NewApp Digest
search bot

operators

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
Blizzard sues to kill another World of Warcraft private server for 'large scale, egregious, and ongoing infringement of [its] intellectual property'
AppWizard
June 14, 2026

Blizzard sues to kill another World of Warcraft private server for ‘large scale, egregious, and ongoing infringement of [its] intellectual property’

Blizzard Entertainment has filed a lawsuit against Project Ascension, a private World of Warcraft server, claiming it operates a substantial business model based on significant infringement of Blizzard's intellectual property. Project Ascension reportedly attracts over a million players and allows in-game item purchases through Donation Points, generating millions for its operators. The server is allegedly hosted on "bulletproof" servers linked to the Russia-based Aeza Group, which has been targeted by the U.S. Department of the Treasury for cybercrime. The Turtle WoW server previously faced similar legal action from Blizzard, and there has been no public response from Project Ascension regarding the lawsuit. Community sentiment appears to be one of resignation towards the situation.
Hackers Use Fake Windows Update Installers to Deliver OnyxC2 Credential Stealer
Winsage
June 12, 2026

Hackers Use Fake Windows Update Installers to Deliver OnyxC2 Credential Stealer

OnyxC2 is a sophisticated credential stealer available for a subscription fee of 0 per month, distributed through disguised lures such as fake Windows updates and legitimate software installers. It functions as a commercial product with features like an automated payload builder, tiered licensing, and a centralized web dashboard. The malware boasts a 99% detection-evasion rate, successfully evading major antivirus solutions during tests. It is developed in C++, utilizing direct system calls and mutating with each build to avoid detection. OnyxC2 collects data from around 210 applications, targeting 45 web browsers, password managers, cryptocurrency wallets, and FTP clients. The malware is delivered using DLL sideloading, where a password-protected archive contains a legitimate application and a malicious DLL. The attacker's DLL is disguised by inflating its size and is loaded by a trusted binary. The malicious code remains encrypted on disk and decrypts in memory to evade analysis. OnyxC2 communicates with a Cloudflare-fronted command-and-control server to manage infected hosts and execute commands like hardware registration and cookie uploads. The threat extends to business environments, targeting FTP and email clients, with stolen session cookies allowing ongoing access to corporate infrastructure. Implementing anti-data exfiltration controls is recommended as a mitigation strategy.
Microsoft Open-Sources PostgreSQL Extension for In-Database Durable Execution
Tech Optimizer
June 10, 2026

Microsoft Open-Sources PostgreSQL Extension for In-Database Durable Execution

Microsoft has introduced pg_durable, a PostgreSQL extension that enables developers to execute durable workflows within the database, reducing the need for external orchestration systems. It simplifies workflow management by allowing developers to express long-running, fault-tolerant SQL functions directly in SQL, managing execution concerns like retries and recovery. Workflows are defined in SQL, with the extension handling retry states, progress tracking, and checkpointing. A pg_durable function operates as a graph of SQL steps that can resume from the last durable checkpoint after a failure. The extension preserves execution states within PostgreSQL tables, ensuring workflows can withstand crashes and restarts. It includes a domain-specific language (DSL) for scheduling and parallel execution. An example of a durable function is provided, demonstrating sequential and parallel execution using specific operators. pg_durable is particularly useful for vector embedding pipelines and scheduled maintenance tasks. Architecturally, it consists of a PostgreSQL extension and a background worker built on Rust libraries, without any external control plane. Durable execution allows long-running workflows to automatically resume from failure points, simplifying distributed system architecture.
This New Computer Virus Is Disguising Itself As A Popular Video Game
AppWizard
June 9, 2026

This New Computer Virus Is Disguising Itself As A Popular Video Game

Old-school gaming consoles are seeing a resurgence, but hackers are exploiting this trend with a malware campaign called "WeedHack," which emerged in January. This malware operates on a "Malware-as-a-Service" model, allowing users to purchase it to infect victims. WeedHack functions as a remote access infostealer, compromising computers to manipulate screens, access webcams, and steal sensitive data. It propagates by enticing users with unofficial "Minecraft" mods and clients, often using videos and download links as bait. Additionally, it employs "SEO poisoning" to promote fake websites as legitimate sources for these mods on platforms like Discord and Reddit. WeedHack disguises itself as a JAR file, similar to the official "Minecraft" client, and once executed, it installs its payload from Ethereum server domains. It can insert itself into antivirus exclusion lists, evading detection, and McAfee's tests show that Windows Defender is ineffective against it. The malware collects extensive information, including Wi-Fi networks and browser cookies, and grants hackers complete control over infected computers. The WeedHack virus serves as both malware and a training ground for aspiring hackers, structured into two tiers: a free version with core capabilities and a paid subscription for advanced features. A community has formed around WeedHack, offering tutorials, a Discord server, and a website for feature requests and custom payload creation. This community aspect lowers the barrier for newcomers, particularly targeting a younger audience that may not understand online safety.
‘Tactical radio action’ game Burn-9 announced for PC
AppWizard
June 7, 2026

‘Tactical radio action’ game Burn-9 announced for PC

14 Hours Productions is developing a political spy thriller game titled Burn-9, set to launch for PC on Steam, GOG, and the Humble Store in 2026. Players take on the role of an unseen operator assisting the last survivor of a black-ops team in a chaotic mission. A demo is currently available. The game involves navigating espionage and making pivotal choices based on gathered intelligence while using advanced surveillance systems. Players can disable security measures and extract sensitive information, facing moral complexities and ethical dilemmas throughout the mission.
Search