Search all coverage

Threat actor

darkworm

Tracked by CyberSIXT since May 8, 2026 · last activity May 8, 2026

Linked incidents

malware closed 2 articles

PamDOORa Linux PAM backdoor advertised for sale on underground forum

Coverage timeline

Student arrested for rail hack amid PamDOORa backdoor $900 sale
www.securityweek.com · May 8, 2026
New Linux PAM backdoor PamDOORa sold on Russian forum for $1,600
thehackernews.com · May 8, 2026