Netcrook
#Backdoor
Inside the Relay: A Go Backdoor Gives Ransomware Operators a Hidden Path Before Encryption
A custom implant written in Go is notable not for noise, but for control: command execution, SOCKS tunneling, and a cleaner route into internal networks.
Custom Backdoor Turns a Regional Intrusion Into a Critical Systems Problem
A reported campaign in Southeast Asia pairs a China-linked attribution with a new remote access tool, raising the stakes for government and utility networks.
PyPI Poisoning Hits Telegram Bot Builders, and the Backdoor Hides in Plain Sight
A malicious package campaign tied to Telegram bot development shows how a trusted Python repository can become the delivery layer for server-side compromise.
The DLL That Wore a Security Badge: Mistic’s Quiet Path Into Windows
A new Windows backdoor is reportedly hiding behind a Microsoft-style component name, using DLL sideloading and self-cleaning behavior to make incident response harder.
Inside the STOCKSTAY Trail: A .NET Backdoor Built for Quiet Espionage
A reported Turla campaign points to a modular Windows implant that can move through phish-lure delivery, remote access files, and encrypted web-style traffic.
STOCKSTAY and the Quiet Art of Looking Legitimate
A .NET backdoor tied to stealthy WebSocket command traffic and environment-based keying shows how modern malware can hide inside ordinary application behavior.
TinyRCT and the Quiet Takeover of Critical Networks
A reported Southeast Asia espionage campaign spotlights a custom .NET backdoor, and the defensive problem it creates is bigger than any single intrusion.
Turla’s New StockStay Backdoor Shows Espionage Code Still Evolves Under Pressure
Google-linked threat research has surfaced StockStay as a fresh malware line in Turla operations, underscoring how targeted espionage campaigns keep rebuilding their access paths rather than relying on a single implant.
TinyRCT and the Quiet Web-Shell Campaign Hidden in Southeast Asia’s Critical Networks
A Unit 42-tracked intrusion cluster blended open-source tooling with a custom .NET backdoor, raising the stakes for governments and energy operators that depend on exposed web applications.
Inside STOCKSTAY: The Windows Backdoor That Hides Like Ordinary Software
A newly identified .NET implant shows how espionage tooling can borrow the look and feel of normal desktop apps while keeping remote tasking quietly alive.
StockStay and the Silent Shape of Modern Espionage
A reported Turla-linked backdoor aimed at Ukrainian government and military targets shows how state-style intrusion kits now lean on modular design, web-like traffic, and host-specific behavior.
When a Backdoor Learns to Vanish, the Access Broker Gets Harder to Catch
Backdoor.Mistic is a reminder that some intrusions are built not for loud damage, but for quiet resale: in-memory execution, DLL sideloading, and self-deletion can make a foothold far more valuable to criminals than a quick smash-and-grab.
Tiny Implant, Big Shadow: The Tunneling Tradecraft Hitting Southeast Asia’s Energy Sector
A newly identified .NET backdoor and a mix of legitimate remote-access utilities show how modern intrusions can hide inside normal admin traffic.
TinyRCT Turns a Quiet Foothold Into a Theft Machine
A custom .NET backdoor tied to a Southeast Asia intrusion cluster shows how modern espionage now relies on trusted Windows paths, tunneling software, and low-noise exfiltration.
Mistic’s Quiet Footprint: Why a Backdoor Tied to ClickFix Matters More Than the Label
A new malware family is drawing attention not for loud destruction, but for the way it blends social engineering, stealthy persistence, and post-compromise flexibility.
Chrome’s Trust Model Becomes the Attack Surface in a Windows Extension Campaign
A campaign abusing policy-controlled installs and Native Messaging shows how a browser can be turned into a command relay when trusted management features are misused.
Gaslight Malware Shows How AI Can Be Targeted Before the Human Even Reads the Sample
A macOS backdoor described as written in Rust is notable less for brute-force evasion than for trying to confuse AI-assisted malware triage with hostile text embedded inside the sample itself.
The Quiet Trade in Footholds: What ModeloRAT and Mistic Backdoor Reveal About Ransomware Prework
Recent reporting suggests access brokerage may be part of the ransomware pipeline, with ModeloRAT and Mistic Backdoor used to maintain stealthy footholds.
Why a Quiet Backdoor Matters More Than a Loud Ransom Note
Mistic looks less like a headline-grabbing smash-and-grab and more like the kind of foothold that can be traded, reused, or handed off inside the ransomware economy.
When a Browser Add-On Crosses the Line Into Host Control
A malicious Edge extension linked to a Python backdoor shows how native messaging can turn a browser convenience feature into a bridge toward endpoint-level abuse.