ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Experience Manager”

3 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 2Threat actor 1
SeverityAllcritical 0high 1medium 2low 0info 0

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security News · 3h agoThreat actor in the wild 5 sourcesCVE-2020-0688CVE-2019-0708

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security News · 21h agoMalware in the wild 3 sources

Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems

Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.

Check Point assesses Noodle RAT, also known as ANGRYREBEL, as a distinct backdoor family rather than a variant of Gh0st RAT or Rekoobe, with separate Windows (Win.NOODLERAT) and Linux (Linux.NOODLERAT) variants sharing a common command-and-control design. The Windows implant runs filelessly via shellcode with loaders like MULTIDROP and MICROLOAD, while the Linux variant provides reverse shells, file management, and SOCKS tunneling after exploitation or web-shell placement on exposed servers. Groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have deployed it against organizations in Thailand, India, Japan, Malaysia, and Taiwan. Check Point released sample hashes and C2 IP indicators alongside the analysis.

Cyber Security News · 21h agoMalware in the wild 2 sources