Loading story…
Researchers identified ACBackdoor, a cross-platform malware family targeting both Linux and Windows systems. The backdoor enables arbitrary command execution, binary execution, persistence, host reconnaissance, and malware updates, while both variants communicate with the same HTTPS-based command-and-control infrastructure. Analysis indicated the Linux sample was more sophisticated than the Windows version, suggesting the malware may have been developed for Linux first and later adapted for Windows.
The Windows variant was reportedly distributed through malvertising tied to the Fallout Exploit Kit, which exploited CVE-2018-15982 and CVE-2018-8174 to infect victims. Researchers said the Linux delivery method remained unknown, but both versions used platform-specific persistence and masquerading techniques to evade detection and maintain access on compromised hosts.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Adobe assigned and disclosed CVE-2018-15982 in Flash Player, a vulnerability later exploited by the Fallout Exploit Kit to deliver the Windows variant of ACBackdoor.
Researchers discovered ACBackdoor as a multi-platform backdoor affecting both Linux and Windows, and Intezer researcher Ignacio Sanmillan analyzed its capabilities and cross-platform design. The analysis found the Linux variant was more sophisticated and likely preceded the Windows port.
Attackers used malvertising campaigns with the Fallout Exploit Kit to deliver the Windows variant of ACBackdoor. The kit exploited CVE-2018-15982 and CVE-2018-8174 during infection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Mokes**, a cross-platform desktop backdoor family with Linux and Windows variants, later also linked to an OS X sample. The malware was designed for surveillance and data theft, supporting screenshots, keylogging, audio capture, and exfiltration of collected information. The Linux sample, detected as `Backdoor.Linux.Mokes.a`, was described as a UPX-packed `C++/Qt` implant statically linked with Qt, `xkbcommon`, and `OpenSSL 1.0.2c`, while the Windows samples were tracked as `Backdoor.Win32.Mokes.imv` and `Backdoor.Win32.Mokes.imw`. Both variants used similar persistence and command-and-control logic, indicating a shared code base and operator playbook. On Linux, Mokes established autostart persistence; on Windows, it used `Run` registry keys and added active keylogging, with code also present for webcam capture. The malware beaconed every minute to hardcoded HTTP command-and-control servers and used TCP port `433` with a custom encrypted protocol for commands and data transfer. Researchers also noted that one Windows sample was signed with a trusted certificate chaining to **COMODO RSA Code Signing CA**, a tactic that could help the malware appear legitimate and evade scrutiny.
Aug 14, 2026
The Harvester APT group has deployed a new Linux variant of its **GoGra** backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in **India** and **Afghanistan**, with decoy documents referencing regional subjects such as **Zomato** and **Umrah**. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor. Once installed, the Linux malware uses **Microsoft Graph API** and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through `/bin/bash`, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026