ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Windows Routing and Remote Access Service”

3 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 5Threat actor 4AI safety & security 1Industry 1Phishing & fraud 1Ransomware 1
SeverityAllcritical 0high 5medium 7low 0info 1

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security News · 4h agoThreat actor in the wild 5 sourcesCVE-2020-0688CVE-2019-0708

Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.

Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.

Cyber Security News · 2d agoThreat actor in the wild

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security News · 1h agoThreat actor in the wild 3 sources