backdoor
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Researchers have identified 14 malicious npm packages disguised as calendar and streak utilities that deliver a sophisticated Linux backdoor known as RedC2 4.0. These packages, once imported, stealthily execute a Linux implant that communicates with a command-and-control server for post-exploitation activities. The RedC2 framework, marketed as a cross-platform toolkit, features AI-assisted capabilities for orchestrating complex intrusions using natural language commands.
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Cybersecurity researchers have identified a new Go-based loader framework named HollowFrame, which is used in conjunction with a Rust-based backdoor called Matryoshka. The attack chain begins with a spear-phishing email containing a malicious link that, when clicked, leads to the execution of a Windows Shortcut file. This initiates a multi-stage process involving privilege escalation, disabling Microsoft Defender, and downloading further malicious payloads.
China-Linked Daxin Malware Active on Manufacturer's Network Since 2013
Researchers have discovered the China-linked Daxin rootkit and a new Stupig backdoor still active on the network of a Taiwanese subsidiary of a high-tech manufacturer. Evidence suggests the intrusion dates back to 2013, meaning it remained undetected for thirteen years. Daxin, a Windows kernel-mode rootkit, employs advanced techniques to communicate within secured networks and hide its traffic.
Tenda Firmware Vulnerability Allows Unauthenticated Admin Access
A critical backdoor vulnerability has been discovered in Tenda device firmware, identified as CVE-2026-11405. This flaw enables unauthenticated attackers to gain administrative control over affected devices by accessing their web management interface. The vulnerability remains unpatched, posing a significant risk to users.
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.
Hidden backdoor in Tenda router firmware grants admin access
A hidden backdoor has been discovered in multiple versions of Tenda router firmware. The hardcoded authentication backdoor allows unauthorized administrative access to the router web management panel.
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
CERT/CC has identified a hidden backdoor in multiple Tenda router firmware versions. This backdoor allows unauthorized administrative access to the devices' web interfaces.