Cyware Daily Threat Intelligence, August 04, 2025

Akira ransomware is striking with surgical precision, exploiting a suspected zero-day flaw in SonicWall SSL VPN devices, even those fully patched. Since mid-July 2025, attackers have used Virtual Private Server logins to bypass MFA, hitting multiple targets in rapid succession.

A cunning Android RAT, PlayPraetor, is sweeping through six countries, already compromising over 11,000 devices with its deceptive tactics. Masquerading as legitimate apps via fake Google Play Store pages and Meta Ads, it exploits accessibility services to overlay phishing screens on nearly 200 banking and crypto apps.

MediaTek chipsets powering smartphones and IoT devices are vulnerable to new flaws that could expose millions of users. These issues, affecting a wide range of Android devices, allow attackers to escalate privileges or execute malicious code. With some exploits requiring no user interaction, unpatched systems face significant risks, urging immediate updates.

Top Malware Reported in the Last 24 Hours

Akira ransomware targets SonicWall VPNs

Akira ransomware has recently targeted SonicWall SSL VPN devices, exploiting a likely zero-day vulnerability even on fully-patched systems. This surge in attacks began around July 15, with multiple pre-ransomware intrusions occurring in quick succession. Researchers noted that the malicious logins often originated from Virtual Private Server hosting rather than typical broadband networks, indicating a sophisticated approach by the attackers. Since its emergence in March 2023, Akira ransomware has extorted approximately $42 million from over 250 victims, with a notable focus on Italian companies.

PlayPraetor infects over 11,000 devices

A newly discovered Android RAT named PlayPraetor has infected over 11,000 devices, primarily targeting users in Portugal, Spain, France, Morocco, Peru, and Hong Kong. This malware exploits Android's accessibility services to gain remote control and can overlay fake login screens on nearly 200 banking apps and cryptocurrency wallets, facilitating account hijacking. PlayPraetor is distributed through fraudulent Google Play Store pages and Meta Ads, tricking users into downloading malicious APKs. It operates under a Chinese C2 panel and features five variants, each with distinct functionalities, including phishing and full device control. The malware establishes a bidirectional communication channel with its C2 server, allowing real-time commands and data theft, while also livestreaming the infected device's screen. 

Plague: New Linux backdoor discovered

A new Linux backdoor, dubbed Plague, has been identified by cybersecurity researchers, having evaded detection for over a year. This malicious Pluggable Authentication Module (PAM) allows attackers to bypass system authentication and gain persistent SSH access without raising alarms. Plague features static credentials for covert access and employs advanced techniques to resist analysis, such as anti-debugging and string obfuscation. It enhances its stealth by erasing evidence of SSH sessions, manipulating environment variables, and redirecting command logs to avoid detection. Multiple samples of this malware have been uploaded to VirusTotal since July 2024, indicating ongoing development by unknown threat actors.

Top Vulnerabilities Reported in the Last 24 Hours

MediaTek patches multiple bugs

MediaTek's Product Security Bulletin reveals multiple vulnerabilities in its chipsets used in smartphones and IoT devices. It includes CVE-2025-20696, a high-severity out-of-bounds write vulnerability in the Download Agent. This flaw requires physical access and user interaction but no elevated execution privileges. CVE-2025-20697, another out-of-bounds write vulnerability in Power HAL, allows privilege escalation or arbitrary code execution. It requires System-level privileges but no user interaction. This affects Android 14.0 and 15.0 devices. CVE-2025-20698 impacts a broader range of chipsets, including legacy and high-performance models. It does not require user interaction and affects Android 13.0, 14.0, and 15.0 devices.

HashiCorp vulnerability allows code execution

HashiCorp disclosed a critical vulnerability (CVE-2025-6000, HCSEC-2025-14) in its Vault products, allowing privileged operators to execute arbitrary code on the host machine. The flaw impacts Vault Community Edition versions 0.8.0 to 1.20.0 and various Vault Enterprise versions, but excludes HashiCorp’s managed HCP Vault Dedicated service due to enhanced security boundaries. Exploitation requires write permissions to the sys/audit endpoint and involves manipulating file audit device functionality and plugin directories. HashiCorp released patches for affected versions (e.g., Vault Community Edition 1.20.1, Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23) and implemented security enhancements to mitigate risks.

Top Scams Reported in the Last 24 Hours

Link-wrapping services abused for phishing

Attackers are leveraging link-wrapping services from companies like Proofpoint and Intermedia to disguise phishing links aimed at stealing Microsoft 365 login credentials. By compromising email accounts protected by these services, they are able to create seemingly legitimate URLs that redirect victims to phishing pages. The attackers employed techniques such as URL shortening and fake notifications, including alerts for voicemail or shared Microsoft Teams documents, to entice users into clicking the malicious links. Once clicked, these links lead to fraudulent Microsoft Office 365 login pages designed to harvest user credentials. This method of exploiting link-wrapping features represents a new tactic in the evolving landscape of phishing attacks.