# backdoor An undocumented means of gaining access to a computer system that poses a security risk. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## China's Salt Typhoon backdoors Latin American orgs with new snooping malware DevFeed: [China's Salt Typhoon backdoors Latin American orgs with new snooping malware]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-17T18:00:17Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [backdoor](), [Malware](), [Cybersecurity](), [infosec]() Tags: [backdoor](), [backdoor-malware](), [china](), [cyber](), [cybersecurity](), [malware](), [salt-typhoon](), [security](), [sparrowocky]() ### AI overview A news report about Salt Typhoon using new snooping backdoors and malware against organizations in Latin America. ### Source excerpt Beware the SparroWocky, my son! The backdoor that bites... ## ESET Researchers Analyze SparroWocky, a New C++ Backdoor Used by FamousSparrow DevFeed: [ESET Researchers Analyze SparroWocky, a New C++ Backdoor Used by FamousSparrow]() Original publisher: [Read original article]() Author: Alexandre Côté Cyr Romain Dumont Published: 2026-09-17T08:50:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Malware](), [apt](), [C++](), [ESET research](), [Windows](), [vulnerability]() Tags: [apt](), [backdoor](), [c-plus-plus](), [eset-research](), [malware](), [sparrowocky](), [vulnerability](), [windows](), [windows-internals]() ### AI overview ESET researchers analyze SparroWocky, a modular C++ backdoor that the China-aligned FamousSparrow group has deployed against organizations in Latin America since at least August 2025. ### Source excerpt ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group ## Laravel Scalpel Scans for Filesystem Intrusion Evidence DevFeed: [Laravel Scalpel Scans for Filesystem Intrusion Evidence]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-09-17T01:38:29Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [Filesystems](), [Security](), [backdoor](), [PHP]() Tags: [backdoor](), [filesystem](), [laravel](), [laravel-packages](), [php](), [security](), [sha-256]() ### AI overview Laravel Scalpel is an intrusion-evidence scanner that runs inside Laravel applications. It checks filesystems for rogue PHP files, obfuscated code, altered server directives, environment issues, and changes from a trusted baseline. ### Source excerpt Laravel Scalpel scans Laravel filesystems for rogue PHP files, obfuscated backdoors, altered directives, environment issues, and file changes. The post Laravel Scalpel Scans for Filesystem Intrusion Evidence appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms DevFeed: [Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms]() Original publisher: [Read original article]() Author: j2sw Published: 2026-09-16T13:32:46Z Content type: article Language: en Sources: [Justin Wilson (j2sw)]() Topics: [MikroTik](), [Vulnerabilities](), [Persistence](), [remote access](), [backdoor](), [ssh]() Tags: [backdoor](), [cybersecurity](), [firmware](), [forensics](), [incident-response](), [mikortrick](), [mikrotik](), [network-operations](), [network-security](), [persistence](), [remote-access](), [security](), [ssh](), [vulnerabilities]() ### AI overview A forensic walkthrough examines a compromised MikroTik router in a honeypot. The intruders established persistence and remote access through scheduled tasks, scripts, new users, and tunnels. The author suspects, but cannot prove, that the compromise involved the MikroTrick RouterOS vulnerability chain. ### Source excerpt What it looks like when an intruder tries to make your own router work against you. A note before we start: Anything in this post that could identify my network, my organization, or my router's real hostname and IP address has been redacted or made generic. The attacker's own infrastructure, such as IP addresses, ports, ... Read more The post A first-hand forensic walkthrough of a real router compromise appeared first on Justin Wilson (j2sw). ## Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure DevFeed: [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure]() Original publisher: [Read original article]() Author: Rem Dudas Published: 2026-09-09T10:00:55Z Content type: article Language: en Sources: [Unit 42]() Topics: [ARKTunnel](), [backdoor]() Tags: [arktunnel](), [backdoor](), [c2](), [cl-cri-1171](), [cybercrime](), [docro-hijacker](), [gaming](), [malware](), [pay-per-install](), [payload](), [remote-access-trojan](), [threat-research](), [youtube]() ### AI