The combination of a passive Linux backdoor on edge devices and a Windows RAT shows how attackers use SMTP as a C2 channel to bypass classic perimeter controls.
The quarterly report provides current statistics on malware, phishing and spyware on ICS computers and contextualises the threat situation for industrial automation systems.
The vulnerability in the dxgkrnl driver allows local attackers to achieve full system compromise, making it particularly relevant for post-exploitation scenarios.