDoS capabilities of Mirai but also adds several new features that enhance its functionality. This poses a significant risk as it can affect various edge devices that are often less secure and can be used for malicious activities like distributed denial-of-service attacks. Users and companies with exposed devices need to take immediate action to protect their systems from this emerging threat.

The latest edition of the Security Affairs Malware newsletter features significant developments in malware tactics, particularly focusing on the Kimsuky group. Researchers report that Kimsuky has integrated artificial intelligence into its operations, employing AI-generated decoy documents to mislead targets and utilizing a local language model for enhanced attack capabilities. Additionally, the newsletter discusses the evolution of the Kimwolf botnet, now at version 7, which poses a growing risk to various organizations. Agencies like CISA and the FBI are urging companies to stay vigilant against these emerging threats. The evolution of these malware tactics underscores the need for organizations to bolster their cybersecurity measures to protect sensitive information.

Mustang Panda, also known as HoneyMyte, has enhanced its CoolClient backdoor by deploying a signed kernel-mode driver that can conceal processes, files, and network activity. This upgrade makes it significantly harder for security software to detect and remove the malware from infected Windows systems. Kaspersky's recent analysis indicates that this new variant of CoolClient deepens the malware's integration into the operating system, raising concerns for users and organizations relying on Windows. The implications are serious, as this could allow attackers to maintain prolonged access to compromised systems while evading detection. Users and organizations need to remain vigilant and implement security measures to protect against this evolving threat.

A recent cybersecurity concern involves attackers purchasing expired domain names and using them to distribute malware. This tactic allows them to exploit the trust users have in familiar web addresses, potentially leading to security breaches and data theft. Companies and individuals who own domains should monitor their registrations closely to avoid falling victim to this scheme. Additionally, organizations need to educate users about the risks associated with clicking on links from unknown or expired domains. The implications of this practice are significant as it not only affects the victims directly but also undermines overall internet security trust. Staying vigilant and proactive in domain management is essential to mitigate these risks.

Salesforce and ServiceNow portals were exposed for 17 months due to a security vulnerability that allowed unauthorized access to sensitive data. The flaw was discovered by researchers who pointed out that it could have been exploited by attackers to gain critical information from user accounts. The prolonged exposure raises serious concerns about data protection and incident response practices within these platforms. Organizations using these services should review their security measures and consider implementing additional safeguards to protect user data. This incident is a stark reminder of the importance of timely security updates and monitoring for vulnerabilities in widely used software.

Attackers are increasingly purchasing expired domain names to take advantage of their established online reputation and traffic. These domains, referred to as dropcatch domains, can be exploited for malicious purposes, including distributing malware, conducting scams, and setting up command-and-control (C2) infrastructure. Each day, around 65,000 domain names that have lapsed are re-registered by new owners, which presents a significant risk. This trend poses dangers to users and organizations as they may unwittingly interact with these compromised domains, leading to potential security breaches. Awareness of this tactic is crucial for internet users and companies to mitigate risks associated with these expired domains.

A new botnet named Evooo1Bot has emerged, targeting internet-facing routers and other gateway devices. Based on the Mirai malware, this botnet converts these devices into SOCKS5 traffic relay nodes, allowing attackers to route internet traffic through them. This can enable various types of malicious activities, including distributed denial-of-service (DDoS) attacks. The attack affects any vulnerable Linux-based routers or similar devices that are exposed to the internet, making it crucial for users and network administrators to secure their devices against unauthorized access. As the botnet continues to spread, it poses a significant risk to network integrity and privacy.

Cybercriminals are increasingly turning to expired domains, known as 'dropcatch' domains, to carry out their illicit activities. These domains are appealing because they come with existing trust, backlinks, and web traffic from their previous legitimate use, making them less suspicious to security systems compared to newly registered domains. This trend raises concerns for businesses and users alike, as these domains can be used for phishing, malware distribution, and other online scams. The use of such domains complicates the detection of malicious activities, as they can easily evade traditional security measures. It's crucial for organizations to stay vigilant and consider monitoring expired domains that could be repurposed for harmful activities.

Hackers are increasingly buying expired domains to take advantage of their existing traffic and credibility to misdirect users toward scams and malware. According to Infoblox, a firm that specializes in DNS threat intelligence, these domains—known as dropcatch domains—can be quickly registered after they expire. In the first half of 2026 alone, cybercriminals purchased over 50,400 of these domains, allowing them to exploit unsuspecting users. This practice poses significant risks as it can lead to increased phishing attacks and the spread of malicious software. Users and businesses need to be aware of these tactics to protect themselves from falling victim to these scams.

Researchers from Group-IB have identified a new Android malware called WindRelay that poses a significant threat to users by capturing real-time payment card data via NFC (Near Field Communication). The malware works in conjunction with the SpyNote remote access trojan, enabling attackers to gain control over a victim's device and relay sensitive information directly to them. The attack typically begins with a phone call from a fraudster impersonating a bank representative, tricking victims into revealing their financial data. This malware not only compromises personal financial security but also highlights the growing sophistication of cybercriminal tactics. Users need to be vigilant about unsolicited calls and consider additional security measures to protect their payment information.