Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Daily Threat Intelligence

Cyware Daily Threat Intelligence - Featured Image

Daily Threat Briefing • Apr 10, 2020

Threat actors behind ransomware attacks are increasingly resorting to extortion tactics to earn ransom from the victims. In a recent incident, an industrial contractor called Visser Precision was targeted by the DoppelPaymer ransomware gang. The attackers demanded a hefty ransom from the firm and later published their confidential data when their demands were not met. The attackers published sensitive files held by the firm, including documents from aerospace giants such as Lockheed Martin, Boeing, and SpaceX.

Coming to new threats, security researchers reported a new update of the cryptomining DDG botnet that incorporates a proprietary P2P protocol for its communication. Due to this, the botnet can continue to operate even if its C2 servers are taken down, thereby making it extremely difficult to stop. On the other hand, security researchers discovered serious flaws in connected cars manufactured by Ford and Volkswagen that can allow attackers to tamper with traction control, collision warning system, and intercept messages sent by the tire pressure monitoring system.

Top Breaches Reported in the Last 24 Hours

SCUF Gaming data exposed

An unsecured database belonging to SCUF Gaming leaked more than 1.1 million records, containing customer names, contact information, payment info, order histories, and repair tickets, among other data. Most of the records appear to have been collected by SCUF Gaming between 2017 and 2020. The database was secured on April 3, 2020.

DoppelPaymer crew leaks stolen data

Visser Precision, an industrial contractor that works with aerospace firms, was attacked by the DoppelPaymer ransomware. The ransomware operators published the data stolen from the company as their ransom demand was not fulfilled. The published data included sensitive documents belonging to Lockheed Martin, Boeing, and SpaceX, among other aerospace giants.

Iranian IDs put up for sale

The personal information of around 45,000 Iranian individuals, totaling to 8.17 GB, was put up for sale on the dark web for an amount of $200 in BTC. The stolen data appeared to have come from several sites including Niazpardaz[.]ir, an online advertising platform, and Arzi24[.]com, a website owned by Farhad Exchange. Security researchers also found another trove of leaked data for sale, including 52,000 ID cards along with selfies of their respective owners.

Top Malware Reported in the Last 24 Hours

Unstoppable DDG botnet

The cryptomining botnet called DDG has been updated by its operators to adopt a proprietary peer-to-peer (P2P) mechanism. The botnet, first reported by Netlab 360 researchers in January 2018, has undergone 16 different updates over the past three months to become a highly sophisticated and seemingly unstoppable threat, according to the researchers. The botnet can fully function using its P2P protocol as a failsafe, even if its C2 servers are taken down.

iOS Fleeceware apps

The UK-based security firm, Sophos, has reported that over 3.5 million iOS users have installed “fleeceware” apps on their iPhones and iPads. These apps are designed to abuse legal loopholes in the app trial mechanism to charge users a subscription fee, even if it is uninstalled after the end of the trial period. Fleeceware includes various types of apps such as image editors, horoscope/fortune-telling/palm readers, QR code/barcode scanners, and face filter apps.

Top Vulnerabilities Reported in the Last 24 Hours

Connected cars’ flaws

A pair of connected cars manufactured by Ford and Volkswagen were found containing serious security flaws. Researchers found that the infotainment unit in these cars could be hacked to tamper with traction control, collision warning system, and intercept messages sent by the tire pressure monitoring system. The two models affected card models were Ford Focus Titanium Automatic 1.0L petrol and the Volkswagen Polo SEL TSI Manual 1.0L petrol.

Buggy smart locks

Tapplock, a company that makes internet-connected smart padlocks, came under fire from the Federal Trade Commission (FTC) for its deceptive security claims. Security researchers from Pen Test Partners, who filed a complaint with the FTC, found that any nearby Tapplock smart lock could be unlocked or locked due to a lack of encryption around the Bluetooth communication between the lock and the companion app.

