LockBit (Vendor): news timeline & CVEs

BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files

The backdoor collects system information via MQTT, including host inventory, commands, files, and directory listings. It operates as a publisher-subscriber model with embedded MQTT brokers, using repeating XOR operation…

The backdoor is a Linux backdoor using MQTT to collect system information, including host inventory, commands, files, and directory listings. It was observed to operate as a publisher-subscriber model with embedded MQTT brokers. The sample includes embedded MQTT topics for secure communication and has been seen in multiple instances across different IP addresses and domains. The backdoor extracts files from a victim, decodes a configuration blob, recovers a MQTT broker address, and creates a client identifier. It operates on Windows-style paths and time values, indicating compatibility with a management design that may have originated elsewhere.

Cyber Security NewsSep 22, 12:29 UTC · 4d agoOther in the wild 2 sources

New pro-Ukraine hacker group targets Russian companies with custom ransomware

F6 links new pro-Ukraine ransomware group VantaCore, likely a Thor rebrand, to seven attacks on Russian firms using custom tooling and multimillion-dollar demands.

Russian cybersecurity firm F6 reports that VantaCore, a ransomware group believed to be a rebrand of pro-Ukrainian group Thor, has targeted at least seven Russian organizations with ransom demands reaching millions of dollars, operating as a ransomware-as-a-service operation with a Tor-based victim chat and a leak site. The group uses custom-built tooling including the VantaCore ransomware that encrypts servers and workstations, VantaCoreLoader for distribution, the VantaCoreRAT backdoor, and SnowKiller, which disables antivirus and security software. Initial access relies on poorly secured VPNs and remote-access tools, flaws in internet-facing applications, and credentials stolen from business partners. F6 notes pro-Ukrainian groups increasingly abandoned stock ransomware like LockBit 3 Black and Babuk in 2025-2026 in favor of custom malware.

The RecordSep 2, 15:11 UTC · 24d agoRansomware

LockBit

Timeline2 articles

Appears with

BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files

New pro-Ukraine hacker group targets Russian companies with custom ransomware