Search: “dracut”

Ukrainian hacker gets four years in US prison over Conti ransomware attacks

Oleksii Lytvynenko was sentenced to four years in the US for his role in Conti ransomware attacks against 1,000+ victims.

Ukrainian national Oleksii Lytvynenko, 44, was sentenced to four years in a US prison for his role in the Conti ransomware operation, having pleaded guilty in June. He worked as a hacker and developer for Conti, personally targeting at least a dozen companies and building a malware loader, and stolen data from eight US victims and four others overseas was found in his accounts. Between 2020 and 2022, Conti attacked organizations across 47 US states and 31 countries, with the FBI estimating victims paid more than $150 million in ransoms by January 2022. Lytvynenko was arrested in Cork, Ireland in July 2023 and extradited after several years in Irish custody; four other alleged Conti members were charged in a separate September 2023 indictment.

The Record·updated Sep 11, 16:07 UTC · 5d ago·first Sep 11, 12:00 UTC · 5d agoPolicy & legal 7 sources1

USN-8758-1: dracut vulnerability

Ubuntu patches dracut CVE-2026-15816, where a rogue adjacent-network DHCP server can inject root-executed commands during boot-failure handling.

Ubuntu security notice USN-8758-1 fixes CVE-2026-15816 in dracut, where messages written by the die() function to the emergency hook directory are not properly shell-quoted. An attacker on an adjacent network controlling a rogue DHCP server could exploit this to inject commands executing as root during boot-failure handling. Users should apply the patched dracut package.

Ubuntu Security Notices·Sep 14, 20:28 UTC · 1d agoAdvisoryCVE-2026-15816

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Recorded Future reports Russian state-sponsored group BlueDelta deploying the HOOKEDGE backdoor against European defense and diplomatic organizations.

Recorded Future research reports that BlueDelta, a Russian state-sponsored threat group, is using the HOOKEDGE backdoor in campaigns targeting defense and diplomatic organizations across Europe. The disclosure details the group's use of the backdoor in espionage-focused operations against high-value government and military targets.

Recorded Future·Aug 27, 00:00 UTC · 20d agoThreat actor in the wild

New Python-Based Payload MechaFlounder Used by Chafer

Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.

Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.

Palo Alto Unit 42·Aug 17, 13:22 UTC · Aug 17, 2026Threat actor

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security·Aug 31, 00:00 UTC · 16d agoAI safety & security in the wild

Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 credentials and deploy malware

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026Malware1

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 12d agoThreat actor in the wild

Permify: Open-source authorization as a service

Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.

Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.

Help Net Security·Sep 14, 05:30 UTC · 2d agoTools1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.

Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.

Security Affairs·Aug 28, 11:26 UTC · 19d agoThreat actor in the wild1

Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis

Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.

ESET identified a UAC-0099 VBScript used in an early-stage intrusion against a target in Ukraine that hides a safety-triggering comment (a question about building a nuclear weapon) intended to make AI code scanners refuse to continue analysis. The script downloads MATCHBOIL, a loader associated exclusively with UAC-0099, alongside familiar anti-analysis checks for IDA and Wireshark. The technique turns the AI triage process itself into the attack target, risking missed detections or benign misclassification of malicious samples.

Cyber Security News·Sep 11, 14:32 UTC · 5d agoThreat actor in the wild 3 sources

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.

Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.

Security Affairs·Aug 19, 17:37 UTC · 28d agoThreat actor in the wildCVE-2024-39943CVE-2025-31702

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the Rust crate arrayref executed a compile-time backdoor, with infrastructure overlapping recent DPRK supply chain attacks on Mastra and axios.

Wiz researchers report that malicious versions of the arrayref Rust crate ran a backdoor during compilation, compromising developer build pipelines. The campaign's command-and-control infrastructure significantly overlaps with infrastructure used in recent DPRK supply chain attacks, including campaigns against Mastra and axios. Developers using affected crate versions should audit their builds and review dependencies.

Wiz Blog·Aug 20, 15:56 UTC · 27d agoThreat actor in the wild1

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42·Aug 17, 12:35 UTC · Aug 17, 2026VulnerabilityCVE-2024-22278

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.

Lytvynenko, 44, admitted coding a loader for Conti and holding stolen data from eight U.S. and four overseas victims; prosecutors linked his actions to attacks on at least 12 companies. Conti infected more than 1,000 organizations across 47 U.S. states and 31 countries between 2020 and 2022, with victim payouts exceeding $150 million. Arrested in County Cork in July 2023 with Cobalt Strike running and an active Rocket.Chat session over Tor, forensic evidence showed his ransomware activity continued after Conti's 2022 collapse.

Security Affairs·Sep 13, 09:19 UTC · 3d agoPolicy & legal

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz·Aug 10, 15:51 UTC · Aug 10, 2026Malware

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabz·updated Sep 11, 09:12 UTC · 5d ago·first Sep 10, 14:43 UTC · 6d agoMalware in the wild 3 sources

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security·05:30 UTC · 14h agoTools

Leaked Russian Cyber-Operations Training Materials

Leaked Bauman university records reveal a formalized Russian pipeline training GRU cyber personnel, linking a graduate to Sandworm's Military Unit 74455.

Leaked training materials from Bauman university describe a force-generation mechanism feeding graduates into General Staff components, including the GRU and directorates responsible for protected communications, cryptography and information security. A 2024 graduate of Department No. 4, Aleksei Kondrashov, was linked to Military Unit 74455, the GRU unit known as Sandworm, which conducted destructive attacks including the 2017 NotPetya attack. Researchers say the leak shows Russian cyber capability is institutionally sustained through recruitment pipelines beyond the familiar APT28 and Sandworm brand names.

Schneier on Security·Sep 1, 16:29 UTC · 15d agoThreat actor

Bisonal Malware Used in Attacks Against Russia and South Korea

Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.

In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.

Palo Alto Unit 42·Aug 17, 12:55 UTC · Aug 17, 2026Malware in the wild