In June 2024, Kaspersky discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat.
The samples Kaspersky found almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form of shell scripts from the attackers’ server. The researchers noticed that some versions of the backdoor use local IP addresses to connect to C2, which led us to believe the threat may be targeted. This also points to an intention to exploit the backdoor for lateral movement through the victim’s network.
Read more…
Source: Kaspersky
Related:
- Cyberattack targets French blood banks
November 4, 2026
A cyberattack on several French blood banks sought to raise temperatures to extremely high levels but was thwarted before it could do any damage to blood products or samples, authorities said. The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were ...
- DOJ warns FBI data breach likely extends to Justice Department employees
November 4, 2026
A major data breach of FBI systems likely also affected staffers across the Justice Department, according to a memo obtained by POLITICO. FBI investigators determined in September that a hack of a bureau jobs portal was a “major” cyber incident, allowing hackers to steal personal information on thousands of FBI agents, including Social Security numbers, birth ...
- The most used lateral movement hacking tools across enterprise infrastructures
November 2, 2026
The statistics compiled from detection alerts* within Kaspersky Anti Targeted Attack (KATA) reveal the hacking tools most often used for lateral movement across enterprise infrastructures, highlighting the pressing need for reliable network security solutions to protect corporate environments. Recent investigations into cyber-espionage groups show that attackers increasingly avoid detectable malware, choosing instead to blend into legitimate ...
- AI-driven attacks on educational organizations in Latin America and Africa
November 2, 2026
Kaspersky Threat Research has uncovered attacks on educational organizations in Latin America and Africa in which attackers used artificial intelligence to help direct activity inside compromised networks. Researchers traced reconnaissance, credential theft, movement between computers and data collection, including activity that compromised highly privileged administrator accounts. The attackers used CyberStrikeAI, an open-source penetration-testing framework that combines ...
- Germany says lawmakers’ iPhones may have been hacked with spyware
November 2, 2026
The German government is warning politicians and public figures that they were targeted by government-backed spyware, days after Apple began sending out notifications warning victims that their iPhones may have been hacked. Germany’s federal cybersecurity office, known as the BSI, said in a note over the weekend that it had become aware that members of the ...
- Inside the underground fake review trade
November 2, 2026
Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day. In our latest research, we examined cybercrime forums where sellers advertise illicit ...