VulnCheck found a backdoor in Zbtlink routers. Chinese router maker Zbtlink then replied the code in its firmware is "solely intended for after-sales maintenance." Its download page has since pulled the affected firmware over "firmware security vulnerabilities." 👀 VulnCheck's Jacob Baines says 20+ Zbtlink models ship with a root-level implant that phones home to a hardcoded C2 with no authentication, anyone on the network path can hijack it. Stay vigilant. These routers are sold as ZBT, ZBTWiFi and Wiflyer on Amazon and Alibaba.

Kaspersky has uncovered a backdoor embedded in the official Windows installer of Daemon Tools, a widely used disc imaging application. Security researchers believe Chinese-speaking hackers carried out a supply chain attack that began on April 8, compromising thousands of systems. The attack primarily targeted organizations in retail, scientific, manufacturing, and government sectors in Russia, Belarus, and Thailand. The backdoor remains active, allowing deployment of additional malware. Disc Soft, the developer of Daemon Tools, has confirmed it is aware of the report and is investigating with high priority. Users who installed recent versions of the software are advised to monitor antivirus alerts and assess their risk.

🚨 Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension Following @Will42W’s warning about TRAE IDE extension supply chain risks, SlowMist investigated the malicious extension juannegro.solidity. Although removed from Open VSX, the extension was still available through the TRAE marketplace as of July 18, 2026. It impersonated a legitimate Solidity plugin and acted as a cross-platform malware dropper. Our analysis found that it: 🔹 Impersonates a legitimate Solidity extension and uses the marketplace as the initial malware delivery channel 🔹 Automatically executes after IDE startup and establishes persistence across platforms 🔹 Uses an Ethereum smart contract to store and retrieve dynamic C2 configurations 🔹 Allows attackers to update C2 endpoints and payload delivery without republishing the extension This incident highlights how extension marketplaces can become initial infection vectors, while blockchain infrastructure can be abused for dynamic C2 management. Users who installed juannegro.solidity should remove the extension and check their systems for potential compromise. Full analysis👇