ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “SSH tunneling tool”

20 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllThreat actor 12Exploit / PoC 8Malware 3AI safety & security 1Vulnerability 1
SeverityAllcritical 8high 10medium 7low 0info 0

Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel

Group-IB uncovered new infrastructure linked to the Tortoiseshell threat actor, including an additional backdoor and an SSH tunneling tool.

Group-IB researchers have discovered new Tortoiseshell infrastructure, revealing an expanded backdoor and a purpose-built SSH tunneling utility. Tortoiseshell is known for targeting IT providers and telecom companies, frequently through supply-chain attacks. The expanded toolset suggests the group is investing in stealthy persistence and covert network communications.

Infosecurity Magazine · 21d agoThreat actor

Nimbus Manticore Expands Toolset With TWOSTROKE

Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.

Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.

The Hacker News · 21d agoThreat actor in the wild

Iranian Hackers Pose as Recruiters to Deliver Cross

Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.

Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.

The Hacker News · 14d agoThreat actor

Iran-linked hackers expand infrastructure across Europe and Middle East, report says

Group-IB found Iran-linked Tortoiseshell expanding command-and-control infrastructure into the UK, Belgium, Saudi Arabia and the UAE with new malware tooling.

Group-IB researchers identified new Tortoiseshell command-and-control infrastructure, including servers named 'uk1' and 'uk2' hosted on UK IP addresses, plus systems in Belgium, Saudi Arabia and the UAE. The Iran-linked espionage group, active since at least 2018 and previously tied to the Islamic Revolutionary Guard Corps, has historically targeted defense, aerospace, technology and military organizations in the Middle East and the United States. Researchers also uncovered new malware samples, including a backdoor resembling TwoStroke that enables command execution, file theft and system reconnaissance, and a tool establishing reverse SSH tunnels to attacker-controlled servers. Group-IB assesses that the group is expanding both its geographic reach and its capabilities and ranks it among the most active Iranian APTs of 2026.

The Record · 21d agoThreat actor in the wild

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker News · 27d agoThreat actor in the wild1

DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own sandbox via an unauthenticated local API; fixed in 0.1.2-alpha.2.

DeepSeek Harness versions 0.1.1-rc.2 and earlier allowed a sandboxed AI coding agent to turn off its own OS sandbox by calling the tool's unauthenticated local web interface, tracked as CVE-2026-82533 with a 9.4 CVSS from VulnCheck. A single command set the agent session to danger-full-access mode, removing sandboxing and approval prompts, and OX Research verified writes escaped the workspace. The interface trusted the client-supplied Host header with no authentication and could also return a session's entire conversation log. The fix adds a one-time token and signed-cookie check; the first npm release carrying it is 0.1.2-alpha.2, with 0.1.2-rc.1 current.

The Hacker News · 7d agoAI safety & security in the wildCVE-2026-825331

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated · 24m agofirst · 5d agoExploit / PoC in the wild 15 sourcesCVE-2026-20079CVE-2026-203165· 2 reads

Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons

Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.

Check Point Research dubbed the cluster Gambling Goblin and linked it with medium-to-high confidence to Earth Berberoka, a Chinese-speaking group Trend Micro documented in 2022, citing shared oRAT tooling, Chinese-language artifacts, and domains mimicking trusted tech brands. Custom Apache modules installed on compromised Brazilian government and education servers acted as reverse proxies, routing selected visitors to gambling and sports-betting phishing pages impersonating Google Play, the Microsoft Store, and Amazon while stripping CSP headers. The broader Linux toolkit included the DownPro downloader, AlphaAgent and oRAT backdoors, the 3snake-based PasswordHarvester credential stealer, and an SSH brute-forcer, with operations extending to Vietnamese, Spanish, and English phishing pages.

Infosecurity Magazine · 14d agoThreat actor

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.

Cisco Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that lets unauthenticated remote attackers execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3), which permits low-privileged logins and can be chained for privilege escalation. Talos identified three post-compromise clusters: UAT-12197 deploying JSP web shells and a JAR command executor for credential theft; UAT-11823, an APT overlapping with Sandworm, deploying a Netcat reverse shell and Cyclops Blink malware; and UAT-11988, assessed as a ransomware operator with TTPs consistent with Qilin affiliates. Hotfixes are available, with a comprehensive hardening release due the week of September 14, 2026.

Cisco Talos · 7d agoExploit / PoC in the wild 2 sourcesCVE-2026-20079CVE-2026-20316

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security News · 8d agoExploit / PoC in the wildCVE-2025-252491

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.

Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.

Security Affairs · 10d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860602

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker News · 17d agoThreat actor in the wild1

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackers · 8d agoMalware in the wildCVE-2025-252492

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackers · 1d agoThreat actor in the wild 3 sourcesCVE-2026-6000410

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker News · 23d agoMalware in the wild

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker News · 15d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2026-74232+2 CVEs1

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 15d agoMalware in the wild

China-linked Fire Ant Hides Inside Trusted Infrastructure

China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.

Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.

Security Affairs · 16d agoThreat actor in the wild1

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.

Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.

Palo Alto Unit 42 · 14d agoThreat actor in the wild

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.

VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.

The Hacker News · 8d agoVulnerability in the wildCVE-2026-74232CVE-2026-74233CVE-2026-66747