Cyware Daily Threat Intelligence, August 22, 2025

Masquerading as an Australian electronics store, Cookie Spider’s malvertising campaign unleashed the AMOS malware on over 300 targets. From June to August, victims were tricked into running commands that installed SHAMOS, a variant stealing passwords, Keychain data, and crypto wallet details.

Berserk Bear hackers are wielding a seven-year-old Cisco flaw to infiltrate global critical infrastructure. Exploiting CVE-2018-0171, these FSB-linked attackers trigger device reloads and use custom SNMP tools and SYNful Knock implants to harvest configurations and maintain covert access.

Posing as Rothschild & Co recruiters, MuddyWater APT is targeting CFOs with spear-phishing finesse. Using Firebase-hosted phishing pages and custom CAPTCHAs, they deploy VBS scripts and ZIPs to install NetBird and OpenSSH, ensuring persistent access to compromised systems worldwide.

Top Malware Reported in the Last 24 Hours

New atomic macOS stealer campaign targets hundreds

Between June and August, over 300 entities were targeted in a malvertising campaign utilizing the Atomic macOS Stealer (AMOS) by the cybercrime group Cookie Spider. Victims were lured into executing malicious commands that fetched a Bash script, enabling the installation of a variant called SHAMOS. This malware conducted reconnaissance and data theft, searching for sensitive information such as passwords, Keychain data, and cryptocurrency wallet details, which it exfiltrated to remote servers in ZIP archives. The campaign, which spanned multiple countries but excluded Russia, cleverly impersonated a legitimate Australian electronics store to bypass security measures. 

Insights into the CORNFLAKE.V3 backdoor

CORNFLAKE.V3 is a sophisticated backdoor malware linked to the threat groups UNC5518 and UNC5774, which exploit compromised websites to deliver malicious payloads. Since June 2024, UNC5518 has been using deceptive techniques, such as fake CAPTCHA pages, to lure users into executing downloader scripts that facilitate malware infections. CORNFLAKE.V3, which supports various payload types including executables and DLLs, establishes persistence through registry Run keys and communicates with its command-and-control server via HTTP. The malware conducts extensive reconnaissance, including Active Directory enumeration and credential harvesting through Kerberoasting, thereby enabling lateral movement within networks. 

Top Vulnerabilities Reported in the Last 24 Hours

Russian hackers abuse Cisco bug

Russian hackers linked to the FSB are exploiting a seven-year-old vulnerability (CVE-2018-0171) in Cisco devices, to target critical infrastructure globally. This flaw allows unauthenticated attackers to remotely trigger device reloads, potentially causing DoS conditions or executing arbitrary code. Over the past year, the FBI has observed these hackers collecting configuration files from thousands of networking devices associated with U.S. entities and modifying them for unauthorized access. The group, known as Berserk Bear, has previously targeted various government and aviation networks. The attackers are employing custom SNMP tools and the SYNful Knock firmware implant to maintain long-term access and evade detection, indicating a significant ongoing threat to vulnerable systems.

Commvault fixes critical remote code flaws

Commvault has released updates to address four significant vulnerabilities that could allow remote code execution on affected instances. Discovered by researchers from watchTowr Labs, these vulnerabilities include issues with unauthenticated API calls, exploitation of default credentials during installation, path traversal that enables unauthorized file access, and insufficient input validation allowing command-line manipulation. The vulnerabilities are identified as CVE-2025-57788, CVE-2025-57789, CVE-2025-57790, and CVE-2025-57791, with CVSS scores ranging from 5.3 to 8.7. Two pre-authenticated exploit chains can be constructed using these flaws, which pose a risk if the built-in admin password remains unchanged since installation.

Top Scams Reported in the Last 24 Hours

MuddyWater APT targets CFOs with phishing

MuddyWater APT is executing a sophisticated spear-phishing campaign aimed at CFOs and finance executives worldwide. This campaign employs social engineering tactics, including impersonating a Rothschild & Co recruiter, to lure victims to Firebase-hosted phishing pages featuring custom CAPTCHA challenges. Attackers utilize multi-stage payload delivery methods, incorporating malicious VBS scripts and ZIP archives to install legitimate remote-access tools like NetBird and OpenSSH, ensuring persistent access to compromised systems. The investigation revealed a shift in infrastructure from 192.3.95.152 to 198.46.178.135, with multiple hosting paths observed.