Cyware Daily Threat Intelligence

Cyware Daily Threat Intelligence August 09, 2018 - Featured Image

Daily Threat Briefing • August 9, 2018

Top Malware Reported in the Last 24 Hours

**WannaCry responsible for TSMC breach
**Chipmaker TSMC acknowledged that the ransomware that shut down its plants was, in fact, WannaCry. The ransomware caused disruption after making its way onto these unpatched Windows 7 machine. TSMC recovered its operational abilities a few days after the WannaCry ransomware infected its networks.

**DeepLocker - The AI-powered malware
** Security experts at IBM have created the next-generation of cyberthreats - an AI-powered malware that comes packed with advanced detection-evading capabilities. The malware can identify targets via facial and voice recognition, as well as geolocation. DeepLocker is also capable of functioning as a nation-state malware, infecting millions of systems while remaining completely undetected.

Related Threat Briefings

May 20, 2025

Cyware Daily Threat Intelligence, May 20, 2025

A fake KeePass build is more than just a phony password manager. Promoted as a legitimate KeePass installer and spread via Bing ads, KeeLoader steals passwords and establishes Cobalt Strike beacons linked to UNC4696, an IAB known for working with Black Basta and BlackCat/ALPHV affiliates. Broadcom just plugged a string of VMware bugs. The company issued security patches for four vulnerabilities across ESXi, vCenter Server, Workstation, and Fusion. The most critical (CVE-2025-41225) scores an 8.8 CVSS and lets privileged users execute arbitrary commands on vCenter. Microsoft Outlook users are in the crosshairs again. A new campaign is abusing the W3LL phishing kit to steal Microsoft 365 credentials via adversary-in-the-middle techniques. This PhaaS toolkit bypasses MFA by intercepting sessions and uses realistic login pages, often posing as Adobe, to fool victims. For detailed Cyber Threat Intel, click ‘Read More’.

May 19, 2025

Cyware Daily Threat Intelligence, May 19, 2025

A Turkish phishing lure leads straight to SnakeKeylogger. The DBatLoader (aka ModiLoader) malware is making the rounds again - this time disguised as a Turkish bank email. Victims who open the fake attachment trigger a chain of BAT scripts, DLL sideloading, and obfuscated executables that ultimately deploy SnakeKeylogger. glibc gets an unexpected twist. A newly identified vulnerability in the GNU C Library affects how static setuid binaries interact with shared libraries, specifically through improper use of LD_LIBRARY_PATH. While no known software currently exploits this bug, developers are urged to patch or update glibc to avoid potential abuse in custom or legacy applications. A quiet wave of phishing hits Kuwait. An ongoing campaign is targeting telecom, insurance, and fisheries sectors across the country, using hundreds of domains to impersonate familiar brands. The operation cleverly masks itself with lookalike domains and fake mobile payment portals, siphoning off sensitive data.

May 16, 2025

Cyware Daily Threat Intelligence, May 16, 2025

Procolored’s software downloads came bundled with more than just printer drivers. Researchers uncovered two embedded threats: SnipVex and XRedRAT. One BTC wallet linked to the malware racked up over $100,000, with infections traced back to nearly 40 compromised executables. A jailbreak enabler reemerges from the patch notes. An iOS kernel vulnerability fixed last year has resurfaced through a public proof-of-concept exploit. The flaw allows unsigned apps to escalate privileges, potentially fueling future jailbreak chains. Devices running older OS versions remain at risk despite Apple’s tightened certificate validation. Criminals are now cloning voices with AI and using them to phish officials. The FBI warns of deepfake audio-driven vishing campaigns impersonating senior U.S. figures to access sensitive accounts. These attacks often begin with smishing texts and evolve into sophisticated voice calls, combining stolen credentials and social engineering to extract more valuable data.

