BellaCiao is a .NET-based malware family that adds a unique twist to an intrusion, combining the stealthy persistence of a webshell with the power to establish covert tunnels. It surfaced for the first time in late April 2023 and has since been publicly attributed to the APT actor Charming Kitten.
One important aspect of the BellaCiao samples is how they exhibit a wealth of information through their respective PDB paths, including a versioning scheme we were able to work out once we analyzed historical records. Recently, Kaspersky researchers were investigating an intrusion that involved a BellaCiao sample (MD5 14f6c034af7322156e62a6c961106a8c) on a computer in Asia. The telemetry indicated another suspicious, and possibly related, sample on the same machine. After further investigation of the sample, it turned out to be a reimplementation of an older BellaCiao version, but written in C++.
Read more…
Source: Kaspersky
Related:
- Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session
November 9, 2026
Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and ...
- 13.3 million people’s medical data exposed; companies pay $300,000
November 9, 2026
The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures. Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than ...
- Nvidia stock falls 5% as scrutiny turns to Jensen Huang’s affair with alleged Chinese spy
November 9, 2026
Nvidia stock fell 5% on Monday after the tech giant launched an investigation into CEO Jensen Huang’s relationship with a businesswoman who intelligence agencies say is a Chinese spy. U.S. intelligence agencies said Alice Huang, an executive at cloud company MegaSpeed, has been passing information to Beijing, according to reports in The New York Times and ...
- Iris Ohyama attack exposes info of 7.7 million customers
November 9, 2026
Major Japanese consumer goods manufacturer Iris Ohyama has confirmed suffering a cyberattack which saw it lose data on 7.7 million people. The company first disclosed the breach on October 29, 2026 when it confirmed “unauthorized access on the e-commerce site” Iris Plaza. At the time, the company said its investigation was ongoing, and that it would ...
- Hundreds of Artex AI hacking tools found publicly exposed to the web
November 6, 2026
Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses, and it’s been ...
- FBI agent steals $2.47 million in crypto tied to 35 investigations and plans Portugal escape
November 6, 2026
A former FBI agent stole $2.47 million in crypto using classified investigative records, compromising federal investigations into criminal organizations and foreign adversaries. The US Department of Justice disclosed on Nov. 5 that Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering after exploiting his access to crypto wallet credentials collected during FBI investigations. His ...