Sub Seven is back after hiatus
Summary: A July 31, 2009 entry on www.subseven.org announced that development of the SubSeven backdoor had resumed, with mobman - who wrote the first version in 1999 - saying work on a new version 2.2 had begun and would be called 2.3. Cisco Talos downloaded the latest build posted on the site, version 2.1.5, and ClamAV detected its server file as Trojan.SubSeven.215-srv and its client file as Trojan.Spy-50523.
Why it matters: SubSeven's return means a well-known backdoor with a decade of history is being actively revised again, and the source gives no reason for the resumed development - so the motive and the new build's capabilities remain unknown.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026