WOGRAT MALWARE ABUSES ONLINE NOTEPAD SERVICES TO STORE MALWARE

Summary from the TLDR InfoSec newsletter

A new malware strain that targets both Windows and Linux is being distributed as a base64 encoded payload from the aNotepad service. The WogRAT malware on Windows is loaded as a DLL and communicates with C2 servers via POST requests to receive commands for uploading and downloading files, waiting, running arbitrary commands, and terminating. The Linux version behaves similarly except that it uses a TinySHell backdoor to communicate with the C2 server over a reverse shell.