Plague Linux Backdoor
Researchers have uncovered Plague, a previously undetected Linux backdoor masquerading as a malicious Pluggable Authentication Module (PAM) to enable persistent SSH access and authentication bypass.| blog.polyswarm.io
Verticals Targeted: Not specified Regions Targeted: Not specified Related Families: Snowlight dropper Executive Summary VShell is a sophisticated Go-based backdoor targeting Linux systems through a novel infection chain that weaponizes filenames in RAR archives. This malware, linked to Chinese APT groups, exploits common shell scripting practices to execute malicious Bash payloads, delivering a stealthy, memory-resident backdoor capable of remote control, file operations, and network tunneling.| PolySwarm Main Blog
Verticals Targeted: Financial Regions Targeted: Hong Kong, United Arab Emirates, Lebanon, Malaysia, Jordan Related Families: AsyncRAT, AwesomePuppet, Gh0st RAT Executive Summary GodRAT is a RAT derived from the Gh0st RAT codebase. It was observed targeting financial institutions via malicious .scr and .pif files distributed through Skype. Leveraging steganography and additional plugins like FileManager, GodRAT facilitates credential theft and system exploration.| PolySwarm Main Blog
Verticals Targeted: Not specified Regions Targeted: Not specified Related Families: AHK Bot, Skitnet/Bossnet| PolySwarm Main Blog
Verticals Targeted: Public Sector, Aviation Regions Targeted: Middle East Related Families: None Executive Summary Charon is a new ransomware family employing advanced APT-style techniques, targeting Middle Eastern public sector and aviation organizations with tailored ransom demands. Its sophisticated attack chain, including DLL sideloading and process injection, underscores the growing convergence of ransomware and APT tactics.| PolySwarm Main Blog
Researchers have uncovered Plague, a previously undetected Linux backdoor masquerading as a malicious Pluggable Authentication Module (PAM) to enable persistent SSH access and authentication bypass.| blog.polyswarm.io
Verticals Targeted: Government, Healthcare, Manufacturing, Transportation, Law and Consulting, IT, Agriculture Regions Targeted: Brazil, Japan, Canada, Turkey, South Korea, Taiwan, United States Related Families: Conti Executive Summary Gunra ransomware has debuted a Linux variant that boosts encryption speed and flexibility, signaling a shift toward broader cross-platform attacks following its initial Windows campaigns.| PolySwarm Main Blog
Verticals Targeted: Government Regions Targeted: US Related Families: StealC, RedLine, NetSupport RAT, DeerStealer, HijackLoader, SectopRAT Executive Summary CastleLoader, a versatile malware loader, has infected 469 devices since May 2025, leveraging Cloudflare-themed ClickFix phishing and fake GitHub repositories to deliver information stealers and RATs. Its sophisticated attack chain, high infection rate, and modular design make it a significant threat to organizations, particularly U.S. g...| PolySwarm Main Blog
Verticals Targeted: Government, Defense, NGOs, Think Tanks, Education, Media, Financial, Healthcare Regions Targeted: US, Europe, East Asia, Africa Related Families: Warlock, LockBit Executive Summary Microsoft has disclosed active exploitation of critical vulnerabilities in on-premises SharePoint servers by Chinese threat actors, urging immediate patching and additional mitigations to prevent unauthorized access and data theft.| PolySwarm Main Blog
DCHSpy is an Android surveillanceware linked to Iran’s Static Kitten group, targeting Iranian users with fake VPN and Starlink apps to steal sensitive data amid regional conflict.| blog.polyswarm.io
Verticals Targeted: Not specified Regions Targeted: Not specified Related Families: Campaigns abusing the CaramelAds SDK Executive Summary Konfety, a longstanding mobile malware, has resurfaced with enhanced evasion capabilities, including dynamic code loading and multi-layered obfuscation, to facilitate ad fraud while evading detection on Android devices. This evolution underscores the persistent challenge of concealed malicious logic in mobile applications, demanding advanced scrutiny from ...| PolySwarm Main Blog
A new variant of the macOS.ZuRu malware, first identified in 2021, was discovered, leveraging a trojanized Termius application to deploy a modified Khepri C2 beacon, targeting developers and IT professionals.| blog.polyswarm.io
NimDoor is a sophisticated MacOS malware deployed by North Korea-linked threat actors, likely Stardust Chollima, targeting Web3 and cryptocurrency organizations.| blog.polyswarm.io
Since April 2025, the BERT ransomware group has targeted organizations in healthcare, technology, and event services across Asia, Europe, and the United States, utilizing PowerShell loaders and multi-threaded encryption.| blog.polyswarm.io
Escalating tensions following Israel’s “Operation Rising Lion” and US “Operation Midnight Hammer” can potentially trigger retaliatory cyberattacks, with IRGC-linked groups targeting US and Israeli critical infrastructure.| blog.polyswarm.io
UAT-6382, a Chinese-speaking threat actor, was observed exploiting a zero-day vulnerability (CVE-2025-0994) in Cityworks to deploy sophisticated malware, targeting U.S. local government networks since January 2025.| blog.polyswarm.io
Analyze suspicious files and URLs, at scale, millions of times per day. Get real-time threat intel from a crowdsourced network of security experts and antivirus companies competing to protect you.| blog.polyswarm.io
A critical vulnerability in Langflow, CVE-2025-3248, is under active exploitation to deploy the Flodrix botnet, enabling attackers to compromise systems fully, launch DDoS attacks, and potentially exfiltrate sensitive data.| blog.polyswarm.io
