Cyware Daily Threat Intelligence, August 08, 2025
Daily Threat Briefing • August 8, 2025
A new breed of EDR killer tool is arming multiple ransomware gangs with the power to silently disable security defenses. This heavily obfuscated binary, injected into legitimate applications, uses a signed driver with a random name to execute BYOVD attacks, terminating processes of major security tools. Shared among threat groups, its varied builds suggest a collaborative framework, amplifying its threat to compromised systems.
CISA is sounding the alarm with a tight deadline, urging federal agencies to patch a critical Microsoft Exchange vulnerability by Monday morning. Tracked as a high-risk flaw affecting Exchange Server 2016, 2019, and Subscription Edition, it allows attackers with on-premises admin access to breach cloud environments, potentially seizing full domain control.
GreedyBear is rewriting the playbook for crypto theft with a sprawling campaign that’s as bold as it is cunning. Deploying over 150 malicious Firefox extensions, 500 executables, and numerous phishing sites, the group uses Extension Hollowing to weaponize initially benign extensions for stealing wallet credentials. This highly organized operation runs from a centralized server, posing a major risk to users.
Top Malware Reported in the Last 24 Hours
11 malicious Go packages deliver malware
Socket identified 11 malicious Go packages, with 10 still live and 8 being typosquats, using obfuscated string routines to fetch and execute payloads from C2 domains. The packages silently spawn shells to download and execute bash scripts on Unix systems or executables on Windows systems, enabling attackers to compromise environments. Observed second-stage payloads enumerate host information, read browser data, and beacon outbound while evading sandbox detection via sleep commands. Examples of malicious packages include github.com/stripedconsu/linker and github.com/agitatedleopa/stm, which deobfuscate to malicious URLs still live. Attackers use certutil.exe and curl on Windows systems to download and execute malicious files, targeting browser credentials and local system data.
Malicious RubyGems in credential theft campaign
A RubyGems malware campaign involved 60 malicious packages posing as automation tools to steal credentials from social media and marketing users. The malicious gems exfiltrate credentials to threat actor-controlled servers, classifying them as infostealer. Many victims are grey-hat marketers using disposable identities for spam and synthetic engagement campaigns, allowing the malware to operate undetected. The campaign targets South Korean users with Korean-language interfaces and region-specific infrastructure. The campaign evolved with new aliases and infrastructure waves, maintaining redundancy and persistence.
New EDR killer tool used by 8 ransomware groups
A new EDR killer tool, an evolution of EDRKillShifter developed by RansomHub, has been identified in attacks by eight different ransomware gangs. This tool enables operators to disable security products on compromised systems, facilitating the deployment of ransomware without detection. It utilizes a heavily obfuscated binary that is injected into legitimate applications, searching for a digitally signed driver with a random name to execute a BYOVD attack. The malicious driver masquerades as a legitimate file, allowing it to terminate processes and services of various security tools, including those from major vendors like Microsoft Defender and Kaspersky. Evidence suggests that this tool is collaboratively developed among threat groups, with each attack employing different builds, indicating a shared framework rather than a single leaked binary.
Top Vulnerabilities Reported in the Last 24 Hours
CISA orders agencies to patch Exchange flaw
CISA has mandated that all FCEB agencies address a critical vulnerability in Microsoft Exchange, tracked as CVE-2025-53786, by Monday morning. This flaw affects Microsoft Exchange Server 2016, 2019, and the Subscription Edition, allowing attackers with administrative access to on-premises servers to attack cloud environments, potentially leading to complete domain compromise. The vulnerability exploits a shared trust relationship in hybrid configurations, making detection difficult, especially since cloud-based logging may not capture malicious activities originating from on-premises servers. This issue follows previous guidance and a hotfix released by Microsoft in April.
Threats in Spotlight in the Last 24 Hours
New coordinated campaign by GreedyBear
GreedyBear is a sophisticated cybercriminal group that has redefined large-scale crypto theft through a coordinated campaign involving over 150 malicious Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Utilizing a technique known as Extension Hollowing, the group initially uploads seemingly innocuous extensions to build user trust before weaponizing them to capture wallet credentials. Additionally, they distribute a variety of malicious Windows executables, including credential stealers and ransomware, primarily through cracked software sites. The campaign also features scam websites that impersonate legitimate crypto products, deceiving users into revealing sensitive information. All components of this operation are managed from a centralized server, indicating a well-organized infrastructure.