🔥 CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March

https://therecord.media/cisa-us-agency-breached-cisco-vulnerability-backdoor

#cisco #firestarter #backdoor #CVE202520333 #CVE202520362

CVE-2026-7413: Persistent undocumented backdoor access with Yarbo

Yarbo 로봇 펌웨어 v2.3.9에 문서화되지 않은 영구 백도어가 발견되어 원격에서 인증 없이 루트 권한 쉘 접근이 가능합니다. 이 백도어는 사용자 설정으로 비활성화할 수 없으며 공장 초기화나 펌웨어 업데이트 후에도 남아 있어 심각한 보안 위협을 초래합니다. CVE-2026-7413은 CVSS 7.2점의 높은 위험도로 평가되며, 관련 취약점들과 결합 시 로봇 전체 함대에 대한 무단 제어와 데이터 노출이 가능해집니다. 공급업체는 백도어 제거와 인증 메커니즘 개선, 펌웨어 업데이트 시 완전 제거를 조치해야 하며, 임시로 네트워크 차단 및 모니터링이 권고됩니다.

https://takeonme.org/cves/cve-2026-7413/

#security #firmware #backdoor #iot #vulnerability

Donuts and Beagles: Fake Claude site spreads backdoor

A fraudulent website impersonating Anthropic's Claude AI platform has been distributing a previously undocumented backdoor called Beagle through malvertising campaigns. The attack begins when victims download a fictitious tool named Claude-Pro Relay from claude-pro[.]com, delivered as a 505 MB ZIP archive. The infection chain utilizes DLL sideloading, exploiting a signed G DATA antivirus updater to load malicious code. The technique mirrors PlugX delivery methods but deploys different payloads. Beagle supports eight commands including shell execution, file transfer, and directory listing, communicating with C2 servers using AES encryption. Related samples dating to February 2026 have been identified, with some variants delivering AdaptixC2 framework. Additional domains impersonated security vendors like Trellix, CrowdStrike, and SentinelOne. The infrastructure spans Cloudflare for distribution and Alibaba Cloud for command and control.

Pulse ID: 69fcc63f1dce161fc2f8380c
Pulse Link: https://otx.alienvault.com/pulse/69fcc63f1dce161fc2f8380c
Pulse Author: AlienVault
Created: 2026-05-07 17:05:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Cloud #CrowdStrike #CyberSecurity #Encryption #InfoSec #Malvertising #OTX #OpenThreatExchange #PlugX #SentinelOne #SideLoading #Trellix #ZIP #bot #AlienVault

MuddyWater usa il ransomware Chaos come falsa bandiera: l’Iran maschera lo spionaggio di Stato da cybercrime

https://insicurezzadigitale.com/muddywater-usa-il-ransomware-chaos-come-falsa-bandiera-liran-maschera-lo-spionaggio-di-stato-da-cybercrime/

From Venture Beat: "One command turns any open-source repo into an #AI #agent #backdoor. #OpenClaw proved no supply-chain scanner has a detection category for it"

#Security #OpenSource

https://venturebeat.com/security/one-command-open-source-repo-ai-agent-backdoor-openclaw-supply-chain-scanner

Un nuovo malware Linux punta dove fa più male
#quasarlinux è il nuovo nome da tenere d'occhio nel panorama #malware I ricercatori lo descrivono come un impianto modulare per sistemi #linux capace di combinare #backdoor #rootkit e furto di credenziali. Il bersaglio non è un utente generico:sono ambienti DevOps, repository, server di build e macchine che spesso hanno accesso a segreti molto più preziosi di un singolo account
#UnoLinux #gnulinux #gnulinuxitalia #linuxitalia

https://www.tomshw.it/hardware/malware-linux-sviluppatori-quasar

🚨 NEWS: Allarme Daemon Tools: Un Attacco alla Supply Chain Ha Compromesso il Popolare Software per Dischi Virtuali

Ecco i punti chiave in breve:
💡 Un grave attacco informatico mirato alla supply chain ha colpito Daemon Tools, il noto software per emulare unità CD e DVD virtuali, compromettendone gli aggiornamenti per oltre un...

🚀 LINK: https://meteoraweb.com/news/allarme-daemon-tools-un-attacco-alla-supply-chain-ha-compromesso-il-popolare-software-per-dischi-virtuali

#malware #sicurezza #supplyChain #attaccoInformatico #backdoor

DAEMON Tools installers were trojanized in a supply-chain attack, delivering a backdoor to thousands of systems worldwide since April 8 🌐
The malware affected versions 12.5.0.2421–12.5.0.2434, targeting high-value organizations and enabling remote code execution via compromised binaries 🛡️

🔗 https://www.bleepingcomputer.com/news/security/daemon-tools-trojanized-in-supply-chain-attack-to-deploy-backdoor/

#TechNews #Daemon #DAEMONTools #Malware #Security #Microsoft #Windows #Backdoor #Attack #Threat #CyberSecurity #Software #InfoSec #Hacking #Safety #Digital #Computing #Protection

🚨 NEWS: La Minaccia Gemella: Supply Chain e Dati degli Studenti nel Mirino dei Cybercriminali

Ecco i punti chiave in breve:
💡 Il panorama della cybersecurity globale vive un momento di tensione senza precedenti. Due distinti attacchi informatici, resi noti nelle ultime ore, delineano una strategia aggress...

🚀 LINK: https://meteoraweb.com/news/la-minaccia-gemella-supply-chain-e-dati-degli-studenti-nel-mirino-dei-cybercriminali

#sicurezzaInformatica #supplyChain #attaccoInformatico #backdoor #datiStudenti

Popular DAEMON Tools software compromised

Since April 8, 2026, installers of DAEMON Tools software have been compromised with malicious payloads distributed through the legitimate website. Versions 12.5.0.2421 to 12.5.0.2434 contain trojaned binaries (DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe) signed with legitimate developer certificates. The attack has affected thousands of systems across over 100 countries, though advanced payloads were selectively deployed to approximately a dozen machines in government, scientific, manufacturing, and retail organizations. Initial infection establishes backdoor communications to typosquatted domains, followed by deployment of an information collector for system profiling. Targeted systems receive additional implants including a minimalistic backdoor and QUIC RAT. Chinese-language strings found in malicious components suggest a Chinese-speaking threat actor. The attack remains active at time of publication, demonstrating sophisticated supply chain compromise techniques comparable to the 2023 3CX ...

Pulse ID: 69f9fd6e0328f7a1be1faa20
Pulse Link: https://otx.alienvault.com/pulse/69f9fd6e0328f7a1be1faa20
Pulse Author: AlienVault
Created: 2026-05-05 14:23:42

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Chinese #CyberSecurity #Government #InfoSec #Mac #Manufacturing #Nim #OTX #OpenThreatExchange #RAT #SupplyChain #Trojan #bot #AlienVault