May 15, 2025

Cyware Daily Threat Intelligence, May 15, 2025

TransferLoader doesn’t just sneak in, it evolves. Active since early 2025, this modular loader combines a downloader, backdoor loader, and backdoor into one stealthy package. It uses anti-analysis tricks, dynamic C2 updates via IPFS, and has already been linked to Morpheus ransomware deployments. Once inside, it enables arbitrary command execution and long-term persistence. Two ransomware gangs, BianLian and RansomExx, are now exploiting the same SAP NetWeaver vulnerability as Chinese APTs. Using CVE-2025-31324, the attackers deliver PipeMagic alongside privilege escalation flaws like CVE-2025-29824. Infrastructure links tie the activity to BianLian, with payloads deployed via web shells and C2 managed through Brute Ratel and inline assembly. Fancy Bear is broadening its reach. Operation RoundPress shows the group leveraging XSS zero-days to breach webmail platforms. Its spearphishing campaigns use malicious JavaScript to deploy SpyPress variants aimed at stealing credentials and exfiltrating emails, often bypassing 2FA in the process. Targets span government and defense sectors from Eastern Europe to South America.

May 14, 2025

Cyware Daily Threat Intelligence, May 14, 2025

Swan Vector is the latest addition to a string of APT campaigns zeroing in on East Asia’s research and engineering sectors. Seqrite Labs uncovered the group’s four-stage malware chain, beginning with a malicious LNK in a ZIP archive and culminating in Cobalt Strike deployment. A PowerShell script posing as a helpful utility is the entry point for Chihuahua Stealer. This .NET-based info-stealer uses scheduled tasks for persistence and grabs browser credentials and crypto wallet data. It compresses the loot, encrypts it, and exfiltrates over HTTPS - all while cleaning up traces. Microsoft’s latest Patch Tuesday addresses 78 vulnerabilities, including five zero-days actively exploited in the wild. Among the critical flaws is a CVSS 10 bug in Azure DevOps Server. The CISA has flagged these vulnerabilities as high priority for federal agencies, emphasizing risks around memory corruption and privilege escalation. SAP’s NetWeaver platform is now at the center of a global cyber campaign. Chinese APT groups have been exploiting CVE-2025-31324 to gain remote code execution via unauthenticated file uploads, targeting over 580 systems. Victims span energy, utilities, and government sectors, with attackers using tools like SNOWLIGHT and KrustyLoader. For detailed Cyber Threat Intel, click ‘Read More’.

May 13, 2025

Cyware Daily Threat Intelligence, May 13, 2025

APT37 is back with another Dropbox-powered espionage play. In Operation: ToyBox Story, the North Korean group used fake national security event invites to deliver RoKRAT malware via ZIP archives. The campaign abused Dropbox for both delivery and command-and-control, using .lnk files to initiate multi-layer encrypted data exfiltration. Apple’s May security update patches multiple critical flaws affecting iOS and macOS. These include code execution bugs in AppleJPEG and CoreMedia, and multiple WebKit vulnerabilities exploitable via crafted media. Affected users should apply the update to avoid potential memory corruption and privilege escalation. Marbled Dust, a Turkish-aligned threat group, exploited a zero-day in the Output Messenger app to spy on Kurdish military networks. CVE-2025-27920, a directory traversal vulnerability, enabled access to sensitive data, even after a patch was released. The group used DNS hijacking, typo-squatted domains, and backdoor implants to maintain long-term access.

May 12, 2025

Cyware Daily Threat Intelligence, May 12, 2025

Not every AI tool on Facebook is what it claims to be. Threat actors are luring users with fake content-generation apps, pushing Noodlophile malware to tens of thousands of victims. Disguised as AI-powered services, these tools trick users into executing malicious files that steal browser credentials, crypto wallet data, and other sensitive information through a layered infection chain. OtterCookie is getting smarter with every version. The North Korea-linked group WaterPlum is actively using the malware to breach financial institutions and crypto platforms worldwide. Since late 2024, new iterations have added capabilities like credential theft from browsers and file uploads - each version revealing signs of modular development and distinct authorship. A flaw in Linux’s nftables is turning dirty sets into dangerous ones. A critical double-free vulnerability allows local attackers to escalate privileges by exploiting memory corruption. Kernel-level fixes are already rolling out to improve cleanup routines and patch the vulnerable destroy path.

