May 2025 - Nextron Systems
Stealth in 100 Lines: Analyzing PAM Backdoors in Linux| www.nextron-systems.com
APT Scanner| Nextron Systems
Stealth in 100 Lines: Analyzing PAM Backdoors in Linux| www.nextron-systems.com
Announcing the Launch of ASGARD Analysis Cockpit v4.3| www.nextron-systems.com
The post Announcing the Launch of ASGARD Analysis Cockpit v4.3 appeared first on Nextron Systems.| Nextron Systems
Many of our customers value the broad module support and high detection coverage found in our professional-grade products. However, we are also committed to continuously improving our free tools, ensuring that the gap in detection capabilities does not grow too wide.| Nextron Systems
YARA Forge Rule Sets Now Available in THOR Cloud and THOR Cloud Lite| www.nextron-systems.com
Free IOC and YARA Scanner - Meet our fast and flexible multi-platform IOC and YARA scanner THOR in a community version named THOR Lite.| www.nextron-systems.com
The post Webhooks in THOR Cloud: Event-Driven Notifications and System Integration appeared first on Nextron Systems.| Nextron Systems
The post AURORA – Leveraging ETW for Advanced Threat Detection appeared first on Nextron Systems.| Nextron Systems
The post Detecting the Most Popular MITRE Persistence Method – Registry Run Keys / Startup Folder appeared first on Nextron Systems.| Nextron Systems
The recently exploited SharePoint vulnerability chain known as ToolShell (CVE-2025-53770) has shown once again that patching alone isn’t enough. Attackers gained unauthenticated remote access to vulnerable on-premises SharePoint servers, planted web shells, and exfiltrated cryptographic keys to enable further exploitation.| Nextron Systems
As part of our ongoing threat hunting efforts, we identified a stealthy Linux backdoor that appears to have gone publicly unnoticed so far. We named it Plague. The implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access.| Nextron Systems
YARA and Sigma Rule Feed| Nextron Systems
THOR as a Web Service| Nextron Systems
We are excited to announce a strategic partnership between Nextron Systems and Threatray AG. This collaboration aims to significantly enhance our existing threat detection capabilities and further improve the precision and sensitivity of our detection signatures. Nextron will leverage Threatray’s advanced Binary Intelligence Platform to refine and extend our detection rules, benefiting both our THOR and Valhalla customers, while Threatray will enhance its own platform by integrating detecti...| Nextron Systems
Discover how digital sovereignty becomes reality in cybersecurity with THOR & ASGARD - Made in Germany, forensic-ready from minute one.| www.nextron-systems.com
The post The Blind Spot Scanner – Why THOR Detects What Others Miss appeared first on Nextron Systems.| Nextron Systems
We’ve released a CLI utility that converts THOR logs into a Timesketch-compatible format. This allows analysts to import and visualize THOR’s forensic findings as timestamped events on a unified timeline, together with data from other sources.| Nextron Systems
Linux PAM backdoor analysis revealing stealthy credential theft. See why AV misses them - and how THOR detects what others overlook.| www.nextron-systems.com
We are pleased to announce a significant enhancement for users of THOR Cloud and THOR Cloud Lite:| Nextron Systems
First detected in September 2024 and initially targeting the United States and Canada, the Nitrogen ransomware group has since expanded its reach into parts of Africa and Europe. Many of their victims remain absent from Nitrogen’s public ransomware blog and likely never will be listed. At the time of writing, ransomware.live reports 21 known victims of Nitrogen. Notably, indicators of this malware family surfaced as early as 2023, suggesting links to other ransomware infections.| Nextron Systems
In recent days, major security companies such as ReliaQuest and Onapsis have disclosed the active exploitation of CVE-2025-31324, a critical vulnerability in SAP NetWeaver’s Visual Composer component. The vulnerability allows unauthenticated attackers to upload arbitrary files, particularly JSP webshells, via the vulnerable developmentserver / metadatauploader endpoint.| Nextron Systems
Nextron Systems officially announces the End of Life (EOL) and End of Support (EOS) for THOR version 10.6, our former stable forensic scanner version. Effective December 31, 2025, THOR 10.6 will no longer receive updates, maintenance, or technical support.| Nextron Systems
Understanding how to detect obfuscated threats is key to defending against stealthy cyber attacks. Learn how THOR uncovers hidden threats.| www.nextron-systems.com
Interested in our services? Contact us for detailed information, personalized assistance, or to schedule a free demo presentation.| www.nextron-systems.com
Incident Response Platform| Nextron Systems
Discover THOR Cloud, a lightweight, easy-to-deploy scanner for on-demand compromise assessments. Scan your systems for hacker activity.| www.nextron-systems.com
Custom File Hashes| Nextron Systems
How to protect your business from Microsoft Exchange vulnerability crisis| www.nextron-systems.com
We just launched THOR-Cloud Lite our new free, lightweight and easy to deploy on-demand compromise assessment scanner. Allowing you to access your scans and reports from everywhere at any time. Licensing, scan campaigns and reports everything is conveniently managed in the new web-based user interface.| Nextron Systems
Since the launch of THOR Cloud Lite in September, our team has been dedicated to developing a more powerful version of THOR Cloud that incorporates the full scanner with its extensive suite of forensic modules and expansive detection signature database. Today, we are excited to announce the general availability of THOR Cloud, which offers a streamlined method for conducting automated compromise assessments on your endpoints.| Nextron Systems
We’re excited to announce a significant update to THOR, our comprehensive digital forensic scanner, which now extends multi-threading capabilities to both the standard version and THOR Lite. Previously exclusive to our forensic lab license holders, this enhancement allows users across all versions to leverage multiple CPU cores to expedite their scans.| Nextron Systems
