Search: “ld_preload”

48 stories

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackers11:16 UTC · 11h agoThreat actor in the wild 3 sources CVE-2026-600041

Fuzzing µCOS protocol stacks, Part 2: Handling multiple requests per test case

Cisco TalosAug 28, 16:00 UTC · Aug 28, 2024Vulnerability in the wild

Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence

Security AffairsMay 9, 13:11 UTC · May 9, 2026Malware

Facefish Backdoor delivers rootkits to Linux x64 systems

Security AffairsMay 30, 09:35 UTC · May 30, 2021Malware

New Pro-Ocean crypto-miner targets Apache ActiveMQ, Oracle WebLogic, and Redis installs

Security AffairsJan 31, 11:27 UTC · Jan 31, 2021Vulnerability CVE-2017-10271 CVE-2016-3088

NginRAT parasite targets Nginx

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Malware

Fuzzing µC/OS protocol stacks, Part 3: TCP/IP server fuzzing, implementing a TAP driver

Cisco TalosAug 28, 16:00 UTC · Aug 28, 2024Tools

OrBit, a new sophisticated Linux malware still undetected

Security AffairsJul 7, 09:34 UTC · Jul 7, 2022Malware

Symbiote, a nearly-impossible-to

Security AffairsJun 17, 23:14 UTC · Jun 17, 2022Malware

TeamTNT Targeting AWS, Alibaba

Cisco TalosApr 21, 12:49 UTC · Apr 21, 2022Malware

HiddenWasp, a sophisticated Linux malware borroes from Mirai and Azazel

Security AffairsMay 31, 11:38 UTC · May 31, 2019Malware

Experts discovered a flaw in GoAhead that affects hundreds of thousands IoT devices

Security AffairsDec 25, 19:16 UTC · Dec 25, 2017Exploit / PoC CVE-2017-17562

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated Sep 11, 14:17 UTC · 4d agofirst Sep 11, 09:07 UTC · 4d agoMalware in the wild 2 sources CVE-2026-46300 CVE-2026-43284 CVE-2026-31431

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner

CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.

CVE-2026-60004 is a critical remote code execution flaw affecting Gitea versions 1.17 through 1.27.0, abused via the diffpatch endpoint to install a Git hook and execute shell commands as the Gitea OS user. Default open registration lets unauthenticated attackers obtain the required repository write access. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 28, 2026 to patch; version 1.27.1 fixes it. A developer reported their HOSTKEY-hosted VPS was exploited to run a miner-like dropper, driving CPU usage above 70% and killing competing processes.

The Hacker NewsAug 26, 07:34 UTC · 20d agoExploit / PoC in the wildCVE-2026-60004

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.