ThreatVectr
Tag

#backdoor

21 stories taggedbackdoor.

Illustration: a cluster of small consumer networking devices, routers and cameras with blinking LED lights
Threat Intelligence

ClingSTUN: The Linux Backdoor Hiding in Your Router's Traffic

A newly tracked malware strain is quietly turning home routers, security cameras, and smart-office hardware into a criminal relay network, and it uses the internet's own plumbing to avoid detection.

4 min read
Illustration: a dim government office at night in an East Asian capital
Threat Intelligence

China-Linked Spies Hide Inside Outlook and OneDrive to Steal Asian Government Secrets

A newly documented backdoor called Antino is sitting on at least 16 government networks across eight Asian countries, and it talks to its handlers through legitimate Microsoft 365 traffic.

3 min read
A timeline visualization from mid-August to early September showing two vulnerability chains being exploited, unpatched server icons turning red as backdoors ar
Vulnerabilities

Hackers Chain Two JFrog Artifactory Bugs to Plant Backdoors on Unpatched Servers

Wiz tracked the attacks from August 15 to September 8. Both flaws were already fixed. Servers that skipped the update paid the price.

3 min read
A network visualization showing interconnected IoT devices across Asia and South America on a world map, with hidden backdoor pathways glowing in the mesh, mess
Threat Intelligence

New BambooToken Malware Hides Its Orders Inside IoT Messaging Traffic

Researchers at Lumen's Black Lotus Labs say the backdoor has quietly infected around a dozen firms across Asia and South America since 2023, using a chat protocol built for smart devices to stay hidden.

4 min read
A HAProxy load balancer interface showing network traffic monitoring, with malicious code injected into the build logs visible in the background terminal
Threat Intelligence

'Ted' Backdoor Found Baked Into HAProxy Builds at Two South Korean Firms

A never-before-seen Linux implant was compiled straight into the load balancers, letting attackers read web traffic and swap pages for chosen visitors.

4 min read
A computer terminal displaying encrypted command-line output and network packet traces, with shadowy server rack infrastructure visible in the background sugges
Threat Intelligence

Iran's Nimbus Manticore Adds New Backdoor and SSH Tunneler to Spy Kit

Group-IB says the IRGC-linked hackers have quietly built out fresh infrastructure and custom malware for espionage campaigns in 2026.

3 min read
A research lab workspace with malware analysis software displayed across multiple monitors, showing binary code and detection signatures, with a small portion o
Threat Intelligence

AI Malware Is Real. It Is Also Mostly Hype.

Palo Alto Networks studied 405 malware samples linked to AI tools. Only 12 ever reached a real computer, and existing defences caught every single one.

4 min read
Formal graduation invitation cards arranged on a surface, with subtle digital artifacts or code elements emerging from the edges of the cards
Threat Intelligence

Fake Graduation Invites Hide China-Linked Spy Tool in Myanmar

Researchers at Seqrite Labs say Operation QUICSILVER is using booby-trapped invitations to plant a new Go-based backdoor called QUICAgent on government and IT networks.

3 min read
A darkened control room with multiple screens displaying network infrastructure and maps of South Asia, with indicators highlighting telecommunications faciliti
Threat Intelligence

Pakistan's Transparent Tribe Is Spying on Afghan Telecom Workers With Fresh Malware

A Pakistani hacking group has been quietly breaking into government and telecom targets in Afghanistan using two newly documented tools. India was in their sights too, but appears to have held the line.

4 min read
A smartphone displaying a software installation dialog box for a telecom application, with network infrastructure silhouettes visible through a window behind it
Threat Intelligence

PATCHCORD: The Fake VPN Installer Hitting Afghan Phone Networks and Indian Infrastructure

A new backdoor is being smuggled onto computers through fake Afghan Telecom software, and researchers say critical services in South Asia are in the crosshairs.

3 min read
A laptop screen showing a software installation dialog box with a progress bar, while code streams down in the background and a subtle warning icon glows in the
Vulnerabilities

Russian hacktivists hijack TrueConf video servers to push booby-trapped installers

Kaspersky says the Head Mare group exploited two unpatched flaws in TrueConf conferencing servers to swap the real client installer for one carrying the PhantomCore backdoor.

4 min read
Network hardware warehouse or manufacturing facility with rows of Zbtlink routers, factory equipment and assembly lines visible, with server racks and network m
Threat Intelligence

Twenty Chinese Router Models Ship From The Factory With A Hidden Backdoor

Researchers at VulnCheck say every current Zbtlink firmware image contains an implant that phones home to Chinese servers and hands attackers root access.

4 min read
A Windows system tray showing a VPN application icon with hidden backdoor processes running in the background, network traffic being redirected to unknown serve
Threat Intelligence

Trojanised QuickFox VPN installer plants stealth backdoor on users' PCs

Fortinet researchers say a tampered version of the China-focused VPN app has been serving the FDMTP backdoor since at least August 2025, with tradecraft that overlaps activity tracked as Silver Fox.

3 min read
Illustration: a dimly lit government office at night
Threat Intelligence

Brazilian Government Sites Turned Into Malware Traps in PhantomEnigma Campaign

Attackers quietly took over more than 20 official .gov.br domains and used them to push a stealthy backdoor, according to new analysis from ANY.RUN.

3 min read
Illustration: Close-up, editorial news photograph
Threat Intelligence

Microsoft Exposes GigaWiper, a New Malware That Spies on Victims Before Destroying Them

A newly discovered backdoor called GigaWiper quietly watches infected computers for months, then wipes or encrypts everything on command, with no way to recover the data.

3 min read
© 2026 Threat Vectr