Daily Threat Briefings

Start your day with a concise and succinct digest of the most important security happenings of the past 24 hours delivered straight to your inbox Monday through Friday.

Aug 27, 2025

Cyware Daily Threat Intelligence, August 27, 2025

The Underground ransomware gang is striking with precision, blending AES and RSA encryption to lock down global targets. After reconnaissance and breaches, they deploy customized malware that wipes shadow copies, blocks remote desktops, and selectively encrypts files using a stripe method for larger ones, sparing critical system folders. Blind Eagle's shadow looms over Colombia, with five activity clusters unleashing RATs and phishing on government sectors from May 2024 to July 2025. Targeting judiciary, education, and healthcare, they impersonate agencies via spear-phishing to deliver Lime RAT and AsyncRAT, leveraging compromised emails and dynamic DNS for espionage and financial gains. Citrix is sealing critical gaps in NetScaler ADC and Gateway, including a zero-day remote code execution flaw that's already under attack. This memory overflow bug affects Gateway configurations, urging immediate firmware updates, alongside fixes for denial-of-service and improper access control vulnerabilities.

Aug 26, 2025

Cyware Daily Threat Intelligence, August 26, 2025

Sneaky adware is sneaking onto millions of Android devices through 77 malicious apps yanked from Google Play. With over 19 million installs, these apps pack Joker malware that steals info and signs up for premium services, alongside Harly variants and the evolving Anatsa trojan. A Docker Desktop flaw is handing attackers the keys to host systems on Windows and macOS. This SSRF vulnerability lets malicious containers bypass isolation to access the Engine API, mount drives, and escalate privileges, fixed in version 4.44.3 to curb unauthorized file access. Phony Tesla sites are reeling in robot enthusiasts with Google Ads promising Optimus preorders for a $250 deposit. These scams mimic Tesla's look to harvest credit card details for underground markets, using rotating domains and Cloudflare to stay elusive.

Aug 25, 2025

Cyware Daily Threat Intelligence, August 25, 2025

Posing as a trusty antivirus app, Android.Backdoor.916.origin is giving Russia's FSB a backdoor into executives' devices. Disguised as a fake antivirus, this malware spreads via private messages, grabs extensive permissions, and uses Accessibility Service to steal chats and more. APT36 is turning innocent Linux desktop files into espionage tools against India's government and defense sectors. Through phishing ZIPs with malicious .desktop files mimicking PDFs, they execute hidden bash commands to fetch Go-based ELF payloads. Salesforce is plugging critical holes in Tableau Server and Desktop that could let attackers run wild with code execution. The top flaw, a 9.6 CVSS type confusion bug, enables local exploits on Windows and Linux, alongside upload vulnerabilities leading to path traversal and improper input validation issues.

Aug 22, 2025

Cyware Daily Threat Intelligence, August 22, 2025

Masquerading as an Australian electronics store, Cookie Spider’s malvertising campaign unleashed the AMOS malware on over 300 targets. From June to August, victims were tricked into running commands that installed SHAMOS, a variant stealing passwords, Keychain data, and crypto wallet details. Berserk Bear hackers are wielding a seven-year-old Cisco flaw to infiltrate global critical infrastructure. Exploiting CVE-2018-0171, these FSB-linked attackers trigger device reloads and use custom SNMP tools and SYNful Knock implants to harvest configurations and maintain covert access. Posing as Rothschild & Co recruiters, MuddyWater APT is targeting CFOs with spear-phishing finesse. Using Firebase-hosted phishing pages and custom CAPTCHAs, they deploy VBS scripts and ZIPs to install NetBird and OpenSSH, ensuring persistent access to compromised systems worldwide.

Aug 21, 2025

Cyware Daily Threat Intelligence, August 21, 2025

Slipping through the cracks like a chameleon, QuirkyLoader is spreading infostealers and remote access tools with a multi-stage attack. Since November 2024, it’s used malicious emails with legitimate executables, leveraging DLL side-loading to target organizations, evading detection with process hollowing. A zero-day flaw has Apple racing to patch millions of devices with emergency iOS and iPadOS updates. This critical ImageIO vulnerability, triggered by malicious images, allows sophisticated attacks—potentially by nation-state actors—to corrupt memory and access devices like iPhone XS and various iPads. Hackers are hijacking Microsoft’s own infrastructure to steal 365 logins with a sly phishing trick. Using legitimate office[.]com links and ADFS redirects, attackers funnel users from Google searches to deceptive phishing pages, bypassing MFA and URL detection with custom tenants and conditional loading.

