Cyware Daily Threat Intelligence, August 14, 2025

A crafty malvertising campaign is slipping PS1Bot into systems through deceptive compressed archives. With techniques like environmental polling and dynamic C# DLL compilation, PS1Bot evades detection while siphoning off passwords and cryptocurrency wallet data, echoing tactics of Skitnet and AHK Bot.

Crypto24 is striking high-profile organizations with surgical precision, blending legitimate IT tools like PSExec and AnyDesk with custom malware to devastating effect. Targeting sectors from finance to entertainment across Asia, Europe, and the U.S., this ransomware group uses privileged accounts and scheduled tasks to maintain stealthy persistence.

Fortinet is sounding the alarm on a critical FortiSIEM vulnerability that’s already being exploited in the wild with circulating exploit code. Rated 9.8 on CVSS, this remote unauthenticated command injection flaw allows attackers to execute unauthorized commands via crafted CLI requests.

Top Malware Reported in the Last 24 Hours

CrossC2 expands Cobalt Strike to Linux

CrossC2 is an unofficial tool developed to enhance Cobalt Strike Beacon's capabilities for Linux and macOS platforms, facilitating cross-platform attacks. It operates by employing anti-analysis techniques, such as string encoding and junk code insertion, while utilizing AES128-CBC for configuration data decryption. The execution process involves ReadNimeLoader, which sideloads DLLs to decrypt and run malware payloads in memory. This loader incorporates various anti-debugging measures and uses AES256-ECB for payload decryption. The campaign has been linked to the BlackBasta group, evidenced by shared domains and tools. Attackers also utilized PsExec, Plink, and SystemBC for lateral movement and privilege escalation.

Malicious JavaScript injects iframe on WordPress

A recent malware campaign has been targeting WordPress websites by injecting a fullscreen iframe that loads content from suspicious external domains. The malicious script, embedded in the WordPress database via the WPCode plugin, employs advanced evasion techniques such as anti-debugging and console method overrides to conceal its activities. This malware specifically targets Windows users, displaying the iframe selectively to avoid detection. Users are misled into executing a disguised PowerShell command that downloads and runs a remote HTML file, putting their systems at risk.

Malvertising campaign leads to PS1Bot malware

A malvertising campaign has been observed distributing PS1Bot, a multi-stage malware framework implemented in PowerShell and C#. This malware features a modular design, enabling various malicious activities such as information theft, keylogging, and establishing persistent access on infected systems. PS1Bot minimizes artifacts by executing modules in memory, avoiding disk writes. Victims are initially delivered a compressed archive containing a downloader script, which retrieves additional payloads from attacker-controlled servers. The malware can exfiltrate sensitive information, including passwords and cryptocurrency wallet data, through various modules. It uses techniques like environmental polling and dynamic compilation of C# DLLs to enhance its capabilities and evade detection, showcasing significant overlaps with previous malware families like Skitnet and AHK Bot.

Crypto24 ransomware exploits legitimate tools

Crypto24 is a sophisticated ransomware group that skillfully combines legitimate IT tools with custom malware to execute stealthy multi-stage attacks on high-profile organizations across Asia, Europe, and the U.S.. By targeting sectors such as financial services, manufacturing, entertainment, and technology, they maintain persistence through privileged account creation and scheduled tasks that integrate malicious activities with normal operations. Their arsenal includes tools like PSExec and AnyDesk for lateral movement, alongside advanced evasion techniques to bypass security measures. Data theft is facilitated through keyloggers and Google Drive for exfiltration, demonstrating the group’s ability to blend in with regular IT operations while executing precision attacks.

Top Vulnerabilities Reported in the Last 24 Hours

Fortinet warns of critical FortiSIEM flaw

Fortinet has issued a warning regarding a critical remote unauthenticated command injection vulnerability in FortiSIEM, tracked as CVE-2025-25256, which has exploit code actively circulating in the wild. This flaw, rated 9.8 on the CVSS scale, affects multiple versions of FortiSIEM, allowing attackers to execute unauthorized commands through crafted CLI requests. While Fortinet did not confirm the flaw as a zero-day, they acknowledged the existence of functional exploit code. Additionally, the company noted that exploitation does not leave distinctive indicators of compromise, complicating detection efforts.

CISA adds new vulnerabilities to KEV catalog

The CISA has added two vulnerabilities affecting the N-able N-central platform to its KEV catalog, indicating active exploitation. The vulnerabilities, CVE-2025-8875 and CVE-2025-8876, involve an insecure deserialization flaw that could lead to command execution and a command injection vulnerability due to improper input sanitization. Both vulnerabilities require authentication to exploit. N-able has addressed these issues in recent updates, urging users to ensure their systems are upgraded to the latest versions. In addition, CISA has included older vulnerabilities from Microsoft Internet Explorer and Office Excel in the KEV catalog.