A newly discovered Golang-based backdoor malware uses Telegram for command-and-control operations. Targeting Windows systems and suspected to be of Russian origin, it executes from C:\Windows\Temp\svchost.exe and features commands for PowerShell execution, persistence, self-destruction, an...
A newly identified threat actor, Silent Lynx, targets organizations in Kyrgyzstan and Turkmenistan, focusing on government embassies, banks, and economic institutions. The group employs sophisticated multi-stage attacks using spear-phishing, malicious binaries, and Telegram bots for comman...
A malicious update was detected in the Python package "aiocpa" (a Crypto Pay API client) on the Python Package Index (PyPI), leading to its quarantine. The package, which had accumulated 12,100 downloads since September 2024, was discovered by Phylum to contain malicious code designed to s...
