The novel Linux implant, Quasar Linux, poses a formidable threat not merely to individual workstations but to the entire software supply chain. This malicious suite targets environments dedicated to the creation, compilation, and dissemination...
The Katana botnet has usurped no fewer than thirty thousand Android-based television set-top boxes, transfiguring these economical apparatuses into a formidable staging ground for distributed denial-of-service (DDoS) bombardments. The vanguard at Nokia Deepfield ERT...
Nidhogg Nidhogg is a multi-functional rootkit for red teams. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for red team engagements that can be integrated with...
Singapore’s preeminent telecommunications providers have fallen prey to a sophisticated cyber espionage campaign orchestrated by the formidable adversarial collective UNC3886. While the intruders successfully infiltrated specific internal architectures, the offensive was decisively neutralized before...
Cyber-espionage attributed to the Chinese group HoneyMyte—also known as Mustang Panda and Bronze President—has reached a new level. Researchers have observed the deployment of an advanced version of the ToneShell malware, concealed by a...
A new commodity has surfaced on underground forums for those seeking to operate more quietly—and for longer. An actor using the alias AlphaGhoul has begun promoting a utility called NtKiller, which, according to its...
Singularity is a powerful Linux Kernel Module (LKM) rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through advanced system call hooking via ftrace infrastructure. What is Singularity? Singularity is a sophisticated rootkit...
Specialists from Group-IB have released an in-depth analysis of the long-running UNC2891 campaign, which demonstrates how inventive modern attack schemes against ATM networks have become. At the center of the operation was a compact...
ELFSPIRIT is a comprehensive static analysis and injection framework designed to parse, manipulate, patch, and camouflage ELF files. With elfspirit, you can explore the intricacies of the ELF format and have the freedom to...
Researchers at Trend Micro have documented a large-scale operation codenamed ZeroDisco, in which attackers weaponized a critical flaw in Cisco’s SNMP implementation (CVE-2025-20352, CVSS 9.0) to implant rootkits and execute arbitrary code on network...