Cybersecurity articles tagged #Backdoor on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installershttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installersThe Head Mare hacktivist group breached TrueConf video conferencing servers to distribute backdoored client installers, compromising user systems.Sat, 08 Aug 2026 16:22:32 GMTTrueConfHead MareSupply Chain AttackBackdoorMalwarehttps://runtimerebel.com/blog/critical-backdoors-supply-chain-attacks-zbtlink-routers-quickfox-vpn-compromisedhttps://runtimerebel.com/blog/critical-backdoors-supply-chain-attacks-zbtlink-routers-quickfox-vpn-compromisedUrgent warning: Zbtlink routers ship with unauthenticated root backdoors, while QuickFox VPN delivers FDMTP implant via supply chain compromise.Fri, 07 Aug 2026 16:43:45 GMTSupply Chain AttackBackdoorRCEZbtlinkQuickFox VPNhttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorshttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorsOngoing cyberattacks by a suspected Chinese-speaking threat actor target Central Asian governments with OctLurk and SilkLurk backdoors for espionage and data theft.Sat, 01 Aug 2026 02:54:42 GMTChinese Speaking HackersOctLurkSilLurkCentral AsiaGovernment TargetsEspionageBackdoorhttps://runtimerebel.com/blog/gigawiper-modular-implant-combines-backdoor-wiper-functionshttps://runtimerebel.com/blog/gigawiper-modular-implant-combines-backdoor-wiper-functionsAnalysis of GigaWiper, a modular implant allowing threat actors to combine backdoor and wiper functionality for customizable destructive attacks and maximum impact.Mon, 13 Jul 2026 18:00:25 GMTGigaWiperWiper MalwareBackdoorModular MalwareDestructive Attackshttps://runtimerebel.com/blog/roundcube-flaw-exploited-by-china-linked-group-against-academicshttps://runtimerebel.com/blog/roundcube-flaw-exploited-by-china-linked-group-against-academicsA China-linked threat cluster is actively exploiting a Roundcube webmail vulnerability to steal credentials and deploy backdoors at U.S./Canadian universities.Wed, 08 Jul 2026 21:35:37 GMTRoundcubeAcademic SectorCredential TheftBackdoorChina LinkedEspionageUniversitieshttps://runtimerebel.com/blog/new-leash-backdoors-target-soho-routers-china-linked-apt-updatehttps://runtimerebel.com/blog/new-leash-backdoors-target-soho-routers-china-linked-apt-updateA China-linked APT group has expanded its toolkit with new 'Leash' backdoors (LongLeash, DogLeash, JarLeash), targeting SOHO routers for persistent access and command…Wed, 08 Jul 2026 17:40:14 GMTChina Linked APTSOHO RoutersLONGLEASHDogLeashJarLeashBackdoorLapDogs Campaignhttps://runtimerebel.com/blog/cve-2026-11405-tenda-router-firmware-admin-backdoor-exposedhttps://runtimerebel.com/blog/cve-2026-11405-tenda-router-firmware-admin-backdoor-exposedCERT/CC warns of an undocumented admin backdoor, CVE-2026-11405, in Tenda router firmware, enabling full administrative access bypass. Immediate action advised.Tue, 07 Jul 2026 11:09:22 GMTCVE-2026-11405TendaRouterFirmwareAuthentication BypassBackdoorCERT CChttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorhttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorA China-linked APT group has compromised ten organizations, including state-owned entities in Southeast Asia, deploying a new backdoor.Wed, 01 Jul 2026 05:41:17 GMTChina Linked APTSoutheast AsiaCritical InfrastructureBackdoorState SponsoredEspionageCyber Warfarehttps://runtimerebel.com/blog/shapedplugin-supply-chain-attack-wordpress-pro-plugins-backdooredhttps://runtimerebel.com/blog/shapedplugin-supply-chain-attack-wordpress-pro-plugins-backdooredAttackers compromised ShapedPlugin's distribution pipeline to inject backdoors into Pro WordPress plugins. Learn how to detect and remediate this supply chain threat.Tue, 23 Jun 2026 00:57:15 GMTShapedPluginWordPressSupply Chain AttackBackdoorWordfencehttps://runtimerebel.com/blog/cryptobandits-malware-tor-abusing-backdoor-data-thefthttps://runtimerebel.com/blog/cryptobandits-malware-tor-abusing-backdoor-data-theftCryptoBandits malware functions as a backdoor, leveraging Tor and a SOCKS5 proxy for stealthy data theft and remote code execution capabilities.Fri, 19 Jun 2026 16:55:32 GMTCryptoBanditsBackdoorTorSOCKS5 ProxyData TheftRemote Code Executionhttps://runtimerebel.com/blog/outdated-redcap-servers-targeted-by-china-linked-unc6508https://runtimerebel.com/blog/outdated-redcap-servers-targeted-by-china-linked-unc6508A majority of internet-accessible REDCap servers remain unpatched, making them prime targets for initial access and backdoor deployment by China-linked UNC6508.Thu, 18 Jun 2026 17:10:13 GMTREDCapUNC6508Outdated SoftwareHealthcareInitial AccessBackdoorhttps://runtimerebel.com/blog/shub-reaper-stealer-backdoors-macos-via-spoofed-appshttps://runtimerebel.com/blog/shub-reaper-stealer-backdoors-macos-via-spoofed-appsSHub Reaper stealer targets macOS, using fake Google, Microsoft, Apple, WeChat, and Miro installers for Apple script-based execution and backdooring.Tue, 19 May 2026 20:42:42 GMTSHub ReapermacOSStealerBackdoorPhishingAppleScripthttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorhttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorA