Skip to content
Threat Feed
Subscribe

Tag

Remote-Access-Trojan

4 briefs RSS
critical advisory

Zbtlink Router Firmware Contains Embedded ENDLESSDOORS Implant

Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.

Router Firmware supply-chain firmware backdoors remote-access-trojan network-security
3t 1c
high advisory

CastleLoader Malware Loader and ClearFake Activity in July 2026

Red Canary reports heightened activity of the CastleLoader malware loader, which uses paste-and-run techniques and legitimate tools to deliver infostealers and RATs, alongside continued prevalence of the ClearFake activity cluster in June 2026.

malware loader infostealer remote-access-trojan paste-and-run drive-by download windows
3r 7t 7i
high advisory

Unpacking 'Cruciferra': Analysis of a Sophisticated Crypter Service

Cruciferra is a sophisticated crypter-as-a-service, written in Mono, actively developed and sold to multiple cybercriminal threat actors who use it to deliver a wide range of remote access trojans and infostealers, employing extensive defense evasion techniques like BYOVD-based EDR tampering, Process Ghosting, and unique cryptographic obfuscation via email-based phishing campaigns.

crypter malware-as-a-service defense-evasion remote-access-trojan infostealer windows
1r 10t 11i
critical advisory

Detection of Malicious Remote Access Tools by Antivirus

This brief details a Sigma rule designed to detect Antivirus alerts flagging various malicious Remote Access Tools (RATs) such as AgentTesla, AsyncRAT, and NanoCore, highlighting the critical need for investigation into the initial infection vector even when the AV blocks the threat.

remote-access-trojan rat antivirus detection malware windows
1r 1t