Aug 20, 2025

Cyware Daily Threat Intelligence, August 20, 2025

Crafty attackers are slipping into cloud Linux systems through a critical Apache ActiveMQ flaw, unleashing DripDropper malware. Exploiting CVE-2023-46604, they use a password-protected payload to communicate via Dropbox, patch the vulnerability to block rivals, and tweak SSH settings for persistent root access. Microsoft’s latest patches are racing to fix a recovery meltdown across Windows 10 and 11. Emergency updates address failures in reset and recovery operations caused by August 2025 patches, with new cumulative fixes released on August 19 to stabilize affected systems. Fraudsters posing as celebrity podcast reps are reeling in business owners with a bait. This podcast imposter scam lures victims into tech-check calls that grant remote access, hijacking social media and risking corporate systems through shared passwords.

Aug 19, 2025

Cyware Daily Threat Intelligence, August 19, 2025

With a diplomat’s charm, malicious emails are smuggling XenoRAT into South Korea’s embassies via GitHub traps. Since March, this spearphishing spree has targeted European missions, using password-protected ZIPs to unleash a trojan that snatches data and grants attackers remote control. A Windows flaw is opening the door for RansomExx to wield PipeMagic like a digital skeleton key. This vulnerability lets Storm-2460 deploy a backdoor through fake ChatGPT apps, targeting IT and finance sectors with stealthy, encrypted remote access. Unpatched N-able N-central servers are sitting ducks for hackers exploiting two critical flaws. These vulnerabilities enable unauthorized command execution, spurring CISA to list them in its KEV Catalog with a federal patching deadline of August 20.

Aug 18, 2025

Cyware Daily Threat Intelligence, August 18, 2025

Trojan Horses are making a comeback as AI-powered apps like "JustAskJacky" disguise malware within useful tools such as recipe or image search apps. By leveraging AI-generated websites, attackers make them look legitimate while slipping past antivirus defenses.

Aug 15, 2025

Cyware Daily Threat Intelligence, August 15, 2025

PhantomCard malware hits Brazilian banks, Cisco patches critical firewall flaw, and Netflix job scams steal Facebook logins from professionals.

Aug 14, 2025

Cyware Daily Threat Intelligence, August 14, 2025

A crafty malvertising campaign is slipping PS1Bot into systems through deceptive compressed archives. With techniques like environmental polling and dynamic C# DLL compilation, PS1Bot evades detection while siphoning off passwords and cryptocurrency wallet data, echoing tactics of Skitnet and AHK Bot. Crypto24 is striking high-profile organizations with surgical precision, blending legitimate IT tools like PSExec and AnyDesk with custom malware to devastating effect. Targeting sectors from finance to entertainment across Asia, Europe, and the U.S., this ransomware group uses privileged accounts and scheduled tasks to maintain stealthy persistence. Fortinet is sounding the alarm on a critical FortiSIEM vulnerability that’s already being exploited in the wild with circulating exploit code. Rated 9.8 on CVSS, this remote unauthenticated command injection flaw allows attackers to execute unauthorized commands via crafted CLI requests.

Aug 13, 2025

Cyware Daily Threat Intelligence, August 13, 2025

Lurking in the shadows since mid-2024, the Curly COMrades group is weaving a web of cyber-espionage across Georgia’s government and Moldova’s energy sector. Their weapon, MucorAgent, uses AES-encrypted PowerShell scripts and hijacked COM objects to slip past defenses, employing erratic scheduled tasks and legitimate remote tools to steal credentials. Microsoft’s August 2025 Patch Tuesday dropped a hefty fix for 111 vulnerabilities, including a zero-day Kerberos flaw that’s raising alarms. Dubbed BadSuccessor, this privilege escalation bug allows attackers with sufficient access to hijack Active Directory domains via Managed Service Accounts. A slick phishing campaign is hitting UK organizations hard, masquerading as the Home Office to swipe Sponsorship Management System credentials. Using urgent emails to lure victims to fake login pages, attackers are raking in £15,000 to £20,000 per scam through fake job offers and visa fraud.

Aug 12, 2025

Cyware Daily Threat Intelligence, August 12, 2025

GitHub repositories are turning into unexpected traps, with SmartLoader malware lurking behind seemingly legitimate projects like game cheats and software cracks. Disguised in README files and compressed archives, it activates via a malicious batch file that loads an obfuscated Lua script, delivering infostealers. A formidable new ransomware, Charon, is borrowing pages from APT playbooks to deliver tailored strikes against organizations. Using DLL sideloading and process injection via legitimate binaries, it deploys advanced encryption with Curve25519 and ChaCha20 and spreads across networks by targeting shares. Dutch cybersecurity officials are spotlighting active exploits of a critical Citrix NetScaler vulnerability, hitting key organizations since early May. The bug enables control flow hijacking and DoS attacks on Gateway or AAA configurations, with web shells found on compromised devices.