Top Scams Reported in the Last 24 Hours

Fake update notification for Cisco Webex

A new phishing campaign was found sending emails disguised as a critical security advisory for Cisco’s Webex web conferencing platform. The emails targeted employees working from home during the COVID-19 pandemic by urging them to update their Cisco Meetings Desktop App for Windows. The embedded link in the emails takes victims to a phishing page designed to steal their Cisco Webex credentials.

Multimillion-Dollar iPhone SMShing campaign

IBM X-Force researchers discovered a SMiShing campaign designed to unlock the phone for resale on the black market. The phishing campaign was found to be operating over 600 phishing domains designed to steal iCloud credentials from Apple users. The attackers behind the campaign were found focusing on cybersecurity and tech conferences to steal iPhones belonging to influential company executives, only to later target them with the SMShing campaign to extract their credentials and private data.

Large-scale email extortion campaign

Researchers detected a large-scale email extortion campaign that targets users by claiming that their systems were hacked and that they possess a video recording of them. The scammers then demand an amount of $1900 in bitcoins and threaten to leak their video to family and friends if the amount is not paid.

Related Threat Briefings

Feb 13, 2025

Cyware Daily Threat Intelligence, February 13, 2025

Cybercriminals aren’t just after your data, they want full control of your device, and they’re getting better at it. The new BTMOB RAT is spreading through phishing sites disguised as streaming services and crypto platforms. This upgraded version of SpySolr RAT goes beyond basic spying and leverages Android’s Accessibility Service. Hackers never forget old exploits. Attackers are ramping up efforts to exploit vulnerabilities from 2022 and 2023, targeting unpatched ThinkPHP and ownCloud systems. Researchers have tracked nearly 600 unique IPs abusing these flaws, proving that even years-old vulnerabilities remain dangerous if left unresolved. Kimsuky is turning fake error messages into a weapon. Inspired by ClickFix campaigns, the North Korean APT has been pushing info-stealers through deceptive pop-ups, tricking victims into running malicious PowerShell commands. Masquerading as a South Korean official, the group lures targets into downloading malware under the guise of document registration.

Feb 12, 2025

Cyware Daily Threat Intelligence, February 12, 2025

Pirated software isn’t just a bargain, it’s a backdoor. Russian hackers are using fake KMS activators and bogus Windows updates to slip malware onto unsuspecting systems in Ukraine. By disguising malware as KMS activators and bogus updates, they deploy DarkCrystal RAT, turning routine software installations into a Trojan horse for cyber-espionage. Microsoft’s February Patch Tuesday is here. This month’s update tackles 55 security flaws, including four zero-days - two of which are actively exploited. Among the most critical fixes are three RCE vulnerabilities, reinforcing why timely patching isn’t just recommended, it’s essential. Romance scams aren’t new, but cybercriminals are getting bolder just in time for Valentine’s Day. A phishing campaign disguised as a Valentine basket giveaway has been circulating, tricking victims into handing over personal data. Researchers found tens of thousands of newly registered Valentine-themed websites in January alone, with 1 in 72 flagged as malicious.

Feb 11, 2025

Cyware Daily Threat Intelligence, February 11, 2025

Hackers are widening their attack surface, and Linux is now in their crosshairs. A new variant of the SystemBC RAT has emerged, stealthily infiltrating Linux environments. Given its history of pairing with ransomware, this development signals a growing threat to corporate systems and cloud infrastructures. Physical access shouldn’t mean instant compromise, but for iPhones and iPads, it briefly did. Apple has rushed to patch a flaw that allowed attackers to disable USB Restricted Mode on locked devices. Designed to prevent unauthorized access, this feature was rendered useless by the vulnerability. Thousands of firewalls meant to protect businesses are instead exposing them to serious risks. Over 12,000 GFI KerioControl firewalls remain unpatched against a critical remote code execution flaw. Despite a fix being available since December, many instances are still vulnerable.

