Cyware Daily Threat Intelligence, April 29, 2025
Daily Threat Briefing • April 29, 2025
Sharp and TX stealers are back, donning a new cloak - named Hannibal Stealer. It is going after credentials from browsers, crypto wallets, FTP clients, and VPN apps. It even captures Discord tokens and Steam sessions. While its core is largely unoriginal, its control panel and delivery updates point to a more commercialized approach, complete with dark web subscriptions.
Privilege escalation is just a pointer error away. Attack of the Vsock exposes a critical use-after-free bug in the Linux kernel’s VMware vsock driver. A mishandled reference count allows attackers to reclaim memory and more. With exploit code already circulating, this one has the potential to hit millions of virtualized systems.
They sound urgent. They look official. And they’re emptying wallets. TA2900, a newly identified BEC actor, is impersonating landlords to trick renters in France and Canada into sending payments to attacker-controlled accounts. Messages come from compromised university inboxes and often swap out IBANs mid-thread.
Top Malware Reported in the Last 24 Hours
Malware targets Uyghur Congress leaders
In March 2025, a malware campaign targeted senior members of the World Uyghur Congress using a trojanized version of UyghurEdit++, a tool for Uyghur language support. The attack involved spear-phishing emails with Google Drive links that led to a password-protected RAR archive containing the malware. This campaign, linked to the Chinese government, aims to surveil the Uyghur diaspora and control information flow regarding human rights issues in Xinjiang. The malware, while not advanced, was delivered with a deep understanding of the target community.
Hannibal Stealer: Rebranded Sharp and TX malware
Hannibal Stealer is a sophisticated rebranded malware variant of the Sharp and TX stealers, targeting sensitive data from Chromium- and Gecko-based browsers, cryptocurrency wallets, and FTP clients. It employs geofencing to evade detection and compromises VPN credentials, Steam sessions, and Discord tokens. Advertised on dark web forums with a subscription model, it features a Django-based control panel for managing stolen data. The malware's source code shows minimal innovation, with changes mainly in log delivery mechanisms.
New Gremlin Stealer for sale
Unit 42 has identified Gremlin Stealer, a new info-stealer written in C# and advertised on Telegram since March. It targets sensitive data, including browser cookies, credit card information, cryptocurrency wallets, and credentials from FTP and VPN services. The malware bypasses Chrome's cookie protection and uploads stolen data to a server at 207.244.199[.]46. Gremlin Stealer is actively developed and capable of exfiltrating data from various applications, including Telegram and Discord.
Top Vulnerabilities Reported in the Last 24 Hours
CISA adds two bugs to KEV catalog
The CISA has added two high-severity vulnerabilities affecting Broadcom Brocade Fabric OS and Commvault Web Server to its KEV catalog due to evidence of active exploitation. The Broadcom flaw, CVE-2025-1976, allows local users with administrative privileges to execute arbitrary code with root privileges due to a flaw in IP Address validation. The Commvault flaw, CVE-2025-3928, allows remote authenticated attackers to create and execute web shells, but requires legitimate user credentials for exploitation. Agencies are advised to apply patches by mid-May 2025.
Critical Linux kernel flaw
A newly disclosed vulnerability in the Linux kernel, CVE-2025-21756, known as Attack of the Vsock, allows privilege escalation to root, threatening millions of systems. The flaw is within VMware vsock driver due to errors in reference counting during vsock transport reassignment. This leads to a use-after-free vulnerability, enabling attackers to execute arbitrary code with kernel privileges. A proof-of-concept exploit demonstrates how attackers can trigger the vulnerability, reclaim freed memory, leak kernel addresses, and hijack control flow to gain root access.
Top Scams Reported in the Last 24 Hours
BEC campaign targets property payments
Proofpoint has identified a new BEC threat actor, TA2900, targeting rental payments in France and occasionally Canada. This actor sends fraudulent French language emails claiming unpaid rent and instructs recipients to send payments to new bank accounts, often changing IBAN details frequently. The campaigns use compromised educational institution mailboxes and social engineering tactics to elicit emotional responses from victims. Researchers suspect the use of generative AI in crafting the emails, although this is unconfirmed. The threat actor's objective is financial theft, using opportunistically compromised accounts globally.