Threat Source newsletter (Feb. 18, 2021)
Summary: Cisco Talos reported that the developers of LodaRAT added Android as a targeted platform, with a new Android variant and an updated Windows version identified in the same campaign, both attributed to the group Talos calls "Kasablanca." The newsletter also described two remote code execution vulnerabilities in the Accusoft ImageGear document-imaging library, which an adversary could exploit through an out-of-bounds write if a target opens a specially crafted file.
What's compelling: LodaRAT's operators have been tied to a campaign targeting Bangladesh, and the same group is now building for Android alongside Windows, widening the set of devices one crew can reach. The ImageGear flaws require only that a user open a crafted file, so any application built on that library inherits the exposure.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026