WINNTI HACKERS TARGET OTHER THREAT ACTORS WITH NEW GLUTTON MALWARE

Summary from the TLDR InfoSec newsletter

The Winnti hacking group has begun using a new Glutton backdoor to attack targets in the US and China. Glutton is a PHP malware that masquerades as a php-fpm process that facilitates fileless execution and injects malicious code into PHP files. It is an advanced backdoor that establishes persistence and supports 22 commands for C2. Notably, the Winnti group has been hiding Glutton in tools sold on cybercrime forums to attack other cybercrime groups and steal their information.