Unknown
Security researchers have identified a Linux rootkit targeting F5 BIG-IP APM devices. The malware intercepts PHP file loading to inject a fileless web shell directly into memory, avoiding disk writes and traditional security controls. The origin and active exploitation status of the rootkit remain unconfirmed.
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open repository containing attack tools. The group is reported to use AI to scale server attacks, deploy the SPECTRE exploit with an EDR bypass mechanism, and install a Linux rootkit for persistent access.