Jun 16, 2025
Cyware Daily Threat Intelligence, June 16, 2025
A trusted developer platform is now a delivery system for stealthy malware. The newly uncovered threat actor Water Curse is abusing GitHub to distribute weaponized repositories aimed at cybersecurity pros, game developers, and DevOps teams. With payloads hidden in build scripts and obfuscated, the campaign enables data theft, remote access, and persistent control.
Some ransomware isn’t just extorting, it’s erasing everything in its path. Anubis, a new RaaS group, adds a destructive twist with its “wipe mode,” ensuring file recovery is impossible even if a ransom is paid. With ties to the older Sphinx malware, Anubis is now offering flexible affiliate terms, data extortion, and encryption via ECIES.
A critical bug is still lurking across thousands of Grafana dashboards. A client-side redirect flaw leaves over 46,000 internet-facing Grafana instances at risk of account takeovers and plugin-based attacks. Despite a patch issued in May, more than a third of deployments remain exposed.