overview An investigation of the CL-CRI-1171 cybercrime campaign describes how YouTube gaming lures and SEO poisoning delivered malware through a custom loader. It covers Docro Hijacker, ARKTunnel, and the Insomnia remote access Trojan. ### Source excerpt An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42. ## 'ChainDrop' worm compromises hundreds of popular npm packages DevFeed: ['ChainDrop' worm compromises hundreds of popular npm packages]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Nick Frichette, Sebastian Obregoso, Martin McCloskey Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [backdoor](), [releases]() Tags: [backdoor](), [chaindrop](), [github](), [malware](), [npm-packages]() ### AI overview ChainDrop is an npm worm that spread a backdoor through hundreds of compromised packages. The article analyzes its loader, which downloads or invokes Bun to run a second-stage payload. ### Source excerpt On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware. ## Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor DevFeed: [Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor]() Original publisher: [Read original article]() Author: Sebastian Obregoso, Christophe Tafani-Dereeper, Eslam Salem Published: 2026-07-09T00:00:00Z Content type: news Language: en Sources: [Datadog Security Labs]() Topics: [backdoor](), [SDKs](), [Blockchain](), [Malware](), [Git](), [npm](), [Bitcoin](), [TypeScript](), [servers](), [ci](), [Prettier]() Tags: [backdoor](), [bitcoin](), [blockchain](), [ci](), [code](), [git](), [github](), [http](), [malware](), [server](), [telemetry](), [typescript]() ### AI overview A malicious commit briefly compromised the Injective blockchain's @injectivelabs/sdk-ts npm package by disguising a credential-stealing backdoor as telemetry code. The malware captured wallet mnemonic seed phrases and private keys, encoded them, and exfiltrated them through HTTP requests to a remote endpoint before the code was reverted. ### Source excerpt A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys. ## MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-06-17T21:54:01Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Malware](), [backdoor](), [payload](), [Python](), [Claude](), [Artificial Intelligence]() Tags: [ai](), [backdoor](), [capture](), [claude](), [claude-ai](), [infosec](), [ip](), [malware](), [payload](), [port](), [python](), [reverse-engineering]() ### AI overview The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code. ### Source excerpt By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win ## FishMonger's arsenal upgraded: SprySOCKS for Windows DevFeed: [FishMonger's arsenal upgraded: SprySOCKS for Windows]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-16T08:54:04Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Processes](), [telemetry]() Tags: [analysis](), [apt](), [backdoor](), [china](), [communication](), [drivers](), [eset-research](), [government](), [kernel](), [linux](), [malware](), [process](), [processes](), [telemetry](), [virustotal](), [windows]() ### AI overview ESET reports two previously undocumented Windows variants of the SprySOCKS backdoor attributed to FishMonger. The variants use TCP, UDP, and WebSocket communications; WIN_DRV uses a kernel driver to conceal artifacts and redirect specially crafted TCP traffic. ### Source excerpt ESET researchers have discovered SprySOCKS for Windows, FishMonger's backdoor weaponizing a kernel driver for advanced stealthiness ## OceanLotus: From external espionage to domestic targeting DevFeed: [OceanLotus: From external espionage to domestic targeting]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-11T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [networking]() Tags: [apt](), [attacks](), [backdoor](), [dns](), [eset-research](), [linux](), [supply-chain](), [telemetry]() ### AI overview The article analyzes OceanLotus's shift toward domestic espionage and two SPECTRALVIPER campaigns in Vietnam: a targeted supply-chain compromise of investor software and a prolonged intrusion against a construction corporation. ### Source excerpt A shift in operational pattern of the infamous Vietnam-aligned APT group ## LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine DevFeed: [LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine]() Original publisher: [Read original article]() Author: LABScon Published: 2026-06-02T13:00:58Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [LABScon](), [Malware](), [Threat