Sophisticated backdoor re-emerges as a RAT more than a decade after its 2004 public release, with updated advanced malicious functionality.
A sophisticated remote access Trojan (RAT) dubbed Hacker Door by researchers has appeared in active attacks and sharing many similarities to a backdoor of the same name that was released in 2004 and last updated in 2005. The new Hacker Door has updated and advanced functionality, report researchers at Cylance.
Hacker Door contains a backdoor and rootkit components. It engages in a set of typical remote commands once active, Cylance researchers say, including grabbing screenshots and files, running other processes and commands, opening Telnet and RDP servers, and stealing Windows credentials during current sessions.
Some of its functionality includes using a signed stolen certificate to evade detection by security software designed to search for unsigned code, notes a ZDNet report. Cylance researchers note Hacker Door is largely undocumented malware and has seldom been seen in the wild.
Hacker Door appears to be used by Winnti, a Chinese advanced persistent threat group, notes Cylance. And Winnti appears to be targeting the aerospace industry, the researchers discovered.
Read more about Hacker Door here.
About the Author(s)
You May Also Like
Unleash the Power of Gen AI for Application Development, Securely
March 19, 2024The Anatomy of a Ransomware Attack, Revealed
March 20, 2024How To Optimize and Accelerate Cybersecurity Initiatives for Your Business
March 26, 2024Building a Modern Endpoint Strategy for 2024 and Beyond
March 27, 2024Building a Modern Endpoint Strategy for 2024 and Beyond
March 27, 2024