Feb 10, 2025

Cyware Daily Threat Intelligence, February 10, 2025

Cybercriminals are finding new ways to poison the AI supply chain. Researchers uncovered two malicious ML models on Hugging Face, where attackers used corrupted pickle files to smuggle Python malware. This novel technique, dubbed nullifAI, aimed to bypass security scans and establish a backdoor. In another case of SEO manipulation, threat actors hijacked IIS servers in Asia, injecting BadIIS malware to manipulate search results and drive unsuspecting users to illegal gambling sites. Government and university servers in Asian countries were among those exploited. Researchers linked the campaign to DragonRank, a Chinese-speaking group. Patching delays could turn into a disaster. CISA warned that a vulnerability in Trimble Cityworks GIS software is being actively exploited for remote code execution. Even though patches were released, attackers continued taking advantage of unpatched systems, prompting its urgent addition to the KEV catalog.

Feb 7, 2025

Cyware Daily Threat Intelligence, February 07, 2025

North Korean hackers are refining their phishing playbook, now using the forceCopy malware to hijack credentials. The Kimsuky hacking group is targeting victims with deceptive emails containing Windows shortcut files disguised as Microsoft Office or PDF documents. The attack also involves the usage of additional malware. CISA has added critical vulnerabilities to its KEV catalog, signaling an urgent need for patching. The list includes flaws in Microsoft Outlook and Sophos XG Firewall, both carrying a CVSS score of 9.8. Federal agencies have until February 27 to patch these. A long-standing Chinese cyber-espionage group, GreenSpot APT, is running a phishing campaign that preys on users of the popular Chinese email service 163[.]com. The group, which has been active since 2007, has registered fake domains to steal login credentials from government and military personnel

Feb 6, 2025

Cyware Daily Threat Intelligence, February 06, 2025

Cybercriminals are getting more sophisticated, turning search engines into traps. A fake Google ad for Cisco AnyConnect led unsuspecting users to a counterfeit website, mimicking a German university to evade security filters. The fraudulent site redirected victims to a spoofed Cisco download page, pushing NetSupport RAT as the legitimate AnyConnect installer. Russian organizations are under fire as attackers distribute NOVA stealer, a new variant of SnakeLogger, through phishing emails. Advertised on underground forums as MaaS for as little as $50 per month, NOVA is designed for credential theft, keylogging, and clipboard data extraction. Cisco has patched two critical vulnerabilities in its Identity Services Engine, which could allow remote attackers to execute commands and manipulate system configurations. Exploited through specially crafted API requests, these flaws pose significant risks for enterprises using ISE for authentication and network control.

Feb 5, 2025

Cyware Daily Threat Intelligence, February 05, 2025

North Korean hackers are turning fake job interviews into a gateway for cyber espionage. SentinelOne identified new variants of the macOS malware FlexibleFerret, used in the Contagious Interview operation to lure targets with fake job interviews. Victims are tricked into downloading malicious software disguised as virtual meeting tools, allowing attackers to gain control over their systems. Cyberespionage groups are shifting their sights to the backbone of enterprise networks. A newly discovered malware, linked to the DaggerFly APT group, is targeting Linux-based network devices instead of standard endpoints. By hijacking SSH connections and replacing system binaries, the malware ensures long-term persistence while silently extracting sensitive data. A security flaw in AMD processors has raised concerns over hardware-based attacks. This bug could allow attackers with admin access to load malicious microcode, potentially undermining system integrity. This exploit underscores the growing risks of hardware security gaps, where even minor weaknesses can have major consequences.

Feb 4, 2025

Cyware Daily Threat Intelligence, February 04, 2025

Cybercriminals are finding new ways to weaponize everyday tools, and this time, they’re using TryCloudflare to hide their tracks. Researchers uncovered a phishing campaign that stealthily delivers AsyncRAT via Python scripting and cloud tunnels. The attack starts with a Dropbox link leading to a maze of scripts that ultimately drop a harmful payload. Even AI developers aren’t safe from deception. Threat actors have infiltrated PyPI with two malicious packages disguised as legitimate tools for DeepSeek. These fraudulent packages steal sensitive data, from user credentials to API keys, proving once again that trust in open-source repositories can be a double-edged sword. One small vulnerability, one massive risk. Russian cybercriminals exploited a zero-day in 7-Zip to deliver SmokeLoader in attacks on Ukrainian entities. By bypassing Windows Mark-of-the-Web protections, the attackers tricked victims into executing malware-laden files.