Research](), [Reverse Engineering](), [Threat Hunting & Intel](), [backdoor]() Tags: [analysis](), [apt](), [attacks](), [backdoor](), [conferences](), [labscon](), [labscon25](), [malware](), [presentation](), [research](), [reverse-engineering]() ### AI overview ESET researchers present technical evidence that Gamaredon facilitated Turla's access to high-value Ukrainian targets between February and June 2025. The presentation examines their operational collaboration, the deployment of Turla's Kazuar backdoor, and the implications for defenders tracking Russian cyberespionage. ### Source excerpt ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## Backdoored node-ipc npm releases steal developer credentials through DNS queries DevFeed: [Backdoored node-ipc npm releases steal developer credentials through DNS queries]() Original publisher: [Read original article]() Author: Nick Frichette Published: 2026-05-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [npm](), [backdoor](), [payload](), [Amazon Route 53](), [Code](), [Cloud](), [Kubernetes](), [Databases](), [OpenSSH]() Tags: [analysis](), [backdoor](), [cloud](), [code](), [database](), [developer](), [dns](), [fork](), [kubernetes](), [malware](), [npm](), [payload](), [process](), [ssh]() ### AI overview This article analyzes three backdoored node-ipc releases published to npm on May 14, 2026. The malicious CommonJS entrypoint launches a detached process, collects environment, host, developer, cloud, package manager, source control, Kubernetes, database, and SSH credentials, archives the data, and attempts DNS TXT exfiltration. ### Source excerpt An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. ## A rigged game: ScarCruft compromises gaming platform in a supply-chain attack DevFeed: [A rigged game: ScarCruft compromises gaming platform in a supply-chain attack]() Original publisher: [Read original article]() Author: Filip Jurčacko Published: 2026-05-05T08:55:27Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Threat Research](), [backdoor](), [LineageOS](), [Windows](), [High Profile Threats](), [C++](), [Shell](), [Python](), [Ruby]() Tags: [analysis](), [android](), [china](), [cloud](), [data](), [eset-research](), [gaming](), [government](), [logging](), [platform](), [supply-chain](), [voice](), [windows]() ### AI overview ESET researchers describe a ScarCruft supply-chain attack that trojanized Windows and Android components of a Yanbian-themed gaming platform. The BirdCall backdoor supports espionage capabilities including collecting data and documents, screenshots, and voice recordings. ### Source excerpt ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games ## Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers DevFeed: [Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-04-27T23:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [data observability](), [GitHub Actions](), [Security](), [supply-chain-security](), [vulnerability](), [backdoor](), [Python](), [data-engineering](), [Cloud](), [ssh]() Tags: [awareness](), [aws](), [backdoor](), [blog](), [data-engineering](), [developer](), [devops](), [devrel](), [docker](), [github-actions](), [kubernetes](), [python](), [security](), [snyk-platform](), [ssh](), [supply-chain](), [supply-chain-security](), [vulnerability]() ### AI overview Attackers compromised the elementary-data Python package's GitHub Actions publication pipeline through script injection and released malicious content that stole cloud credentials and SSH secrets from data engineering environments. ### Source excerpt Attackers exploited a GitHub Actions script injection vulnerability to publish a malicious version of the elementary-data Python CLI (v0.23.3), embedding a credential-stealing backdoor that targeted dbt profiles, cloud provider keys, and SSH secrets from data engineering environments. ## GopherWhisper: A burrow full of malware DevFeed: [GopherWhisper: A burrow full of malware]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-04-23T08:59:18Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Go Language](), [C++]() Tags: [api](), [apt](), [backdoor](), [c-plus-plus](), [china](), [discord](), [eset-research](), [go](), [malware](), [microsoft-365](), [slack]() ### AI overview ESET Research describes GopherWhisper, a China-aligned APT group targeting a Mongolian government entity. Its largely Go-based malware toolset uses backdoors, injectors, loaders, and legitimate services including Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control