Russia-aligned actors exploit MDaemon flaw to plant backdoors with no clicks
ESET says MDaemon before 26.0.4 runs CVE-2025-8088 while scanning a malicious RAR, dropping HELLAGE or HELLTAG DLLs in Ukraine.
74
- Mentions · 7d10
- Mentions · 30d26
- All mentions56
- First seenAug 12, 2026
- Last mentioned6h ago
Timeline
56 articles · newest firstDeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
76
ESET: Belarus-linked FrostyNeighbor wipes Ukrainian transport manufacturer
UNC1151 used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper delivered through Group Policy.
74
GhostWriter linked to first Belarus data wipe at Ukrainian firm
ESET ties FrostyNeighbor to the wipe and says Belarus-aligned operators increasingly mirror Russian priorities in Ukraine.
64
ESET details Amatera infostealer spread, capabilities, and MaaS model
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
58
ESET: GhostWriter wiper hit a Ukrainian manufacturer
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
74
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
58
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
ASD cuts an Amadey operator off from 180,000 infected computers
The disruption does not recover credentials already stolen, and ASD’s annual report does not describe the operation.
74
Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
86
Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
73
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
76
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
68
What to do when a data breach notice doesn't say much
ESET explains how to act on vague breach notices as US victim notices surge and details shrink.
42
Week in review: FortiBleed is still active, Patch Tuesday forecast
CISA added an exploited NetScaler flaw to KEV as Atlassian, Exchange, and SonicWall patches landed amid active attacks.
76
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
UAC-0099's MATCHBOIL downloader hides C2 behind Cloudflare and delivers MATCHWOK to Ukrainian firms.
66
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
UAC-0099's MATCHBOIL downloader evolved with sandbox checks, .NET Reactor obfuscation, scheduled-task persistence, and recurring C2, hitting Ukrainian transport and energy firms.
58
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.
78
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
ESET documents two years of UAC-0099 upgrades to its MATCHBOIL downloader used in espionage against Ukrainian government, energy and transport sectors.
55
YouTubers targeted with fake sponsorships and “channel verification” phishing
Scammers phish YouTube creators with fake brand sponsorships to steal Google account credentials.
50
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
UAC-0099 upgraded MatchBoil malware in espionage attacks on Ukrainian transport and energy firms.
74
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.
76
MATCHBOIL: New tricks, same old evil intentions
ESET details MATCHBOIL, a C# downloader UAC-0099 uses against Ukrainian transport, manufacturing, and energy firms.
67
Inside a brand deal scam targeting YouTube creators
Scammers impersonate brands such as Hollyland to phish YouTube creators and hijack Google accounts.
52
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
78
The quest for simplicity: Why SMBs want advanced protection without the complexity
ESET argues SMBs want advanced, simple cybersecurity and managed detection rather than more complex point tools.
26
This month in security with Tony Anscombe – September 2026 edition
ESET's September roundup covers AI agents hacking a government health database and Microsoft's 974 patches.
78
Hackers Hide Malware Inside 7-Zip Installers Using a New Evasion Technique
G Data found OpenSUpdater loaders hidden inside tampered 7-Zip SFX extraction code, using nested legitimate installers and padded certificates to evade analysis.
52
Timeshare exit scams: From fake buyers to recovery fraud
ESET details timeshare exit scams hitting owners trying to quit contracts: upfront-fee fraud, fake buyers, shell-LLC transfers, and double-dip recovery scams.
15
The devil is still in the email – but wearing a new mask
ESET details modern phishing evolution: QR codes, OAuth token theft via ConsentFix, ClickFix paste attacks, and deepfake-assisted BEC.
45
Documentation placeholder domain used in ClickFix attacks
Placeholder domain third-party.com is serving ClickFix lures that execute remote PowerShell on Windows.
62
Is that vibe coded app safe? 5 checks before you download
ESET lists five checks for vetting AI “vibe coded” apps that may leak data or enable fraud.
32
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
80
Been told to pay at a Bitcoin ATM? Read this first
ESET details Bitcoin ATM impersonation scams; FBI logged 13,460 incidents costing victims $389 million in 2025, mostly hitting people over 50.
16
AI-Powered Threats Exploit Digital Trust Through Autonomous Breach Techniques
A PRC-linked group used Claude Code as an autonomous operator for espionage, while researchers identified the first Android malware leveraging generative AI.
70
Looking for free Robux? Here’s what’s real, and what’s a scam
ESET warns free Robux generators, fake giveaways, and lookalike Roblox login pages steal children's credentials, personal data, and money.
15
The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive
ESET warns SMB AI agents face malicious skills and prompt injection while classic attacks still dominate breaches.
64
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
78
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
78
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.
78
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
- CVE-2023-3602588%8.8Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files
- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2026-688209%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- CVE-2026-969403%8.8Weak authorization privilege escalation in Microsoft Exchange Server
- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
Appears with
- ESETvendor · 22
- CERT-UAorganization · 12
- UAC-0099threat actor · 12
- MatchBoilmalware · 11
- Microsoftvendor · 10
- Sandwormthreat actor · 9
- MatchWokmalware · 8
- Microsoftorganization · 7
- Googlevendor · 6
- FamousSparrowthreat actor · 4
- Windowsproduct · 4
- Dragstaremalware · 4
- MATCHBOILproduct · 3
- OWASPorganization · 3
- Ezirizvendor · 3
- .NET Reactorproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.