Kernel Developer | Security REsearcher | Basketball Fan {Botconf | VirusBulletin | Kaspersky SAS} Speaker Current: @Xlab_qax EX: @360Netlab @Kaspersky AKA 渣兔
Joined December 2014
- Tweets319
- Following390
- Followers1.4K
- Likes570
🚨 #CWPdoor — a deceptively simple stealth #backdoor. The adversary drops a precompiled trojanized #cwpsrv (#Nginx) to replace the original — an uncommon tactic 🤔
No idea how it spreads yet, but CVE-2026-73695 disclosure has people speculating 👀
Happy hunting 🍷 @Xlab_qax
CWPdoor is a passive backdoor targeting Linux Control Web Panel (CWP). It is created by injecting malicious code into the cwpsrv source code and recompiling it, allowing it to masquerade as a legitimate service during normal operation. blog.xlab.qianxin.com/cwpdoo…
🚨XCPE botnet~
Been tracking lw_android_agent since August 20th — man, it's painful.
XLab，简直痛失百万啊~😭😭😭
Google and partners just shut the door on the XCPE botnet, severing criminal access to 10M+ devices. 🛡
Instead of a hacker breaking in, a device maker hid a backdoor in its own TV boxes to sell access to cybercriminals.
Full story: goo.gle/4iwISz8
That’s quite a story‑‑ straight out of a movie.🙀
Słowacki NBÚ znalazł w fotoradarach drogowych NERO R-ONE mechanizmy zdalnego dostępu i zarządzania, które można traktować jako potencjalny „backdoor”. Ich pełna konfiguracja nie jest dostępna użytkownikowi. Wbudowno nieudokumentowany moduł 3G/4G, który po włożeniu karty SIM umożliwiał zdalną łączność z urządzeniem. Kamera miała 12 rosyjskich numerów telefonu, niewidocznych w panelu administracyjnym, z których mogła przyjmować komendy przez SMS i połączenia.
🚨The #AryStinger #Botnet is packing massdns, httpx, fscan, ksubdomain, tlsx, and even tcpdump all in one.🤣
The operators are repurposing old routers into a massive recon + #proxy infrastructure. Stockpiling intel and gearing up for something big?🤔
Happy hunting 🍷@Xlab_qax
More Than 4,000 Legacy Routers Compromised by #AryStinger, Turned into Global Attack Proxies for Hackers
blog.xlab.qianxin.com/arysti…
🚨Finish a interesting #ClickFix case.
Actors were probably thinking, “Why fake a site when I can just hack a real one?”🤣
Still surprised how many big sites delay patching CVE-2026-26980🫨有一句挺应景的中文:"世界就是一个巨大的草台班子"。😅 #GhostCMS
Happy hunting 🍷@Xlab_qax
700+ Ghost CMS sites compromised via CVE-2026-26980 (SQLi → Admin API Key theft) and weaponized for ClickFix attacks. Victims include Harvard, Oxford, Auburn and more. Two threat actors now fighting over the same sites.
blog.xlab.qianxin.com/ghost-…
