Search: “dcrat”

16 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 54 Threat actor 10 Ransomware 9 Vulnerability 5 Policy & legal 2 Exploit / PoC 2 Data breach 2 Phishing & fraud 1

SeverityAll critical 19 high 23 medium 42 low 0 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI discloses CVE-2026-81985, a second use-after-free in Adobe Acrobat Reader DC annotation handling enabling remote code execution with CVSS 7.8.

The Zero Day Initiative published ZDI-26-661 covering a use-after-free vulnerability in Adobe Acrobat Reader DC's annotation feature. Exploitation allows arbitrary code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI rated the flaw CVSS 7.8 and assigned CVE-2026-81985.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 19 sources CVE-2026-81985

Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware

Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.

Cybercriminals are pushing fake Grand Theft Auto VI downloads through poisoned search results, gaming forums, torrent sites, and social media, targeting players seeking a leaked build before release. Huntress analyzed a sample bundling NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware in one package; fake ISO files exceed 100GB largely with junk data, and Russian-language prompts suggest the operators target Russian-speaking gamers. Chaos ransomware acts as a wiper, overwriting files larger than 200MB with random data, deleting shadow copies for admin users, and disabling recovery options rather than offering genuine ransom payment paths.

Cyber Security NewsSep 10, 14:23 UTC · 6d agoMalware in the wild 3 sources

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabzupdated Sep 11, 09:12 UTC · 5d agofirst Sep 10, 14:43 UTC · 6d agoMalware in the wild 3 sources

ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75863) in Adobe Photoshop DCM file parsing.

The Zero Day Initiative published advisory ZDI-26-678 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75863 with a CVSS 7.8 score. The flaw occurs while parsing DCM files. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 3 sources CVE-2026-75863

Grand Theft Auto VI hype leads to malware

Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.

Huntress analyzed a malicious ISO masquerading as a leaked Grand Theft Auto VI build; there is no official GTA6 demo or leaked playable copy. The fake gta6installer.exe shows a Russian 'license' message asking victims to email the attacker if the crack fails, then drops GTA6-branded files into %TEMP%. It installs multiple repurposed NJRAT copies (2023-era files) connecting to AWS-hosted IPs 35.157.111.131, 3.68.56.232, 3.67.15.169 and an ngrok tunnel, plus DCRAT communicating with a0700877.xsph.ru (141.8.197.42). The bundle also includes an infostealer and ransomware used as a wiper, in what appears to be an opportunistic, everything-at-once campaign.

HuntressSep 9, 14:00 UTC · 7d agoMalware in the wild

Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.

Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.

GBHackersSep 10, 12:00 UTC · 6d agoResearch in the wild 2 sources2

Silver Fox Targets Japanese Manufacturer with 3

Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.

Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.

The Hacker NewsAug 27, 10:50 UTC · 20d agoThreat actor in the wild

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security News12:23 UTC · 9h agoPhishing & fraud in the wild 2 sources

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business NewsAug 17, 05:03 UTC · Aug 17, 2026Policy & legal2

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker NewsAug 28, 08:05 UTC · 19d agoThreat actor in the wildCVE-2026-194781

Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware

Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.

Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.

Security AffairsAug 16, 17:17 UTC · Aug 16, 2026Threat actor

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Infoblox reports Sable Squirrel spent nearly $7 million on expired domains to redirect traffic to illegal sports streaming, gambling, and malware infrastructure.

Infoblox tracked 50,400 dropcatch domains re-registered daily in gTLDs during H1 2026, nearly 20% of all registrations, with .net and .xyz leading. The threat actor Sable Squirrel has acquired more than 10,000 expired domains supporting Asian sports piracy brands such as Xoilac, Cakhia, 90phut, Socolive, and MiTom while promoting betting services like VSBet, ColaScore, and 8xbet. The operation, assessed as Vietnam-based and overlapping the dismantled Xoi Lac TV streaming network, targets users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia via a traffic distribution system, publishes Android apps through suspected compromised Google Play developer accounts, and deployed over 31,000 malware samples including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT.

The Hacker NewsSep 8, 06:20 UTC · 8d agoThreat actor in the wild1

ValleyRAT masquerading as adware

Kaspersky reports threat actors distributing the ValleyRAT backdoor disguised as adware, tracing the infection chain to the final payload.

Kaspersky researchers analyzed a campaign distributing the ValleyRAT backdoor under the guise of adware. The write-up documents the complete infection chain, from the malicious installer through deployment of the final backdoor payload. ValleyRAT is a remote access tool typically used by criminal actors for surveillance and data theft.

Kaspersky SecurelistAug 31, 10:00 UTC · 16d agoMalware in the wild

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.

Broadcom's Symantec and Carbon Black documented Backdoor.Turn, a Go-based RAT associated with the DragonForce ransomware group, deployed at a major U.S. services firm where attackers remained on the network for one to two months. The backdoor obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay for connection setup, and runs a QUIC session to the attacker's C2 server, so defenders see only outbound traffic to legitimate Teams servers. Initial access is suspected to involve exploiting a SQL/MS-SQL vulnerability or an access broker, followed by a PowerShell-dropped ZIP, DLL side-loading, and BYOVD evasion using a Huawei driver; the RAT is injected into DbgView64.exe after DragonForce ransomware deployment for continued access. First publicly documented TURN abuse by the group, it leverages Praetorian's Ghost Calls technique and supports command execution, network scanning, LDAP/AD search, lateral movement, and browser credential theft.

The Hacker NewsAug 18, 12:13 UTC · 29d agoMalware CVE-2023-52271 CVE-2025-61155 CVE-2025-10551

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 BlogSep 4, 12:00 UTC · 12d agoThreat actor in the wild1

ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool

Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.

Kaspersky found a malicious installer abusing a modified version of the legitimate QN Wallpaper adware application to deliver the ValleyRAT backdoor via DLL sideloading of libcef.dll. The installer masquerades as DingTalk, Chrome or Tencent Meeting software, creates persistence, disables Windows Defender via the DisableAntiSpyware registry key, and loads AES-encrypted payloads. ValleyRAT collects keystrokes, clipboard contents and screenshots plus system details, can download additional modules, and resists removal by injecting into svchost.exe or marking its process critical. The campaign was detected over 100,000 times in 2026, affecting more than 1,500 users mainly in China and India, and is attributed to Silver Fox with both espionage and financial motives.

Security AffairsAug 31, 19:45 UTC · 16d agoMalware in the wild