New Linux malware uses malicious RAR filenames to drop VShell backdoor via spam surveys, exploiting shell operations & metadata.

Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses

Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses

Chinesische Hacker der Gruppe UNC5174 nutzen SNOWLIGHT und VShell, um Linux-Systeme anzugreifen. Die Kampagne setzt auf Open-Source-Tools zur Kostenreduktion und erschwerten Zuordnung.

Security researchers at Sysdig discover threat actors repurposing legitimate open source security tools for cyberattacks, with Chinese-sponsored UNC5174 group leveraging Linux-based VShell and other tools to evade detection.

Vshell is a Go-based remote administration tool that provides post-compromise capabilities for network pivoting and proxying. While the project is marketed as non-malicious, publicly available…

CVE-2026-1731 is an RCE vulnerability in identity platform BeyondTrust. This flaw allows attackers control of systems without login credentials.

The China-linked threat actor known as UNC5174 has been attributed to a new campaign that leverages a variant of a known malware dubbed SNOWLIGHT and a new open-source tool called VShell to infect Linux systems. "Threat actors are increasingly using open source tools in their arsenals for cost-effectiveness and obfuscation to save money and, in this case, plausibly blend in with the pool of

UNC5174 uses SNOWLIGHT and VShell to target Linux and macOS systems, exploiting Ivanti flaws for remote control.