#Windows #RDP lets you log in using revoked passwords. #Microsoft is OK with that.

Researchers say the behavior amounts to a persistent #backdoor.

In response, Microsoft said the behavior is a “a design decision (...) As such, Microsoft said the behavior doesn’t meet the definition of a #security #vulnerability, and company engineers have no plans to change it.

https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Pulse ID: 6813da43537c3d86e6ba3ca2
Pulse Link: https://otx.alienvault.com/pulse/6813da43537c3d86e6ba3ca2
Pulse Author: AlienVault
Created: 2025-05-01 20:32:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Chinese snoops use stealth RAT to #backdoor US orgs – still active last week

"Let the #espionage and access resale campaigns begin (again)"
https://www.theregister.com/2025/04/15/chinese_spies_backdoored_us_orgs/

#Telegram founder and CEO Pavel Durov has taken a page out of #Signal book and says he'll pull the app out of France if officials demand an encryption #backdoor
https://t.me/durov/410 (on Telegram)

Sophisticated backdoor mimicking secure networking software updates

A sophisticated backdoor targeting Russian organizations in government, finance, and industrial sectors has been discovered. The malware masquerades as updates for ViPNet, a secure networking software suite. It is distributed via LZH archives containing legitimate and malicious files. The backdoor exploits a path substitution technique to execute a malicious loader, which then decrypts and loads a versatile payload capable of connecting to a C2 server, stealing files, and launching additional malicious components. The complexity of this attack highlights the need for multi-layered security measures to protect against advanced persistent threats.

Pulse ID: 6807bc7e44edbbe6afa50132
Pulse Link: https://otx.alienvault.com/pulse/6807bc7e44edbbe6afa50132
Pulse Author: AlienVault
Created: 2025-04-22 15:57:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. #DataBreache #backdoor #Cybersecurity https://www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/

#Florida’s New Social Media Bill Says The Quiet Part Out Loud And Demands An Encryption #Backdoor - https://www.techdirt.com/2025/04/17/floridas-new-social-media-bill-says-the-quiet-part-out-loud-and-demands-an-encryption-backdoor/

New version of MysterySnail RAT and lightweight MysteryMonoSnail backdoor

A new version of the MysterySnail RAT, attributed to the Chinese-speaking IronHusky APT group, has been detected targeting government organizations in Mongolia and Russia. The malware, which hadn't been publicly reported since 2021, now features a modular architecture with five additional DLL modules for command execution. A lightweight version dubbed MysteryMonoSnail was also observed. The infection chain involves a malicious MMC script, an intermediary backdoor, and the main MysterySnail RAT payload. The attackers use public file storage and the piping-server project for command and control. This case highlights the importance of maintaining vigilance against seemingly obsolete malware families, as they may continue operating undetected for extended periods.

Pulse ID: 6800fcd0995e011520970651
Pulse Link: https://otx.alienvault.com/pulse/6800fcd0995e011520970651
Pulse Author: AlienVault
Created: 2025-04-17 13:06:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

BPFDoor Malware Uses BPF to Evade Detection and Control Linux Servers

BPFDoor is a stealthy, advanced backdoor malware that targets Linux systems by
abusing a powerful technology known as BPF (Berkeley Packet Filter). BPF is
normally used in cybersecurity tools for monitoring and filtering network traffic
efficiently, especially in cloud, telecom, finance, and container based
environments. It's also used by tools like Cilium, Falco, and Tracee for visibility
and threat detection. However, when used maliciously, BPF gives attackers the
ability to bypass firewalls and hide inside systems, making BPFDoor very hard
to detect.

Pulse ID: 67ff166c04a6a92ca5ef55f5
Pulse Link: https://otx.alienvault.com/pulse/67ff166c04a6a92ca5ef55f5
Pulse Author: cryptocti
Created: 2025-04-16 02:31:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

https://cyberinsider.com/global-coalition-warns-sweden-against-encryption-backdoor-legislation/

#Florida’s New #SocialMedia Bill Says the Quiet Part Out Loud and Demands an #Encryption #Backdoor

https://www.eff.org/deeplinks/2025/04/floridas-new-social-media-bill-says-quiet-part-out-loud-and-demands-encryption

#privacy #chatcontrol #backdoor #hackers #cybercrime

GEC vraagt Zweeds parlement tegen encryptie-backdoor te stemmen https://www.security.nl/posting/883467/GEC+vraagt+Zweeds+parlement+tegen+encryptie-backdoor+te+stemmen?channel=rss

Sweden wants to #backdoor #encryption. But we, together with 230+ orgs, are saying no.

#NoToBackdoors

Read our open letter to the Swedish Riksdag:

https://tuta.com/blog/open-letter-sweden-encryption

#UK’s demand for #Apple #backdoor should not be heard in secret, says court

https://techcrunch.com/2025/04/07/uk-demand-for-apple-backdoor-should-not-be-heard-in-secret-says-court/

Brasil precisa urgentemente regulamentar a entrada de robôs domésticos e criar uma equipe especial para INSPECIONAR esses dispositivos em busca de backdoors ocultos de fábrica, que não são informados pelos fabricantes.

Esses robôs irão habitar várias casas daqui a alguns anos e, caso venham com backdoor não-divulgado, poderão ser controlados em massa por atores mal-intencionados, que podem usar os robôs para atacarem pessoas, casas, edifícios, veículos, postes de luz, além de provocar intencionalmente acidentes e incêndios, enfim, causar a maior destruição dentro do país.

Robô com backdoor oculto pelo fabricante é como infiltrar inimigos no país e, depois de um tempo, ordenar esses inimigos a destruirem o país por dentro. É algo extremamente grave, uma questão séria de soberania nacional!