Great Scott, I’m tired
Summary: Cisco Talos reported a new PlugX malware variant targeting telecom and manufacturing sectors in Central and South Asia since 2022, abusing legitimate software and sharing technical fingerprints with the RainyDay and Turian backdoors. The newsletter also notes Microsoft's July 17 global fix for an Entra ID flaw that allowed Global Admin impersonation, a U.S. Secret Service operation against a telecommunications threat network in the New York tristate area, and a ransomware attack on Collins Aerospace that disrupted European airports.
What you should know: Talos attributes the PlugX campaign to the same or closely linked attackers behind RainyDay and Turian, and warns the malware can lurk undetected for years - a persistence timeline that outlasts most detection and response cycles.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026