www.securityweek.com 5/8/2026, 3:01:11 PM · via preferred

Student arrested for rail hack amid PamDOORa backdoor $900 sale

Student arrested for rail hack amid PamDOORa backdoor $900 sale

Student arrested for rail hack amid PamDOORa backdoor $900 sale

SecurityWeek’s In Other News round-up highlights a 23-year-old student detained in Taiwan for allegedly infiltrating the high-speed rail network and transmitting fake General Alarm signals, alongside the rise of PamDOORa, a PAM-based Linux backdoor marketed by a threat actor known as ‘darkworm’ that provides persistent SSH access while harvesting plaintext…

First seen 2026-05-08T10:59:41.386Z · Last seen 2026-05-08T15:01:11.122Z

CyberSIXT Evidence Panel
Primary Source flare.io
Threat Actor
darkworm

SECURITYWEEK’S In Other News round-up highlights a 23-year-old student detained in Taiwan for allegedly infiltrating the high-speed rail network and transmitting fake General Alarm signals, alongside the rise of PamDOORa, a PAM-based Linux backdoor marketed by a threat actor known as ‘darkworm’ that provides persistent SSH access while harvesting plaintext credentials. The piece notes PamDOORa is being sold on a Russian cybercrime forum for $900.

It also identifies IBM security services lead Tom Parker as a frontrunner to lead CISA following the withdrawal of the previous nominee, with Parker’s private-sector experience including founding Hubble cited as a key factor. Additionally, the article references other linked items in the weekly brief, such as a new Linux backdoor and related threat activity, situating PamDOORa within broader post-exploitation tool trends.

Taken together, the summary underscores ongoing developments in hidden access tools, high-profile security leadership discussions, and continued attention to cyber-physical and critical infrastructure security.

View Primary Source Via www.securityweek.com

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline