The Toy Ghouls backdoor hides C2 traffic in HiveMQ MQTT and Element messenger. See how the Bearlyfy group's custom malware works.

Related Posts:

• US Offers $10M for IRGC Cyber Leader
• Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules
• AWS Password Spraying Campaign Targets Root Accounts

The post Toy Ghouls Backdoor Uses HiveMQ and Element for C2 appeared first on Daily CyberSecurity.

VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.

Related Posts:

• Critical MongoDB Security Vulnerabilities Require Immediate Patching
• CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
• D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login

The post ZBT Router Backdoor: VulnCheck Sinkholes SPEAKINGSTONE and DARKLANTERN Implants appeared first on Daily CyberSecurity.

Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.

Related Posts:

• WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns
• Manic Android Malware Steals Data Without Active Internet
• Android Head Unit Malware Recruits Vehicles into Botnet

The post C2Looper: Rust Backdoor Uses GitHub for C2 Control appeared first on Daily CyberSecurity.

Seqrite links Operation QUICSILVER to a China-nexus actor deploying the QUICAgent Go backdoor against Myanmar government targets via a VHD lure.

Related Posts:

• Cisco Talos Exposes UAT-10147 Agentic AI Attacks
• Operation ASTERIX: Crypto Scam Used AI and Fake Wallets
• arrayref Rust Crate Hijacked in Supply Chain Attack With DPRK Infrastructure Overlap

The post Operation QUICSILVER Targets Myanmar Government With Go Backdoor appeared first on Daily CyberSecurity.

GEEKOM's official site served backdoored AMD mini PC drivers since December 2024 via a compromised legacy support page still indexed by Google.

Related Posts:

• Abyssos Modular RAT: Zscaler ThreatLabz Analysis
• Aeternum Blockchain Botnet Hides C2 Commands in Polygon Smart Contracts
• DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

The post GEEKOM Mini PC Driver Downloads Found Bundled With Backdoor Since 2024 appeared first on Daily CyberSecurity.

A Head Mare TrueConf attack chains two zero-days to install the PhantomCore backdoor via a trojanized client.

Related Posts:

• DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers
• UNC6671 Vishing Extortion Rebrands Across 5 Brands
• Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks

The post Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor appeared first on Daily CyberSecurity.

CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.

Related Posts:

• Metabase SQL Injection Zero-Day (CVSS 10) Exploited
• Multiple ClamAV Flaws Let Remote Attackers Cause DoS
• CryptoJS Randomness Vulnerability Drains Crypto Wallets

The post CVE-2026-66747: Zbtlink Router Backdoor ENDLESSDOORS Enables Unauthenticated Remote Code Execution as Root appeared first on Daily CyberSecurity.