Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Administered by:

Server stats:

241
active users

eupolicy.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#backdoor

6 posts5 participants0 posts today
Public
OTX Bot

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Pulse ID: 6813da43537c3d86e6ba3ca2
Pulse Link: otx.alienvault.com/pulse/6813d
Pulse Author: AlienVault
Created: 2025-05-01 20:32:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#APT10#BackDoor#CandC
Public
OTX Bot

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned APT group, employs Spellbinder, a lateral movement tool for adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows them to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The group targets individuals, gambling companies, and entities in Southeast Asia, UAE, China, and Hong Kong. Their malware chain includes the WizardNet backdoor and utilizes DNS hijacking to deliver malicious updates. Evidence links TheWizards to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), suggesting it may be a digital quartermaster for this APT group. The attackers use sophisticated tools and techniques to evade detection and maintain persistence on compromised systems.

Pulse ID: 68124373bde0da2a4679b021
Pulse Link: otx.alienvault.com/pulse/68124
Pulse Author: AlienVault
Created: 2025-04-30 15:36:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#AdversaryInTheMiddle#Asia#BackDoor
Public
Wietze Brandsma 🏴‍☠️

‘ProtectEU’ security strategy: a step further towards a digital dystopian future edri.org/our-work/protecteu-se
The European Commission presented an internal security strategy that would undermine digital rights and even increase security threats. We unpack what ‘ProtectEU’ means for the EU’s future digital policy, including on encryption, data retention, and border surveillance. #ChatControl #ProtectEU #BackDoor

European Digital Rights (EDRi)‘ProtectEU’ security strategy - European Digital Rights (EDRi)The European Commission presented an internal security strategy that would undermine digital rights and even increase security threats.
Public
#cryptohagen

#Telegram founder and CEO Pavel Durov has taken a page out of #Signal book and says he'll pull the app out of France if officials demand an encryption #backdoor
t.me/durov/410 (on Telegram)

TelegramDu Rove's Channel😲 Last month, France nearly banned encryption. A law requiring messaging apps to implement a backdoor for police access to private messages was passed by the Senate. Luckily, it was shot down by the National Assembly. Yet 3 days ago the Paris Police Prefect advocated for it again. 🤦‍♂️ The members of the National Assembly were wise to reject a law that would have made France the first country in the world to strip its citizens of their right to privacy. Even countries that many Europeans view as lacking in freedoms have never banned encryption. Why? Because it’s technically impossible to guarantee that only the police can access a backdoor. Once introduced, a backdoor can be exploited by other parties — from foreign agents to hackers. As a result, the private messages of all law abiding citizens can get compromised. Aimed at preventing drug trafficking, the law wouldn’t have helped fight crime anyway. Even if mainstream encrypted apps had been weakened by a backdoor, criminals could still communicate securely…
Public
OTX Bot

Sophisticated backdoor mimicking secure networking software updates

A sophisticated backdoor targeting Russian organizations in government, finance, and industrial sectors has been discovered. The malware masquerades as updates for ViPNet, a secure networking software suite. It is distributed via LZH archives containing legitimate and malicious files. The backdoor exploits a path substitution technique to execute a malicious loader, which then decrypts and loads a versatile payload capable of connecting to a C2 server, stealing files, and launching additional malicious components. The complexity of this attack highlights the need for multi-layered security measures to protect against advanced persistent threats.

Pulse ID: 6807bc7e44edbbe6afa50132
Pulse Link: otx.alienvault.com/pulse/6807b
Pulse Author: AlienVault
Created: 2025-04-22 15:57:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#BackDoor#CyberSecurity#Government
Public
OTX Bot

New version of MysterySnail RAT and lightweight MysteryMonoSnail backdoor

A new version of the MysterySnail RAT, attributed to the Chinese-speaking IronHusky APT group, has been detected targeting government organizations in Mongolia and Russia. The malware, which hadn't been publicly reported since 2021, now features a modular architecture with five additional DLL modules for command execution. A lightweight version dubbed MysteryMonoSnail was also observed. The infection chain involves a malicious MMC script, an intermediary backdoor, and the main MysterySnail RAT payload. The attackers use public file storage and the piping-server project for command and control. This case highlights the importance of maintaining vigilance against seemingly obsolete malware families, as they may continue operating undetected for extended periods.

Pulse ID: 6800fcd0995e011520970651
Pulse Link: otx.alienvault.com/pulse/6800f
Pulse Author: AlienVault
Created: 2025-04-17 13:06:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#BackDoor#Chinese#CyberSecurity
Public
Cyclone

ProtectEU threatens End-to-End-Encryption across VPNs, messaging apps, and secure email services.

This is part of a growing global trend where governments push for backdoors under the guise of national security. While aimed at combating crime, these proposals risk eroding digital privacy, weakening cybersecurity, and potentially driving privacy-focused services out of EU jurisdictions altogether.

forum.hashpwn.net/post/562

hashpwn · Infosec NewsEU's "ProtectEU" Plan Threatens End-to-End Encryption Across VPNs, Messaging Apps, and Secure Email Services The EU Commission has launched ProtectEU, a bro...
#ProtectEU#vpn#backdoor
Continued thread
Public
Nonilex

While NPR was unable to recover the code for that project, the name itself suggests that Wick could have been designing a #backdoor, or "Bdoor," to extract files from #NLRB's internal case management system, known as NxGen, acc/to several #cybersecurity experts who reviewed Berulis' conclusions.

…NxGen is an internal system that was designed specifically for the NLRB in-house, acc/to several of the engineers who created the tool….

#criminal#law#Trump
ExploreLive feeds
About