Cyware Daily Threat Intelligence, August 13, 2025

Lurking in the shadows since mid-2024, the Curly COMrades group is weaving a web of cyber-espionage across Georgia’s government and Moldova’s energy sector. Their weapon, MucorAgent, uses AES-encrypted PowerShell scripts and hijacked COM objects to slip past defenses, employing erratic scheduled tasks and legitimate remote tools to steal credentials.

Microsoft’s August 2025 Patch Tuesday dropped a hefty fix for 111 vulnerabilities, including a zero-day Kerberos flaw that’s raising alarms. Dubbed BadSuccessor, this privilege escalation bug allows attackers with sufficient access to hijack Active Directory domains via Managed Service Accounts.

A slick phishing campaign is hitting UK organizations hard, masquerading as the Home Office to swipe Sponsorship Management System credentials. Using urgent emails to lure victims to fake login pages, attackers are raking in £15,000 to £20,000 per scam through fake job offers and visa fraud.

Top Malware Reported in the Last 24 Hours

XZ-Utils backdoor found in Docker Hub images

Over 35 Linux images on Docker Hub still contain the XZ-Utils backdoor. This backdoor, embedded in the liblzma.so library of the xz-utils compression tool, enables attackers to bypass SSH authentication and execute commands as root. The malicious code was injected by a contributor and included in official packages for major Linux distributions like Debian and Fedora. Despite its discovery, many of these compromised images remain publicly accessible on Docker Hub.

Curly COMrades group uses new backdoor

Curly COMrades, a cyber-espionage group active since mid-2024, targets government and judicial organizations in Georgia and energy firms in Moldova. They deploy a sophisticated malware known as MucorAgent, a three-stage .NET backdoor that utilizes AES-encrypted PowerShell scripts and hijacks COM objects for stealthy operations. The group employs various persistence mechanisms, including erratic scheduled tasks and legitimate remote monitoring tools, to maintain access to compromised systems. Their activities focus on credential theft, attempting to extract sensitive data from domain controllers and LSASS memory. 

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft August 2025 Patch Tuesday

Microsoft's August 2025 Patch Tuesday addressed 111 security vulnerabilities, including a significant zero-day flaw in Windows Kerberos (CVE-2025-53779), known as BadSuccessor. This privilege escalation vulnerability allows attackers with sufficient access to compromise Active Directory domains by misusing delegated Managed Service Accounts. Among the critical issues patched are vulnerabilities in Azure OpenAI, GDI+, and Windows Graphics Components, with some rated as high as CVSS 10.0. Additionally, an NTLM hash disclosure vulnerability (CVE-2025-50154) enables attackers to extract sensitive credentials without user interaction, posing a serious risk even on fully patched systems. 

Adobe Patch Tuesday patches 60 bugs

Adobe has released security patches for over 60 vulnerabilities across 13 software products as part of its August 2025 Patch Tuesday update. This extensive update addresses critical issues, including arbitrary code execution, DoS, and privilege escalation. Notable fixes target Adobe Commerce, which had multiple critical vulnerabilities affecting versions 2.4.8‑p1 and earlier, and the Substance 3D product line, where heap-based buffer overflows posed significant risks. Additionally, Adobe Illustrator, Photoshop, Animate, InDesign, and FrameMaker received critical patches for various vulnerabilities, including out-of-bounds writes and memory leaks. 

Top Scams Reported in the Last 24 Hours

Phishing campaign mimics UK Home Office

An active phishing campaign is targeting UK organizations licensed to sponsor foreign workers and students by impersonating the Home Office. This sophisticated scheme aims to compromise the Sponsorship Management System (SMS) credentials of these organizations, facilitating various immigration fraud and extortion attempts. Attackers have been observed charging victims between £15,000 and £20,000 for fake job offers and visa sponsorships. The campaign begins with emails containing urgent alerts that direct users to fraudulent login pages, closely mimicking the official SMS interface. Once the attackers capture the credentials, they engage in monetization schemes, including selling access to compromised accounts and creating fake visa documents.