Search: “web server”

2,188 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 2246 Malware 2191 Ransomware 1391 Exploit / PoC 987 Data breach 705 Threat actor 596 Phishing & fraud 317 Policy & legal 300 Industry 236 AI tools & infra 79 Advisory 67 Research 65 AI safety & security 56 AI industry 42

SeverityAll critical 3510 high 2984 medium 2012 low 622 info 220

Banking Trojans: Ursnif Global Distribution Networks Identified

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Palo Alto Unit 42Aug 17, 12:56 UTC · Aug 17, 2026Malware in the wild

DDoS attacks in H2 2011

Kaspersky SecurelistFeb 22, 15:37 UTC · Feb 22, 2012Malware

Free trojanized WordPress themes lead to widespread compromise of web servers

Help Net SecurityFeb 19, 00:00 UTC · Feb 19, 2020Malware

Iran-linked APT OilRig target IIS Web Servers with new RGDoor Backdoor

Security AffairsFeb 4, 17:23 UTC · Feb 4, 2018Malware

Several Malware Families Targeting IIS Web Servers With Malicious Modules

The Hacker NewsAug 6, 05:11 UTC · Aug 6, 2021Malware

GoBruteforcer: New Golang-Based Malware Breaches Web Servers via Brute

The Hacker NewsMar 18, 11:52 UTC · Mar 18, 2023Malware

Cybersecurity battleground shifting to Linux and web servers

Help Net SecurityJun 27, 00:00 UTC · Jun 27, 2017Malware

Golang-Based Botnet GoBruteforcer targets web servers

Security AffairsMar 13, 22:49 UTC · Mar 13, 2023Malware1

Lazarus Group Targeting Microsoft Web Servers to Launch Espionage Malware

Infosecurity MagazineMay 24, 16:00 UTC · May 24, 2023Malware

Hajime, the mysterious evolving botnet

Kaspersky SecurelistApr 25, 08:58 UTC · Apr 25, 2017Malware

The Inevitable Move – 64

Kaspersky SecurelistDec 11, 21:41 UTC · Dec 11, 2013Malware

Protecting Your Microsoft IIS Servers Against Malware Attacks

The Hacker NewsSep 8, 12:56 UTC · Sep 8, 2023Malware

The botnet business

Kaspersky SecurelistMay 13, 10:00 UTC · May 13, 2008Malware

RubyMiner Monero Cryptominer affected 30% of networks worldwide in just 24h

Security AffairsJan 17, 20:13 UTC · Jan 17, 2018Malware CVE-2013-0156

RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

The Hacker NewsJan 1, 09:19 UTC · Jan 1, 2026Malware CVE-2025-55182 CVE-2023-1389 CVE-2025-24893

New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework

The Hacker NewsJun 5, 13:49 UTC · Jun 5, 2026Malware

New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants

Cisco TalosSep 19, 12:00 UTC · Sep 19, 2023Malware

Web shell malware continues to evade many security tools

Help Net SecurityApr 23, 00:00 UTC · Apr 23, 2020Malware CVE-2019-0604 CVE-2019-19781 CVE-2019-3396+10 CVEs

Experts show how to defeat the AMD's Secure Encrypted Virtualization

Security AffairsMay 26, 14:15 UTC · May 26, 2018Malware

The SessionManager IIS backdoor: a possibly overlooked GELSEMIUM artefact

Kaspersky SecurelistJun 30, 08:00 UTC · Jun 30, 2022Malware

Hackers hosted tools on a Stanford University website for months

Help Net SecurityJun 26, 21:22 UTC · Jun 26, 2018Malware

Infostealers increasingly impact global security

Help Net SecurityNov 13, 00:00 UTC · Nov 13, 2024Malware CVE-2010-4598 CVE-2011-2474 CVE-2014-0130+15 CVEs

CCleaner Command and Control Causes Concern

Cisco TalosSep 20, 21:57 UTC · Sep 20, 2017Malware

Ebury Botnet Malware Compromises 400,000 Linux Servers Over Past 14 Years

The Hacker NewsMay 15, 00:00 UTC · May 15, 2024Malware CVE-2021-45467

Prometei botnet improves modules and exhibits new capabilities in recent updates

Cisco TalosMar 9, 13:02 UTC · Mar 9, 2023Malware CVE-2019-07081

The serpent’s tongue: Luring the Python out of its den

Cisco TalosJul 14, 10:00 UTC · Jul 14, 2026Malware1

Kaspersky SOC analyzes an incident involving a web shell used as a backdoor

Kaspersky SecurelistFeb 28, 04:00 UTC · Feb 28, 2025Malware

BRICKSTORM backdoor exposed: CISA warns of advanced China

Security AffairsDec 5, 11:03 UTC · Dec 5, 2025Malware

AgentTesla Remains Most Prolific Malware in November, Emotet and Qbot Grow

Infosecurity MagazineDec 14, 17:00 UTC · Dec 14, 2022Malware

Offensive attacks and the World Cup 2010

Kaspersky SecurelistJun 11, 19:10 UTC · Jun 11, 2010Malware

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.

Sophos's September 7 analysis describes malware tied to F5's c05d5254 activity that hooks apr_dso_load, modifies the libphp PHP module in memory, and injects a PHP web shell when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, leaving on-disk files clean. A separate installer infects /usr/sbin/httpd and umount, runs before Apache starts, disables SELinux (per ESET's related PoisonedRefresh analysis), and opens a local socket at /run/bigtlog.pipe for shell access. The activity is linked to CVE-2025-53521 in BIG-IP APM, rated 9.8 CVSS 3.1, patched in October 2025, added to CISA KEV on March 27, 2026.

The Hacker NewsSep 9, 07:36 UTC · 7d agoMalware in the wildCVE-2025-53521