All news with #persistence tag

🛡️ FortiGuard Labs reports that the long-running cyber-espionage group Confucius has shifted tactics against Microsoft Windows users, moving from document stealers like WooperStealer to Python-based backdoors such as AnonDoor. The change, observed between December 2024 and August 2025, favors persistent access and command execution over simple data exfiltration. Researchers describe layered evasion and persistence techniques including DLL side-loading, obfuscated PowerShell, scheduled tasks and stealthy exfiltration to minimize detection. Targeting remains focused in South Asia, particularly Pakistan.

🔍 Microsoft Threat Intelligence describes a new XCSSET variant that infects Xcode projects and expands capabilities to include clipboard hijacking, Firefox data theft, and additional persistence via LaunchDaemon entries. The actor uses run-only compiled AppleScripts, AES-based encryption, and layered obfuscation to evade analysis. A bnk submodule monitors and can replace wallet addresses in the clipboard while a new Mach-O binary targets Firefox data. Organizations are advised to patch promptly, inspect Xcode project sources, and deploy Microsoft Defender for Endpoint.

🔐 Chinese state-linked actors deployed a custom Linux/BSD backdoor called BRICKSTORM on network edge appliances to maintain persistent access into U.S. legal, technology, SaaS and outsourcing firms. These implants averaged 393 days of undetected dwell time and were used to pivot to VMware vCenter/ESXi hosts, Windows systems, and Microsoft 365 mailboxes. Mandiant and Google TAG attribute the activity to UNC5221 and have released a scanner and hunting guidance to locate affected appliances.

🔒 Proofpoint reported that a China-aligned threat actor tracked as TA415 conducted spear-phishing in July–August 2025, impersonating U.S. policy officials and the U.S.-China Business Council to target government, think tank, and academic personnel focused on trade and economic policy. The messages delivered password-protected archives on public cloud services that contained a Windows shortcut which executed a hidden batch script and an obfuscated Python loader named WhirlCoil while displaying a decoy PDF. The loader establishes a VS Code Remote Tunnel to enable persistent backdoor access, harvests system and user data, exfiltrates it via base64-encoded HTTP posts to free request-logging services, and establishes scheduled tasks (e.g., GoogleUpdate) for persistence.

⚠️ Cybersecurity researchers disclosed a campaign that abuses ConnectWise ScreenConnect remote sessions to deliver a fileless loader which ultimately executes the AsyncRAT remote-access trojan. Attackers use hands-on-keyboard activity to run a layered VBScript and PowerShell chain that loads obfuscated .NET assemblies and spawns AsyncClient.exe. Persistence is maintained via a scheduled task disguised as "Skype Updater," and stolen credentials, keystrokes, and wallet artifacts are exfiltrated to a DuckDNS command-and-control host.

🔒 FortiGuard Labs has uncovered MostereRAT, a Remote Access Trojan targeting Microsoft Windows that uses layered evasion and persistence techniques. Written in Easy Programming Language, the malware deploys a multi-stage chain, uses mutual TLS for C2 communication, and can disable Windows Update and antivirus processes. The campaign, aimed largely at Japanese users, begins with phishing emails that lead to a malicious Word download and installs services running at SYSTEM-level, while deploying remote access tools such as AnyDesk and TightVNC.

🔐 Mandiant observed attackers exploiting a zero‑day ViewState deserialization flaw (CVE-2025-53690) in legacy Sitecore deployments that reused a sample ASP.NET machineKey. Adversaries delivered a WeepSteel reconnaissance backdoor to collect system and network data and disguised exfiltration as normal ViewState traffic. Sitecore advises replacing and encrypting static machineKey values and instituting regular key rotation to mitigate further risk.