SDBbot

Signals

NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

Malware & Tools · SDBbot

· MalwareS0461 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

SDBbot is a backdoor with installer and loader components that has been used by TA505 since at least 2019.(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)

Tactic Coverage

stealth (7)discovery (6)privilege escalation (4)command and control (3)persistence (3)collection (2)lateral movement (1)exfiltration (1)execution (1)

Used By (1 groups)

G0092TA505Hive0065, Spandex Tempest

Techniques (24)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

T1027Obfuscated Files or Information

stealth

T1027.002Software Packing

stealth

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

References

https://attack.mitre.org/software/S0461 https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader