Cyware Daily Threat Intelligence, August 19, 2025

With a diplomat’s charm, malicious emails are smuggling XenoRAT into South Korea’s embassies via GitHub traps. Since March, this spearphishing spree has targeted European missions, using password-protected ZIPs to unleash a trojan that snatches data and grants attackers remote control.

A Windows flaw is opening the door for RansomExx to wield PipeMagic like a digital skeleton key. This vulnerability lets Storm-2460 deploy a backdoor through fake ChatGPT apps, targeting IT and finance sectors with stealthy, encrypted remote access.

Unpatched N-able N-central servers are sitting ducks for hackers exploiting two critical flaws. These vulnerabilities enable unauthorized command execution, spurring CISA to list them in its KEV Catalog with a federal patching deadline of August 20.

Top Malware Reported in the Last 24 Hours

XenoRAT targets embassies in South Korea

A state-sponsored espionage campaign is targeting foreign embassies in South Korea with XenoRAT malware, delivered through malicious GitHub repositories. Since March, at least 19 spearphishing attacks have been launched, primarily against European embassies, using sophisticated email lures that include fake meeting invitations and official correspondence. The attackers employed password-protected ZIP files from cloud storage services, containing disguised .LNK files that execute PowerShell code to retrieve the malware. XenoRAT is a powerful trojan capable of logging keystrokes, capturing screenshots, accessing webcams, and facilitating remote operations.

Android malware targets users with scams

An active Android phishing campaign is targeting Indian users by impersonating a government electricity subsidy service. Attackers lure victims into downloading a malicious app through YouTube videos and a phishing website that mimics an official government portal. Once installed, the app masquerades as a “security update” and requests aggressive permissions to access contacts and SMS messages. It steals sensitive financial information, including UPI credentials, by directing users to fake payment forms. The malware can also send phishing messages to the victim's contacts and is remotely controlled via Firebase.

Microsoft Windows vulnerability exploited by PipeMagic

Cybersecurity researchers have uncovered the exploitation of a privilege escalation vulnerability in Microsoft Windows, identified as CVE-2025-29824, to deploy the PipeMagic malware in RansomExx ransomware attacks. This malware, which first emerged in 2022, acts as a sophisticated backdoor, allowing remote access and command execution on compromised systems. The exploitation involves a combination of techniques, including the use of a fake OpenAI ChatGPT app and DLL hijacking, to deliver the malware. PipeMagic operates through a modular architecture, utilizing named pipes for encrypted communication and enabling attackers to maintain control over infected hosts. Targeting various sectors across the globe, including IT and finance, the malware has shown persistence and adaptability, indicating ongoing development by the threat actor known as Storm-2460.

Top Vulnerabilities Reported in the Last 24 Hours

800+ N-able servers remain unpatched 

Over 800 N-able N-central servers remain unpatched against two critical vulnerabilities, CVE-2025-8875 and CVE-2025-8876, which are actively being exploited. These flaws allow authenticated attackers to execute commands through improper sanitization of user input and insecure deserialization. N-able has released a patch in version 2025.3.1 and urged administrators to update their systems promptly. The Shadowserver Foundation reported that 880 vulnerable servers are primarily located in the U.S., Canada, and the Netherlands, with around 2,000 N-central instances exposed online. In response to the situation, CISA added these vulnerabilities to its KEV Catalog and mandated federal agencies to patch their systems by August 20, 2025.

CISA adds Trend Micro bug to KEV catalog

The CISA added two critical vulnerabilities in Trend Micro Apex One, tracked as CVE-2025-54948 and CVE-2025-54987, to its KEV catalog due to active exploitation in the wild. These vulnerabilities allow pre-authenticated remote attackers to upload malicious code and execute commands via the Apex One Management Console. Trend Micro confirmed that both flaws, which share similar characteristics but target different CPU architectures, have been exploited in real-world attacks. The vulnerabilities have a high CVSS score of 9.4, prompting urgent attention from organizations, particularly those with exposed management consoles. Federal agencies are required to address these vulnerabilities by September 8, in compliance with Binding Operational Directive 22-01.