Storm-2603 used SharePoint ToolShell flaws for a fileless backdoor
Kaspersky says the group hit an on-premises server on December 24 and its product blocked Warlock before encryption.
1
Stories per day · 30 days
2 RSS
Relatedbackdoor1fedex1fortijump1fortimanager1fortios1peerstitch1phishing1process-hollowing1sharepoint1sirius1storm-26031telecom1toolshell1unc58201velociraptor1warlock1
7 stories, newest first · one card per story
Stories tagged #fileless
Sirius backdoor variant delivered by Korean FedEx-themed PDF emails
Trellix says a weaponized PDF launches fileless loaders that inject Sirius into suspended Windows processes after the victim approves a prompt.
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
9
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
4
AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection
Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.
6
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.