Malware | Breaking Cybersecurity News | The Hacker News

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025. "The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," the Slovakian cybersecurity company said . "It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes." "The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal e...

Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor on Windows, macOS, and Linux machines. The bee-js package is the JavaScript library behind Swarm Desktop and the swarm-cli command-line tool. Swarm Desktop runs a Swarm node on a user's own computer and saves the node's private keys there. Both malicious releases have been taken down, and the project's maintainers released a clean Swarm Desktop update today. Neither step removes a backdoor already installed nor protects a key already sent. No theft of funds had been reported at the time of writing. Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC today and was w...

The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said . "Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands." The campaign is notable for making use of three different infection chains - A Windows Shortcut (LNK) file that abuses the native "ftp.exe" utility to run scripts and create scheduled tasks designed to maintain contact with a command-and-control (C2) server. A VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet, while running an MSI installer in the background to d...

A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed systems. AI is helping some of them move faster, but old mistakes are doing plenty of the work too. Even forgotten settings and small changes made months ago are coming back to cause trouble. There's a lot packed into this week's news, including some strange research findings, fresh attacks, and a few warnings worth taking seriously. Here's the full recap. ⚡ Threat of the Week OpenSSH Flaw Sees Exploitation Attempts — Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set....

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server. The researchers, who named the backdoor cwpdoor , captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs. On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say this indicates that "real victims already exist in the wild." They give no count of infected servers. The backdoor is cwpsrv itself, rebuilt with extra code...