Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog – Page 30

Threat actors deploying the Black Basta and CACTUS ransomware families have been found to rely on the same BackConnect (BC) module for maintaining persistent control over infected hosts, a sign that affiliates previously associated with Black Basta may have transitioned to CACTUS.

“Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine,” Trend Micro said in a Monday analysis. “This enables them to steal sensitive data, such as login credentials, financial information, and personal files.”

It’s worth noting that details of the BC module, which the cybersecurity company is tracking as QBACKCONNECT owing to overlaps with the QakBot loader, was first documented in late January 2025 by both Walmart’s Cyber Intelligence team and Sophos, the latter of which has designated the cluster the name STAC5777.

Read more | >

A previously undocumented polyglot malware is being deployed in attacks against aviation, satellite communication, and critical transportation organizations in the United Arab Emirates.

The malware delivers a backdoor called Sosano, which establishes persistence on the infected devices and allows the attackers to execute commands remotely.

The activity was discovered by Proofpoint in October 2024, which states that the attacks are linked to a threat actor named ‘UNK_CraftyCamel.’ While the campaign is still small, the researchers report that it is still advanced and dangerous to targeted companies.

Read more | >

A new botnet malware named ‘Eleven11bot’ has infected over 86,000 IoT devices, primarily security cameras and network video recorders (NVRs), to conduct DDoS attacks.

The botnet, which is loosely linked to Iran, has already launched distributed denial of service (DDoS) attacks targeting telecommunication service providers and online gaming servers.

Eleven11bot was discovered by Nokia researchers who shared the details with the threat monitoring platform GreyNoise.

Read more | >

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.

In January, Zscaler discovered a Zloader malware sample that contained what appeared to be a new DNS tunneling feature. Further research by Walmart indicated that Zloader was dropping a new proxy malware called BackConnect that contained code references to the Qbot (QakBot) malware.

BackConnect is malware that acts as a proxy tool for remote access to compromised servers. BackConnect allows cybercriminals to tunnel traffic, obfuscate their activities, and escalate attacks within a victim’s environment without being detected.

Read more | >

Link:

The picture was taken by the James Webb Space Telescope and shows a star being born in the protoplanetary system Herbig-Haro 30.

Now due to the vastness of space, we aren’t *actually* looking at the exact moment the star was born, but rather, how this cosmic creation would have looked like when it happened thousands, if not millions of years ago.

It’s basically a whole lot of timey-wimey stuff over deep space.

Continue reading “NASA telescope takes mind-blowing photo of the exact moment a star is born” | >