backdoor3 articles
Three Hacker Groups Are Quietly Carving Up Russian Enterprise Networks
Three distinct threat groups – NightEagle, Hacking Cat, and Toy Ghouls – have been identified by Kaspersky as actively targeting Russian enterprises using a range of malicious tools including backdoors, ransomware, and wipers. NightEagle exploits VPN credentials and Active Directory vulnerabilities to deploy the GhostContainer backdoor, while pro-Ukrainian hacktivist group Hacking Cat leverages Exchange server vulnerabilities to deliver the Gorilla RAT and multiple variants of Monkey ransomware, some of which function as wipers. Toy Ghouls, a financially motivated group, has evolved from using leaked ransomware builders to deploying a custom "Bird Agent" backdoor that uses unconventional C2 channels, including an MQTT broker and the Matrix-based Element messenger, to evade detection.
Chinese Router Maker Says Its Firmware Backdoor Is Fine, Actually, Then Quietly Pulls Firmware
Chinese router vendor Zbtlink has denied that its firmware contains backdoors, claiming a suspicious remote-control feature found by security firm VulnCheck was intended solely for after-sales maintenance on sample units. However, the company simultaneously paused firmware downloads and acknowledged unspecified security vulnerabilities, contradicting its denial. VulnCheck's CTO described the code as a persistent, boot-loaded implant across more than 20 router models that phones home to external servers with no authentication, allowing anyone controlling those endpoints to issue commands to affected devices.
Zbtlink Routers Shipped With Built-In Backdoor Handing Out Root Shells to Anyone Listening
Cybersecurity researchers at VulnCheck have discovered a factory-installed backdoor, dubbed ENDLESSDOORS, embedded in firmware across at least 20 Zbtlink router models, which automatically beacons to Chinese command-and-control servers and can grant attackers an unauthenticated interactive root shell. The implant, based on an obscure open-source tool called rctl, requires no authentication and can be hijacked by anyone able to intercept or control the C2 domain resolution. Zbtlink has taken down the affected firmware and claims the feature was intended solely for after-sales technical support, but has suspended sales of the impacted models while working on patched firmware.