and exfiltration. ### Source excerpt ESET Research has discovered a new China-aligned APT group that we've named GopherWhisper, which targets Mongolian governmental institutions ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise DevFeed: [Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise]() Original publisher: [Read original article]() Author: Luca Beurer-Kellner; Aleksei Kudrinskii; Marco Milanta; Kristian Bonde Nielsen; Hemang Sarkar; Liran Tal Published: 2026-02-05T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Agent Skills](), [Security](), [supply-chain-security](), [prompt injection](), [AI Agent](), [Credential theft](), [Malware](), [Claude Code](), [cursor](), [OpenClaw](), [API keys](), [backdoor]() Tags: [agent](), [agent-skills](), [ai](), [api-keys](), [awareness](), [backdoor](), [blog](), [credential-theft](), [developer](), [malware](), [prompt-injection](), [security](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk's ToxicSkills audit examined 3,984 AI agent skills and found that 36.82% had at least one security flaw. The research identified malware, credential theft, prompt injection, exposed secrets, backdoors, and data exfiltration affecting users of OpenClaw, Claude Code, and Cursor. ### Source excerpt Snyk's ToxicSkills research reveals 36% of AI agent skills contain security flaws, including 1,467 vulnerable skills and active malicious payloads targeting OpenClaw, Claude Code, and Cursor users. ## Backdoors in VStarcam cameras DevFeed: [Backdoors in VStarcam cameras]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2026-01-07T13:01:48Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Security](), [backdoor](), [passwords](), [P2P](), [Protocol (disambiguation)]() Tags: [backdoor](), [cameras](), [p2p](), [passwords](), [protocol](), [security]() ### AI overview An investigation of VStarcam cameras finds that firmware mechanisms systematically undermine administrator-password protection by leaking passwords and exposing cameras through internet-connected P2P functionality. The article also examines insecure firmware updates delivered over plain HTTP and recommends restricting internet access with a network firewall or using custom firmware. ### Source excerpt VStarcam is an important brand of cameras based on the PPPP protocol. Unlike the LookCam cameras I looked into earlier, these are often being positioned as security cameras. And they in fact do a few things better like... well, like having a mostly working authentication mechanism. In order to access the camera one has to know its administrator password. So much for the theory. When I looked into the firmware of the cameras I discovered a surprising development: over the past years this protection has been systematically undermined. Various mechanisms have been added that leak the access password, and in several cases these cannot be explained as accidents. The overall tendency is clear: for some reason VStarcam really wants to have access to their customer's passwords. A reminder: "P2P" functionality based on the PPPP protocol means that these cameras will always communicate with and be accessible from the internet, even when located on a home network behind NAT. Short of installing a custom firmware this can only addressed by configuring the network firewall to deny internet access. Contents How to recognize affected cameras Downloading the firmware Caveats of this survey VStarcam's authentication approach Endpoint protection Unauthenticated log access Explicit password leaking via logs Log uploading Password-leaking backdoor Establishing a timeline The impact Coordinated disclosure attempt Recommendations How to recognize affected cameras Not every VStarcam camera has "VStarcam" printed on the side. I have seen reports of VStarcam cameras being sold under the brand names Besder, MVPower, AOMG, OUSKI, and there are probably more. Most cameras should be recognizable by the app used to manage them. Any camera managed by one of these apps should be a VStarcam camera: Eye4, EyeCloud, FEC Smart Home, HOTKam, O-KAM Pro, PnPCam, VeePai, VeeRecon, Veesky, VKAM, VsCam, VStarcam Ultra. Downloading the firmware VStarcam cameras have a mechanism to deliver firmware updates (Loo ## LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan DevFeed: [LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan]() Original publisher: [Read original article]() Author: Anton Cherepanov Peter Strýček Published: 