May 9, 2025

Cyware Daily Threat Intelligence, May 09, 2025

Old routers are becoming cybercrime goldmines. The FBI has warned that end-of-life routers are being hijacked with malware like TheMoon and sold on proxy networks such as 5Socks and Anyproxy. These compromised devices are used for crypto theft, cybercrime-as-a-service, and even espionage. Meanwhile, Chaya_004 is exploiting SAP systems on a global scale. The Chinese threat group was found exploiting CVE-2025-31324, a critical flaw in SAP NetWeaver, to gain remote code execution. Their campaign has hit hundreds of organizations globally, leveraging a Golang-based shell named SuperShell and tools hosted on Chinese cloud platforms in a coordinated effort. Phishing pages are climbing the search results and duping users. The FreeDrain campaign is using SEO poisoning and free-tier platforms like GitBook and Webflow to host fake wallet interfaces that harvest seed phrases. Over 38,000 phishing subdomains have been linked to this large-scale crypto scam, believed to originate from India and powered by generative AI. For detailed Cyber Threat Intel, click ‘Read More’.

May 8, 2025

Cyware Daily Threat Intelligence, May 08, 2025

COLDRIVER’s latest malware, LOSTKEYS, is now in play. The Russian state-backed group is deploying this tool to steal files and system data from advisors, journalists, NGOs, and individuals linked to Ukraine. Delivered via ClickFix, LOSTKEYS expands COLDRIVER’s toolkit beyond credential phishing, signaling a continued focus on espionage and document theft. SysAid users, it’s time to patch. Multiple vulnerabilities—ranging from XXE to OS command injection—have been fixed in version 24.4.60. Researchers uncovered the flaws and even released a PoC, warning that 77 unpatched instances remain exposed online. Given SysAid’s large user base, the window for exploitation remains a real concern. A clever lure is fueling a quiet takeover in Brazil. Cisco Talos uncovered a campaign abusing the country’s electronic invoicing system to trick victims into installing remote monitoring tools. The attackers use free trials of RMM products to hijack machines, often targeting high-level accounts in finance, education, and government.

May 7, 2025

Cyware Daily Threat Intelligence, May 07, 2025

Agenda’s playbook just got upgraded. The ransomware group has added two new tools: SmokeLoader and a stealthy .NET-based loader called NETXLOADER. The latter leverages techniques like JIT hooking and AES decryption to deploy ransomware and loaders directly into memory, while SmokeLoader injects payloads into explorer.exe using anti-analysis tricks. In a different vein, a bogus debugging package was found duping Discord bot developers. The malicious PyPI package ‘discordpydebug,’ posing as a helpful tool, is designed to steal data and execute commands. Downloaded over 11,500 times, it exploited community trust, mirrored by over 45 npm lookalikes in what appears to be a broader campaign. AWS patched a critical bug in Amplify Studio version 2.20.3. CVE-2025-4318 allowed attackers to inject JavaScript into UI components during render time via the amplify-codegen-ui package. No active exploitation was detected.

May 6, 2025

Cyware Daily Threat Intelligence, May 06, 2025

Mamona isn’t calling home but it’s still locking you out. This offline ransomware strain skips data theft and C2 communication altogether, instead encrypting files using its own cryptographic routines. Though it avoids detection through network monitoring, a working decryption tool is already available for victims. Google’s latest Android update delivers fixes for around 50 vulnerabilities, including a critical zero-day in FreeType, which was already under active attack. The patch batch covers issues across Android OS, MediaTek, Qualcomm, Wear OS, and Automotive OS, reinforcing security across a wide device ecosystem. CoGUI is fueling a phishing surge in Japan by spoofing trusted brands like Rakuten and PayPay. The kit uses geofencing and browser fingerprinting to narrow its targets, directing victims to convincingly faked login pages that siphon credentials and payment details with precision.

May 5, 2025

Cyware Daily Threat Intelligence, May 05, 2025

Corporate HR teams are the latest target in a spear-phishing spree by Venom Spider. Disguised as job applications, these emails deliver More_eggs backdoor, now upgraded with advanced features. The attack leverages advanced evasion tactics to slip past defenses and establish persistent access. A fresh batch of vulnerabilities from MediaTek could leave millions of devices open to attack. The most severe enables remote DoS via rogue base stations. Other flaws impact encryption, memory handling, and certificate validation across phones, tablets, and smart devices running Android 13 to 15. Luna Moth is back, and it's using helpdesk lookalikes to worm its way into corporate inboxes. The campaign spoofs trusted brands with phishing emails and fake domains, siphoning credentials and financial data. So far, 50 domains tied to this operation have been linked to breaches in legal, healthcare, and finance sectors.