{"id":42585,"date":"2021-08-25T19:50:13","date_gmt":"2021-08-25T19:50:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/proxylogon-flaw-evil-emails-sql-injections-used-to-open-backdoors-on-windows-boxes\/"},"modified":"2021-08-25T19:50:13","modified_gmt":"2021-08-25T19:50:13","slug":"proxylogon-flaw-evil-emails-sql-injections-used-to-open-backdoors-on-windows-boxes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/proxylogon-flaw-evil-emails-sql-injections-used-to-open-backdoors-on-windows-boxes\/","title":{"rendered":"ProxyLogon flaw, evil emails, SQL injections used to open backdoors on Windows boxes"},"content":{"rendered":"

ESET and TrendMicro have identified a novel and sophisticated backdoor tool that miscreants have slipped onto compromised Windows computers in companies mostly in Asia but also in North America.<\/p>\n

As usual in the infosec world, the pair of security outfits can’t agree on a name for this remote-access module. ESET refers to the malware as SideWalk and to the group responsible as SparklingGoblin; TrendMicro prefers ScrambleCross and calls the threat actor Earth Baku, even as it acknowledges that the miscreants are better known as APT41.<\/p>\n

TrendMicro’s researchers speculate that the design of the malware indicates that at least one member of the group is familiar with the tools and techniques of security red teams while the SideWalk\/ScrambleCross backdoor suggests personnel with deep knowledge of low-level programming and advanced software development.<\/p>\n