60
Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them
60
57
60
57
60
60
60
60
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.
78
60
57
60
57
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
Sophos analyzed a Linux rootkit targeting F5 BIG-IP APM environments, also tracked by ESET as PoisonedRefresh, which hijacks Apache's apr_dso_load module loader to inject a fileless PHP web shell into memory. The implant intercepts __libc_start_main, hides strings with RC4, creates a password-protected local UNIX socket backdoor for interactive Bash access, and persists across BIG-IP upgrade images while modifying SELinux configuration. It is likely a second-stage payload following exploitation of CVE-2025-53521, a critical RCE flaw F5 reclassified from a DoS issue in March. The ShadowServer Foundation tracked 795 F5 BIG-IP APM endpoints exposed online.
76
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.
Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.
74
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.
68
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.
Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.
70
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78