Cyware Daily Threat Intelligence, April 24, 2025
Daily Threat Briefing • April 24, 2025
It starts with a fake sales order and ends with FormBook silently stealing your data. A recent phishing campaign has been abusing a long-patched Microsoft flaw to deliver a fileless variant of the malware. The attack uses a Word document, a fake PNG file follows, carrying an encrypted payload that’s decrypted and run entirely in memory - leaving no trace on disk.
A single request is all it takes to bring SonicWall firewalls to a halt. CVE-2025-32818 targets the SSLVPN Virtual Office interface and can trigger a DoS condition on affected Gen7 appliances. The vulnerability, rated 7.5 in severity, has been patched in recent firmware updates.
Signal and WhatsApp are the new frontline for cloud compromise. Russian actors are running OAuth phishing campaigns against Microsoft 365 users tied to Ukraine and human rights work. Victims are tricked into handing over legitimate Microsoft auth codes, often via chats impersonating European officials.
Top Malware Reported in the Last 24 Hours
New DslogdRAT exploits 0-day
DslogdRAT is a newly observed malware exploiting a zero-day vulnerability in Ivanti Connect Secure, targeting organizations in Japan. It operates by executing commands through a web shell and communicates with a C2 server using encoded data. The malware's configuration is hardcoded and designed to avoid detection by operating during business hours. Another malware, SPAWNSNARE, was found on the same compromised systems.
Android spyware in fake Alpine Quest app
A new Android spyware, Android.Spy.1292.origin, has been discovered in a fake Alpine Quest app, targeting Russian military personnel. The spyware, hidden in a trojanized version of the app, steals contacts, geolocation, and file information and can download additional modules to exfiltrate stored data. Distributed via Russian Android catalogs and a fake Telegram channel, the spyware sends data to a command-and-control server and shares geolocation updates with attackers' Telegram bots. The modular design allows it to perform a broader range of malicious activities.
FormBook malware spreads via phishing campaign
A new sophisticated phishing campaign has been identified by Fortinet, which distributes the FormBook info-stealer. This campaign targets Windows users through emails disguised as sales orders and utilizes a legacy Microsoft vulnerability (CVE-2017-11882) to deliver a fileless variant of the malware. The attack begins with a malicious Word document that exploits the altChunk feature to load an embedded RTF file, triggering a sequence that results in the execution of a DLL file disguised as "AdobeID.pdf" and executes it via process hollowing. The malware then downloads an encrypted payload disguised as a PNG file, decrypts it, and runs the FormBook malware in memory to evade detection.
Top Vulnerabilities Reported in the Last 24 Hours
High-severity bug in Redis
A high-severity vulnerability, CVE-2025-21605, has been identified in Redis. This flaw allows unauthenticated users to cause server memory exhaustion, resulting in a Denial-of-Service (DoS) condition. The vulnerability affects Redis versions from 2.6 onward and has been patched in versions 6.2.18, 7.2.8, and 7.4.3. To mitigate the risk, administrators can block unauthenticated access or implement network security measures.
Vulnerability in SonicOS SSLVPN Virtual Office
SonicWall has disclosed a high-severity vulnerability in its SonicOS SSLVPN Virtual Office interface, identified as CVE-2025-32818, which could allow remote attackers to crash firewall appliances. This vulnerability, with a CVSS score of 7.5, can lead to a DoS condition by sending specially crafted requests to the SSLVPN interface. Affected devices include a range of SonicWall’s Gen7 virtual and physical firewalls. SonicWall has released updated firmware to address this issue, and users are urged to update immediately to mitigate the risk.
Top Scams Reported in the Last 24 Hours
Russian hackers target Microsoft 365 OAuth
Since March, Volexity has observed Russian threat actors targeting individuals and organizations linked to Ukraine and human rights through Microsoft 365 OAuth phishing campaigns. These attacks involve impersonating European officials, using legitimate Microsoft authentication workflows, and leveraging compromised accounts to gain unauthorized access to victims' data. The campaigns are primarily conducted via Signal and WhatsApp, requiring victims to share Microsoft-generated authorization codes.