new SHub macOS infostealer variant employs fake Apple security update prompts via AppleScript to install a backdoor, threatening user data and system integrity.Tue, 19 May 2026 00:57:05 GMTSHubmacOSInfostealerAppleScriptBackdoorPhishinghttps://runtimerebel.com/blog/malicious-node-ipc-versions-compromise-developer-secrets-via-supply-chainhttps://runtimerebel.com/blog/malicious-node-ipc-versions-compromise-developer-secrets-via-supply-chainThree versions of the node-ipc npm package (9.1.6, 9.2.3, 12.0.1) contain stealer/backdoor functionality targeting developer secrets. Urgent update advised.Thu, 14 May 2026 20:36:23 GMTNode IpcNPMSupply Chain AttackDeveloper SecretsBackdoorStealerhttps://runtimerebel.com/blog/stealthy-quasar-linux-qlnx-malware-targets-developershttps://runtimerebel.com/blog/stealthy-quasar-linux-qlnx-malware-targets-developersNew Quasar Linux (QLNX) malware is infecting developers' Linux systems, utilizing rootkit, backdoor, and credential-stealing techniques. Learn to detect and mitigate.Wed, 06 May 2026 00:46:50 GMTQuasar LinuxQLNXLinux MalwareRootkitBackdoorSoftware DevelopersCredential Thefthttps://runtimerebel.com/blog/silver-fox-apt-tax-themed-phishing-delivers-abcdoor-to-india-russiahttps://runtimerebel.com/blog/silver-fox-apt-tax-themed-phishing-delivers-abcdoor-to-india-russiaChina-backed Silver Fox APT targets organizations in India and Russia with over 1,600 tax-themed phishing messages to deploy ABCDoor backdoor and ValleyRAT.Mon, 04 May 2026 16:46:54 GMTSilver FoxABCSDoorValleyRATPhishingIndiaRussiaAPTBackdoorTax Themed Attackshttps://runtimerebel.com/blog/wordpress-quick-page-post-redirect-backdoor-arbitrary-code-injectionhttps://runtimerebel.com/blog/wordpress-quick-page-post-redirect-backdoor-arbitrary-code-injectionA dormant backdoor in the Quick Page/Post Redirect WordPress plugin allowed arbitrary code injection for five years on over 70,000 sites. Learn mitigation.Thu, 30 Apr 2026 00:51:16 GMTWordPressQuick Page Post RedirectBackdoorCode InjectionSupply ChainPlugin Vulnerabilityhttps://runtimerebel.com/blog/unc6692-targets-microsoft-teams-to-deploy-snow-malwarehttps://runtimerebel.com/blog/unc6692-targets-microsoft-teams-to-deploy-snow-malwareUNC6692 is leveraging Microsoft Teams and social engineering to deliver the modular Snow malware suite, facilitating long-term persistence and data theft.Sat, 25 Apr 2026 16:17:06 GMTUNC6692Microsoft TeamsSNOW MalwareSocial EngineeringBackdoorPersistencehttps://runtimerebel.com/blog/firestarter-backdoor-infects-cisco-firewall-at-us-federal-agencyhttps://runtimerebel.com/blog/firestarter-backdoor-infects-cisco-firewall-at-us-federal-agencyAnalysis of the Firestarter backdoor on Cisco firewalls, detailing its remote access capabilities, post-patch persistence, and mitigation strategies.Fri, 24 Apr 2026 12:34:34 GMTFIRESTARTERCisco FirewallBackdoorFederal AgencyPersistenceRemote Accesshttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallhttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallCISA and NCSC warn of FIRESTARTER, an APT-deployed backdoor maintaining persistence on Cisco Firepower and Secure Firewall devices post-patching.Thu, 23 Apr 2026 16:44:19 GMTFIRESTARTERCisco FirepowerCisco Secure FirewallCisco ASABackdoorAPTCVE-2025-20333CVE-2025-20362LINE VIPERPersistencehttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestinghttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestingChina-linked APT41 is targeting AWS, Azure, and Google Cloud with a new zero-detection backdoor designed to harvest credentials and maintain persistence.Mon, 13 Apr 2026 16:35:11 GMTAPT41Cloud SecurityCredential HarvestingAWSAzureBackdoorhttps://runtimerebel.com/blog/smart-slider-3-pro-3-5-1-35-backdoor-via-supply-chain-attackhttps://runtimerebel.com/blog/smart-slider-3-pro-3-5-1-35-backdoor-via-supply-chain-attackNextend's Smart Slider 3 Pro version 3.5.1.35 was compromised via a supply chain attack. Learn how to identify and remediate the backdoor today.Fri, 10 Apr 2026 08:37:51 GMTSmart Slider 3 ProWordPress SecurityNextendBackdoorSupply Chain Attackhttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcoshttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcosChinese APT Red Menshen utilizes an upgraded BPFdoor backdoor to target global telecommunication companies, bypassing traditional defenses.Fri, 27 Mar 2026 20:16:14 GMTRed MenshenBPFdoorAPTTelecommunicationsChinaBackdoorEspionagehttps://runtimerebel.com/blog/fake-next-js-job-interview-tests-backdoor-developershttps://runtimerebel.com/blog/fake-next-js-job-interview-tests-backdoor-developersMicrosoft Defender discovered a campaign where malicious Next.js job interview tests backdoor developers' devices, posing a supply chain risk.Thu, 26 Feb 2026 00:33:15 GMTNext JsSoftware DevelopersSupply Chain AttackMalwareBackdoorSocial EngineeringJob ScamsMicrosoft Defenderhttps://runtimerebel.com/blog/supply-chain-attack-npmhttps://runtimerebel.com/blog/supply-chain-attack-npmA typosquatted npm package mimicking a popular React utility has been downloaded over 47,000 times before removal.Thu, 25 Jan 2024 00:00:00 GMTNPMSupply ChainTyposquattingJavaScriptBackdoor