Etumbot Detection, more prior coverage
Summary: Arbor Networks published details on a backdoor it named Etumbot, including technical functionality and hashes of known samples. Cisco Talos ran those hashed samples through its sandbox, captured the resulting pcap files, and replayed them against the Sourcefire NGIPS/Snort ruleset, where six rules fired, including alerts for outbound connections tied to Win.Backdoor.Demtranc and DNS requests to known malware domains cht.strangled.net and finance.yesplusno.com.
Why it matters: The VRT rules that caught this sample date back to 2012, so the detection here rests on signatures already in place rather than anything new - a reminder that the value of a ruleset depends on whether it is deployed and tuned where the traffic actually flows.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026