The ted backdoor is DPRK Linux malware hidden inside HAProxy. It pairs with curlRAT to spy on South Korean media and automotive firms, Rapid7 reports.

Related Posts:

• Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection
• Kimsuky Uses AI Agent Opencode to Create Phishing Decoys
• Passkey Social Engineering Attacks Breach Enterprise Cloud Data

The post Ted Backdoor Hides in HAProxy to Spy on South Korea appeared first on Daily CyberSecurity.

The Toy Ghouls backdoor hides C2 traffic in HiveMQ MQTT and Element messenger. See how the Bearlyfy group's custom malware works.

Related Posts:

• US Offers $10M for IRGC Cyber Leader
• Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules
• AWS Password Spraying Campaign Targets Root Accounts

The post Toy Ghouls Backdoor Uses HiveMQ and Element for C2 appeared first on Daily CyberSecurity.

VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.

Related Posts:

• Critical MongoDB Security Vulnerabilities Require Immediate Patching
• CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
• D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login

The post ZBT Router Backdoor: VulnCheck Sinkholes SPEAKINGSTONE and DARKLANTERN Implants appeared first on Daily CyberSecurity.