Cyware Daily Threat Intelligence, April 10, 2025
Daily Threat Briefing • April 10, 2025
A torrent download might be doing more than delivering cracked software. A campaign has been distributing ViperSoftX to Korean users, likely run by Arabic-speaking threat actors. The malware quickly expands its footprint by downloading multiple payloads. It even manipulates Windows Defender settings to stay hidden, making cleanup far more difficult once it’s embedded.
Dell users have a new reason to check their patch status. Six vulnerabilities in PowerScale OneFS could expose systems to compromise, including one high-severity flaw that warrants immediate attention. While version 9.10.1.1 addresses the issues, Dell has provided workaround steps and targeted patches for older releases.
What looks like a harmless file-sharing notification is actually the start of a RAT deployment. A new phishing campaign mimics messages from files[.]fm, warning users of file deletion to create urgency. Clicking through leads to a real landing page, ultimately triggering malware. The payload often includes ConnectWise RAT, giving attackers persistent, remote access to compromised systems.
Top Malware Reported in the Last 24 Hours
ViperSoftX malware targets Korean victims
ASEC discovered a malware campaign targeting Korean victims since April 1, suspected to be orchestrated by Arabic-speaking attackers. The malware, known as ViperSoftX, is primarily spread through cracked software or torrents and operates as a PowerShell script. During the C&C communication process, the malware downloads additional malicious software, including a VBS downloader, malicious PowerShell script, PureCrypter, and Quasar RAT. The VBS downloader is responsible for downloading and executing PowerShell and VBS files from a remote server. The PowerShell script, in turn, downloads and executes PureCrypter and Quasar RAT, while also adding Windows Defender exception paths to evade detection.
New TCESB malware targets ESET Security Scanner
A Chinese-linked threat group, ToddyCat, has been exploiting a security vulnerability in ESET's software to deliver a new malware, TCESB, in Asia. The malware uses DLL Search Order Hijacking to gain control of the execution flow, exploiting a flaw in ESET Command Line Scanner, which insecurely loads a DLL named "version.dll." TCESB is a modified version of an open-source tool, EDRSandBlast, and uses the BYOVD technique to install a vulnerable Dell driver, DBUtilDrv2.sys, susceptible to a privilege escalation flaw tracked as CVE-2021-36276.
Top Vulnerabilities Reported in the Last 24 Hours
CISA warns of two Linux kernel bugs
The CISA has warned about two actively exploited vulnerabilities in the Linux kernel, identified as CVE-2024-53197 and CVE-2024-53150, both located in the USB-audio driver. These flaws could allow attackers to manipulate system memory, escalate privileges, or access sensitive information. CVE-2024-53197 is an out-of-bounds access vulnerability that can be exploited by an attacker with physical access to a system using a malicious USB device. CVE-2024-53150 is an out-of-bounds read vulnerability that can be exploited by a local, privileged attacker to obtain sensitive information. Both vulnerabilities were added to the KEV catalog.
Dell issues security advisory
Dell has issued a security advisory for multiple vulnerabilities—CVE-2025-27690, CVE-2025-26330, CVE-2025-22471, CVE-2025-26480, CVE-2025-23378, and CVE-2025-26479—in its PowerScale OneFS operating system. These vulnerabilities could be exploited by malicious users to compromise affected systems. Upgrading to PowerScale OneFS version 9.10.1.1 or later typically resolves these vulnerabilities, but specific remediated versions are available for older OneFS releases. For the high-severity CVE-2025-27690 vulnerability, several workarounds are suggested until an upgrade or patch is applied.
Hackers target SSRF flaws in EC2-hosted sites
A targeted cyber campaign exploited SSRF vulnerabilities in websites hosted on AWS EC2 instances to extract sensitive data, including IAM credentials, between March 13 and 25. This campaign was likely carried out by a single threat actor who used SSRF flaws to remotely query internal EC2 Metadata URLs and gain unauthorized access to sensitive information. The attackers focused on instances running on IMDSv1, AWS's older metadata service, which has since been replaced by the more secure IMDSv2.
Top Scams Reported in the Last 24 Hours
“Pick Your Poison” phishing campaign
Cofense analyzed a sophisticated phishing campaign titled "Pick Your Poison." The attack begins with an email that appears to be from a legitimate file-sharing service, files[.]fm, warning the recipient of an impending file deletion. Upon clicking the embedded link, users are redirected to a legitimate files[.]fm page, enhancing the illusion of safety. However, when users open the shared file, they are presented with two options, "Preview" or "Download," both leading to malicious outcomes. The malware often installs a RAT such as ConnectWise RAT, allowing threat actors unauthorized access to compromised systems.