New Linux Backdoor "PamDOORa" Exploits PAM to Steal SSH Credentials Security researchers from Group-IB’s DFIR team have identified a novel Linux backdoor technique, dubbed PamDOORa, that abuses Pluggable Authentication Modules (PAM) to harvest SSH credentials and maintain stealthy persistence on compromised systems. PAM, a modular authentication framework introduced in Linux in 1991, allows administrators to customize authentication workflows for applications like sshd, login, and su. While its flexibility enhances security, it also creates attack surfaces when misconfigured. The pam_exec module, designed to execute external commands during authentication, is being weaponized in this campaign. In the PamDOORa attack, threat actors modify PAM configuration files (e.g., `/etc/pam.d/sshd`) to inject a malicious script that triggers during SSH login attempts. The script captures usernames, timestamps, and environment variables (e.g., `PAM_USER`, `PAM_RHOST`) and exfiltrates them to a remote command-and-control (C2) server via tools like netcat (nc). The attack leverages the optional control flag in PAM, ensuring the malicious execution does not disrupt authentication or raise alarms even if login attempts fail. A key concern is its stealth: PAM’s internal handling of authentication means the credential theft leaves minimal traces in system logs, complicating detection. Traditional monitoring may only flag failed logins, masking the underlying data exfiltration. The technique underscores how legitimate Linux features can be repurposed for covert attacks. Organizations running Linux servers particularly those exposed to external networks are advised to audit PAM configurations, monitor unauthorized changes, and enforce stricter logging and execution controls. The discovery highlights the risks of trusted frameworks when misconfigured, as Linux’s dominance in enterprise and cloud environments makes it an attractive target.

Rival Ransomware Gangs Clash as 0APT Threatens to Expose Krybit Operatives In an unusual escalation within the cybercriminal underworld, the ransomware group 0APT has targeted a rival outfit, Krybit, threatening to expose its affiliates unless a payment is made. The confrontation, first observed by dark web monitors on Sunday, follows the standard double-extortion playbook leaking a sample of stolen data as leverage but with a twist: the victim is another criminal operation. 0APT, which launched in January 2026, accused Krybit of being a ransomware group that "poses significant risks to cybersecurity and data privacy worldwide," despite engaging in the same illicit activities. The group warned that if Krybit failed to comply, it would release identity photos, names, locations, and other sensitive details of its members. As an added incentive, 0APT offered to unlock data for Krybit’s victims though the practical impact of such an offer remains questionable, given the target’s lack of reputational concerns. Security researchers at Barricade Cyber Solutions analyzed the leaked data and found plaintext credentials, five cryptocurrency wallet addresses, and no evidence of paid ransoms suggesting Krybit may be a fledgling operation. Meanwhile, Krybit’s website is currently offline, displaying a generic maintenance message. While 0APT has been labeled a "legitimate threat" with "credible technical depth" by Halcyon’s ransomware research center, its initial victim claims were widely seen as inflated. Krybit, by contrast, remains poorly documented, with dark web tracking platforms indicating it has only been active for a few weeks. This isn’t the first time cybercriminals have turned on each other. In 2025, DragonForce attacked rivals BlackLock and Mamona, defacing their sites and leaking internal communications. The group later seized control of RansomHub’s operations in April 2025 following a month-long feud, ultimately dismantling the once-dominant ransomware enterprise. The incident underscores the paranoia and infighting within the ransomware ecosystem, where even criminal groups are not immune to extortion though the effectiveness of such tactics against fellow threat actors remains debatable.

Group-IB, a Singapore-based cybersecurity company, experienced a data breach. It found a dump containing details for nearly 400,000 payment card records uploaded to a popular darknet card shop on April 9. The database was comprised almost entirely of the payment records related to banks and financial organizations in South Korea and the US.