    Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant 0 views Eyal Estrin unread, 10:13 PM (25 minutes ago)    to https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/redc2-ai-powered-linux-implant Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Researchers found trojanized npm packages that pretend to be calendar and streak utilities while secretly deploying RedC2 4.0’s AI-powered Linux implant, RedShell. The campaign uses a simple import to trigger execution and is linked to a broader, evolving C2 framework promoted by the threat actor MarlboroMan via Red Offsec. #RedC2 #RedShell...

Researchers uncover 14 malicious npm packages that secretly install RedC2 4.0, an AI-assisted command-and-control framework designed to maintain stealthy access to Linux servers.

Sicherheitsforscher haben manipulierte npm-Pakete entdeckt, die sich als Kalenderwerkzeuge tarnen, jedoch eine Linux-Hintertür installieren.

Security researchers have uncovered a supply-chain campaign distributing a native Linux implant tied to RedC2, a commercial multi-OS command-and-control (C2) framework marketed on Hack Forums, through...

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Curate Feeds | Make Collections | Customize Email Briefs

Attackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages. Researchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials. #Siemens #S7Series #GitLab #PTCWindchill #RedC2...

TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem. 

TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem.

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Un framework di comando e controllo commerciale integra per la prima volta un agente AI che traduce il linguaggio naturale in comandi post-exploitation. Distribuito tramite 14 pacchetti npm trojanizza...

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Cybersecurity researchers identified 14 trojanized npm packages posing as legitimate calendar and streak utilities, which covertly deploy an AI-powered Linux backdoor named RedC2 4.0. Upon loading, the malicious module extracts a bundled binary, grants it executable permissions, and executes it as a detached background process. The attack targets npm’s package ecosystem, though no specific dates, affected versions, or CVE IDs were disclosed. The RedC2 4.0 implant leverages AI capabilities for command-and-control (C2) operations, though further technical details on its functionality were not provided. The discovery was attributed to Trend Micro’s research team, referenced as TrendAI in the report.

compromised host read more about 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2