Attackers brute-force exposed SQL Servers to deploy XMRig and Gh0st RAT
A Go scanner finds TCP 1433, guesses sa and admin logins, then enables xp_cmdshell to run Windows commands.
1
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #gh0st-rat
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
7
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
“Tick” Group Continues Attacks
Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.