2025-12-18T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [.NET](), [enterprise deployment]() Tags: [apt](), [backdoor](), [browser](), [c-sharp](), [china](), [cloud](), [cloud-services](), [eset-research](), [google](), [japan](), [malware](), [microsoft](), [net](), [policy](), [techniques](), [windows]() ### AI overview ESET describes LongNosedGoblin, a China-aligned APT group conducting cyberespionage against governmental entities in Southeast Asia and Japan. The group deploys malware through Group Policy and uses tools including the NosyDoor backdoor and the C#/.NET NosyHistorian application. ### Source excerpt ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions ## MuddyWater: Snakes by the riverbank DevFeed: [MuddyWater: Snakes by the riverbank]() Original publisher: [Read original article]() Author: ESET Research Published: 2025-12-02T10:00:15Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [C++]() Tags: [analysis](), [api](), [apt](), [backdoor](), [c](), [c-c-plus-plus](), [c-plus-plus](), [critical-infrastructure](), [cryptographic](), [eset-research](), [iran](), [malware](), [memory](), [persistence](), [socks5](), [techniques](), [tools](), [windows]() ### AI overview ESET analyzes a MuddyWater campaign targeting organizations in Israel and Egypt that uses custom loaders, credential stealers, reverse tunnels, and the MuddyViper backdoor to evade defenses and maintain access. ### Source excerpt MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook ## Espressif says ESP32 undocumented Bluetooth HCI commands are not a backdoor DevFeed: [Espressif says ESP32 undocumented Bluetooth HCI commands are not a backdoor]() Original publisher: [Read original article]() Author: John Lee Published: 2025-03-10T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Bluetooth](), [Security](), [backdoor]() Tags: [backdoor](), [blog](), [bluetooth](), [esp32](), [hci](), [iot](), [security]() ### AI overview Espressif explains that the reported undocumented ESP32 Bluetooth HCI commands are controller debug commands. It says they do not participate in normal HCI communication with NimBLE or Bluedroid and do not pose a security threat or backdoor. ### Source excerpt Overview# Espressif has already provided a formal response to the recently published claims about ESP32 Bluetooth controller serving as a potential "backdoor" or having "undocumented features" that can cause security concerns. This post highlights the technical details about the relevant commands (HCI Commands) that were undocumented and establishes that the mentioned undocumented HCI commands do not pose a security threat and are certainly not a "backdoor". ## 6 Ways Shadow Access Creates Risk in Your Infrastructure DevFeed: [6 Ways Shadow Access Creates Risk in Your Infrastructure]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-02-28T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security](), [backdoor](), [ssh](), [Databases](), [Kubernetes clusters]() Tags: [backdoor](), [breach](), [compliance](), [credentials](), [infrastructure](), [security](), [ssh]() ### AI overview This article explains shadow access: unauthorized or unmonitored infrastructure and application access created by unmanaged credentials, shared SSH keys, hard-coded API tokens, and undocumented backdoors. It describes the resulting security, breach, and compliance risks and presents Teleport as a way to address their root causes. ### Source excerpt Shadow access is one of the most dangerous threats to your infrastructure. Learn what it is, where it comes from, and how Teleport eliminates its root causes. ## Do not pass GO - Malicious Package Alert DevFeed: [Do not pass GO - Malicious Package Alert]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2025-02-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Go Language](), [backdoor](), [vulnerability]() Tags: [backdoor](), [blog](), [code-security](), [database](), [developer](), [devrel](), [go](), [interest](), [supply-chain](), [supply-chain-security](), [vulnerability]() ### AI overview The article reports that a typosquatted BoltDB Go module contained a backdoor and remained available through Go module caching. It describes the reported impact and the removal of the module from GitHub and the Go module proxy. ### Source excerpt Recently, researchers have found another Software Supply Chain issue in BoltDB, a popular database tool in the Go programming environment. The BoltDB Go Module was found backdoored and contained hidden malicious code. [Next page]()