Feb 3, 2025

Cyware Daily Threat Intelligence, February 03, 2025

Cybercriminals are exploiting trust and social engineering at scale, preying on unsuspecting victims across industries. The Russian-speaking cybercrime gang Crazy Evil has been linked to over 10 social media scams, tricking users into installing malware like StealC and AMOS. Operating primarily through Telegram, the group specializes in identity fraud, cryptocurrency theft, and info-stealers. A wedding invitation should bring good news, not malware. Hackers in Malaysia and Brunei are targeting users with fake wedding invites spread via WhatsApp and Telegram, tricking them into installing a new Android malware called Tria. The campaign resembles UdangaSteal but focuses on new social engineering tactics. Even the tightest security can come undone with a race condition. Apple patched a critical vulnerability in macOS Sonoma, Sequoia, and iPadOS, which allowed hackers to escalate privileges and run code at the kernel level. Apple fixed the issue by improving memory management, but this serves as another reminder that even the most secure systems need constant vigilance.

Jan 31, 2025

Cyware Daily Threat Intelligence, January 31, 2025

Cybercriminals are sharpening their tactics, and Brazilian financial firms are the latest target. The Coyote banking trojan is on the prowl, using malicious Windows LNK files to execute PowerShell scripts that steal data and compromise systems. Meanwhile, a new browser-based threat is emerging—syncjacking. This attack exploits malicious extensions to hijack browsers, disable security settings, and access stored credentials. In its final stage, attackers gain full control of devices, including cameras and audio, without detection. Speaking of hidden threats, users of Microsoft Ads are being tricked by fraudulent Google ads leading to phishing pages designed to steal their login credentials. This campaign has persisted for two years, slipping past security filters and mimicking Microsoft’s login process with deceptive precision. For detailed Cyber Threat Intel, click ‘Read More’.

Jan 29, 2025

Cyware Daily Threat Intelligence, January 29, 2025

Cybercriminals are refining their tactics, blending deception with persistence to breach defenses. A financially motivated threat actor has been running a phishing email campaign since last year, targeting users in Poland and Germany. The attacks use payloads like Agent Tesla, Snake Keylogger, and a new backdoor named TorNet. Zyxel CPE Series devices are under siege as researchers uncover an actively exploited zero-day vulnerability. This flaw allows attackers to execute remote commands, potentially leading to system takeovers, data loss, and network intrusions. The attacks, originating primarily from Taiwan, have compromised over 1,500 devices, sparking urgent calls for users to apply security updates. Phishing scams continue to evolve, with a new campaign exploiting PDF documents to steal Amazon Prime credentials. Victims receive emails warning of an expired membership, leading them to a fake Amazon login page where they unknowingly hand over personal and credit card information.

Jan 28, 2025

Cyware Daily Threat Intelligence, January 28, 2025

Even the sleekest systems have their cracks. Apple has patched a critical CoreMedia vulnerability that hackers have already exploited to target devices. The flaw, which impacts how audio and video are processed, had been actively used against earlier versions of iOS prior to iOS 17.2. Apple’s fix is now available for iPhones XS and later, select iPads, and the company’s latest hardware. Security shouldn’t feel like Swiss cheese. Yet, SonicWall’s SMA1000 appliances are under siege, with attackers exploiting a critical vulnerability to install malware without requiring credentials. Despite a patch being available, over 5,000 devices remain exposed, allowing hackers to hijack SSL VPN sessions remotely. Think twice before clicking on that delivery notification. Phishers posing as USPS are sending fraudulent SMS messages claiming a package couldn’t be delivered due to “incomplete address information.” With over 630 phishing pages spanning 50 countries, the campaign targets unsuspecting individuals at an alarming scale. In today’s digital landscape, not all deliveries are worth opening - especially the fraudulent ones.