Cyware Daily Threat Intelligence, August 20, 2025

Crafty attackers are slipping into cloud Linux systems through a critical Apache ActiveMQ flaw, unleashing DripDropper malware. Exploiting CVE-2023-46604, they use a password-protected payload to communicate via Dropbox, patch the vulnerability to block rivals, and tweak SSH settings for persistent root access.

Microsoft’s latest patches are racing to fix a recovery meltdown across Windows 10 and 11. Emergency updates address failures in reset and recovery operations caused by August 2025 patches, with new cumulative fixes released on August 19 to stabilize affected systems.

Fraudsters posing as celebrity podcast reps are reeling in business owners with a bait. This podcast imposter scam lures victims into tech-check calls that grant remote access, hijacking social media and risking corporate systems through shared passwords.

Top Malware Reported in the Last 24 Hours

Apache ActiveMQ flaw enables DripDropper

Threat actors are exploiting a critical vulnerability (CVE-2023-46604) in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy the DripDropper malware. This malware, which requires a password to run, communicates with an attacker-controlled Dropbox account, allowing for covert C2. After gaining access, the attackers patch the vulnerability to prevent further exploitation by others and to evade detection. They modify existing SSH configurations to enable root login, facilitating the installation of DripDropper, which alters system files to ensure persistence. 

North Korea exploits GitHub for cyberespionage

North Korean hackers used GitHub as a covert C2 platform in a cyberespionage campaign targeting diplomatic missions in South Korea between March and July. The campaign employed spear-phishing emails impersonating trusted diplomatic contacts, delivering malware via cloud solutions like Dropbox and Daum Cloud. Attackers used a Windows shortcut disguised as a PDF to execute PowerShell code, which fetched malware from GitHub and established persistence through scheduled tasks. The malware infrastructure included rapid payload rotation and cloud-based delivery methods to evade detection.

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft releases emergency Windows updates 

Microsoft has issued emergency out-of-band updates to address significant issues affecting Windows recovery and reset operations following the August 2025 security updates. These problems impact both Windows 10 and older versions of Windows 11, with specific updates causing failures during reset attempts and recovery processes. The affected updates include KB5063875 for Windows 11 and KB5063709 and KB5063877 for Windows 10. To resolve these issues, Microsoft released cumulative updates (KB5066189, KB5066188, and KB5066187) on August 19, 2025. These updates are available as optional downloads through Windows Update and the Microsoft Update Catalog. Additionally, Microsoft has addressed related update failures and errors experienced by users on Windows 11 24H2 systems.

Exploit targets SAP NetWeaver vulnerabilities

A new exploit has emerged that targets critical vulnerabilities in SAP NetWeaver, specifically CVE-2025-31324 and CVE-2025-42999, enabling authentication bypass and remote code execution. CVE-2025-31324 allows unauthenticated attackers to upload malicious files due to a missing authorization check, while CVE-2025-42999 involves insecure deserialization that can be exploited by privileged users. These vulnerabilities pose significant risks, including potential system compromise and data theft. The CISA has added these flaws to its KEV catalog, indicating their active exploitation in the wild.

Major password managers exposed to bugs

At DEF CON 33, security researcher Marek Tóth unveiled significant clickjacking vulnerabilities affecting several popular password managers, including 1Password, Bitwarden, LastPass, and others. These zero-day vulnerabilities enable attackers to steal sensitive information such as passwords, credit card details, and personal data when users visit malicious websites. Tóth demonstrated how these vulnerabilities exploit the browser-based plugins of these password managers, allowing hackers to manipulate user actions without their knowledge. 

Top Scams Reported in the Last 24 Hours

Beware of this new podcast scam

A new scam known as the podcast imposter scheme is targeting business owners and influencers, where fraudsters pose as representatives of fictional celebrity podcasts. Victims receive enticing emails inviting them to share their experiences for a $2000 compensation. Once they express interest, the scammers arrange a call to check their technology, which serves as a pretext to gain remote access to the victim's computer. This allows the criminals to hijack social media accounts and potentially compromise other accounts with the same passwords. The Better Business Bureau warns that this tactic is increasingly aimed at executives and specialists, making them vulnerable entry points into corporate systems for cybercriminals.