Search: “WinUpdate”

9 stories

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker NewsSep 6, 08:34 UTC · 9d agoMalware in the wild

Threat Round Up for Nov 10

Cisco TalosNov 17, 16:07 UTC · Nov 17, 2017Ransomware

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Kaspersky SecurelistNov 28, 07:00 UTC · Nov 28, 2025Malware1

GravityRAT: The spy returns

Kaspersky SecurelistOct 19, 10:00 UTC · Oct 19, 2020Malware

Frankenstein campaign: threat actors put together open

Security AffairsJun 8, 18:23 UTC · Jun 8, 2019Threat actor CVE-2017-11882

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 8d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Search: “WinUpdate”

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Threat Round Up for Nov 10

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

GravityRAT: The spy returns

Frankenstein campaign: threat actors put together open

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Microsoft Exposes Evasive Chinese Tarrask Malware Attacking Windows Computers

China-linked Hafnium APT leverages Tarrask malware to gain persistence

Threat Roundup for August 23 to August 30