Threat Source Newsletter (Dec. 9, 2021)
Summary: Cisco Talos reported a malicious campaign using fake installers of popular software to deliver two undocumented malware families, a backdoor and a Google Chrome extension, in attacks that began in late 2018 and mainly targeted Canada along with the U.S., Australia and some EU countries. Talos attributed the families to an unknown actor using the alias "Magnat," whose apparent motivation is financial gain from selling stolen credentials, fraudulent transactions and Remote Desktop access, and separately noted Zoho's warning that attackers are actively exploiting CVE-2021-44515 in Desktop Central and Desktop Central MSP to bypass authentication and execute arbitrary code.
What's compelling: An actor tracked as "Magnat" has been refining the same backdoor-and-browser-extension pair since late 2018, and the payoff is your stolen credentials and Remote Desktop access sold on. Zoho's CVE-2021-44515 is being exploited in the wild to bypass authentication on ManageEngine Desktop Central servers, so unpatched instances are an open door.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-44515
- Related
- CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026