Tagged: Malware

21 October 2026 Security Tor SSH Ebury Linux Malware

Tor Deep Dive Part 1: How Over 300 Tor Exit Relays Were Hijacked to Steal SSH Passwords

In early October 2026, attackers rewrote the exit policy on hundreds of Tor relays and sent SSH traffic to interception servers. What happened, how it was found, what is still unknown, and what to change today.
21 October 2026 Security Tor SSH Ebury Linux Debian Malware

Tor Deep Dive Part 6: Ebury, and How to Check Your Own Debian Hosts for It

Ebury is the SSH backdoor that sat on the hijacked Tor relays. How it hides inside a library sshd already loads, why dpkg -V stays silent, and what ESET's own detection script does and does not catch, tested on Debian 13.
16 October 2026 Fortinet Security CVE FortiManager Malware

PEERSTITCH: What a FortiManager Compromise Leaves Behind After You Patch It

Unit 42 describes a memory-only FortiGate implant, PEERSTITCH, deployed after a FortiManager breach and a CVE-2025-61624 privilege escalation. The patch closes the doors. It does not revoke what was already stolen.
5 September 2026 Linux Security Malware Networking

No CVE Required: The Ted Backdoor Hiding Inside Your Own HAProxy Build

Rapid7 found a Linux implant compiled into HAProxy's own binary. No CVE, no patch, a recompiled build reports the same version string as a clean one. The mechanism, and why file integrity monitoring, not network visibility, is what would catch it.