Cyware Daily Threat Intelligence, August 25, 2025

Posing as a trusty antivirus app, Android.Backdoor.916.origin is giving Russia's FSB a backdoor into executives' devices. Disguised as a fake antivirus, this malware spreads via private messages, grabs extensive permissions, and uses Accessibility Service to steal chats and more.

APT36 is turning innocent Linux desktop files into espionage tools against India's government and defense sectors. Through phishing ZIPs with malicious .desktop files mimicking PDFs, they execute hidden bash commands to fetch Go-based ELF payloads.

Salesforce is plugging critical holes in Tableau Server and Desktop that could let attackers run wild with code execution. The top flaw, a 9.6 CVSS type confusion bug, enables local exploits on Windows and Linux, alongside upload vulnerabilities leading to path traversal and improper input validation issues.

Top Malware Reported in the Last 24 Hours

Android malware targets Russian executives

Android.Backdoor.916.origin is a sophisticated malware disguised as an antivirus application linked to Russia's FSB, specifically targeting business executives. This multifunctional backdoor allows attackers to execute commands, conduct surveillance, and steal sensitive information, including chats, browser data, and live audio/video streams. The malware is distributed through private messages under the guise of a legitimate security app named "GuardCB," which mimics real antivirus tools to avoid detection. Upon installation, it requests extensive permissions, granting attackers full control over the device. The malware exploits the Accessibility Service to log keystrokes and extract data from popular applications like Telegram and WhatsApp. 

APT36 exploits Linux files for malware

APT36 is targeting Indian government and defense entities by exploiting Linux .desktop files to install malware. They send phishing emails containing ZIP files with malicious .desktop files disguised as PDF documents. When users open these files, hidden bash commands execute, fetching hex-encoded payloads from the attackers' servers. The malware, a Go-based ELF executable, is designed for espionage and can establish persistence through cron jobs and systemd services. Additionally, the attackers use techniques to conceal their actions, such as launching a benign decoy PDF in Firefox to distract victims.

Malicious Go module steals SSH credentials

A malicious Go module, disguised as an SSH brute-force tool, has been discovered to exfiltrate credentials to a Telegram bot controlled by the attacker. Named "golang-random-ip-ssh-bruteforce," this module scans random IPv4 addresses for exposed SSH services on TCP port 22 and attempts to log in using a simplistic username-password list that includes common credentials like "root" and "admin." Notably, the module disables host key verification, allowing it to connect to any server without identity checks. Once a successful login occurs, the module sends the target IP address, username, and password to a hard-coded Telegram bot named "@sshZXC_bot." 

Top Vulnerabilities Reported in the Last 24 Hours

Critical vulnerabilities found in Tableau Server

Salesforce has addressed multiple critical vulnerabilities in Tableau Server and Desktop that could allow attackers to upload malicious files and execute arbitrary code. The most severe vulnerability, CVE-2025-26496, has a CVSS score of 9.6 and involves type confusion, enabling local code execution on both Windows and Linux systems. Other significant flaws include CVE-2025-26497 and CVE-2025-26498, which allow unrestricted file uploads with a CVSS score of 7.7, leading to absolute path traversal. Additionally, CVE-2025-52450 and CVE-2025-52451, both scoring 8.5, exploit improper pathname limitations and input validation issues.