hackspace
162 subscribers
283 photos
82 videos
25 files
1.03K links
hackspace
Download Telegram
😁2
😏
Fox-IT (NCC Group) details RemotePE, a North-Korean Lazarus in-memory RAT delivered through a three-stage chain — DPAPILoader (environmentally-keyed first-stage), RemotePELoader (HellsGate / ETW-patched HTTP beacon) and RemotePE itself, which never touches disk. The writeup walks AES-GCM C2, MSZIP-compressed command batches, the IConsole / IFileExplorer / IProcess command surface, infrastructure, MITRE ATT&CK mapping, and a full IOC set spanning July 2023 — May 2026.


https://core-jmp.org/2026/05/remotepe-lazarus-in-memory-rat-dpapi-loader-chain/
Chinese Backdoor for Telecom Systems

A while ago we showed the backdoor that the Chinese have been using to maintain persistence across telecom systems.

The backdoor attaches itself to a raw network socket and inspects incoming traffic. It sees packets before firewall rules have a chance to process them. So even if your firewall is configured correctly, the backdoor can still see traffic that should have been blocked.

To access the system hackers send a magic byte to get a reverse shell


https://hackers-arise.com/compromising-telecom-systems-deploying-and-detecting-the-bpfdoor-backdoor/