Cyware Daily Threat Intelligence, August 27, 2025

The Underground ransomware gang is striking with precision, blending AES and RSA encryption to lock down global targets. After reconnaissance and breaches, they deploy customized malware that wipes shadow copies, blocks remote desktops, and selectively encrypts files using a stripe method for larger ones, sparing critical system folders.

Blind Eagle's shadow looms over Colombia, with five activity clusters unleashing RATs and phishing on government sectors from May 2024 to July 2025. Targeting judiciary, education, and healthcare, they impersonate agencies via spear-phishing to deliver Lime RAT and AsyncRAT, leveraging compromised emails and dynamic DNS for espionage and financial gains.

Citrix is sealing critical gaps in NetScaler ADC and Gateway, including a zero-day remote code execution flaw that's already under attack. This memory overflow bug affects Gateway configurations, urging immediate firmware updates, alongside fixes for denial-of-service and improper access control vulnerabilities.

Top Malware Reported in the Last 24 Hours

Underground ransomware goes global

The Underground ransomware gang has been conducting targeted attacks against various companies globally, including those in South Korea, since July 2023. Utilizing a sophisticated encryption process that combines random number generation, AES symmetric encryption, and RSA asymmetric encryption, the malware ensures that decryption is impossible without the corresponding RSA private key. The gang conducts thorough reconnaissance to select specific targets, breaching systems prior to deploying customized ransomware. By deleting shadow copies and restricting remote desktop connections, the malware prevents recovery efforts. It selectively encrypts files based on their size, employing a stripe method for larger files, while excluding certain folders and file types to avoid system damage. 

Blind Eagle targets Colombia with RATs

Cybersecurity researchers have identified five distinct activity clusters linked to the threat actor Blind Eagle, which has targeted Colombian government entities from May 2024 to July 2025. These attacks employed various tactics, including RATs and phishing lures, primarily aimed at local, municipal, and federal levels. Blind Eagle's operations reflect both cyber espionage and financially motivated activities, with significant focus on sectors such as judiciary, education, and healthcare. Attack chains often utilized spear-phishing emails impersonating government agencies to deliver malicious documents. The group leveraged compromised email accounts and dynamic DNS services to obscure their infrastructure. Notably, they employed well-known RATs like Lime RAT and AsyncRAT, indicating a persistent and evolving threat landscape in the region, with a majority of their activities concentrated in Colombia.

ESET warns against PromptLock

ESET has discovered PromptLock, the first AI-driven ransomware that utilizes OpenAI’s gpt-oss:20b model to generate and execute malicious Lua scripts for scanning, stealing, and encrypting files on multiple platforms, including Windows, Linux, and macOS. This ransomware employs the SPECK 128-bit encryption algorithm and has been identified as a work-in-progress, with a potential data destruction feature that has not yet been implemented. 

New malware targets Indonesia's pension fund

A new malware campaign is exploiting Indonesia's state pension fund, TASPEN, by deploying a malicious Android application disguised as an official portal. Targeting pensioners and civil servants, the banking trojan and spyware leverages legacy system vulnerabilities to steal sensitive data, including banking credentials and biometric information. The operation begins with a phishing website that tricks victims into downloading the APK, employing advanced evasion tactics to avoid detection. The malware, packed with DEX encryption, unpacks at runtime and uses various services to intercept one-time passwords and monitor user activity. Communication with command-and-control servers occurs through encrypted channels, indicating potential links to Chinese-speaking threat actors. This attack not only threatens individual financial security but also undermines public trust in Indonesia's digital ecosystem.

Top Vulnerabilities Reported in the Last 24 Hours

Citrix patches NetScaler RCE bug

Citrix patched three vulnerabilities in NetScaler ADC and Gateway, including CVE-2025-7775, a critical remote code execution flaw actively exploited as a zero-day vulnerability. CVE-2025-7775 is a memory overflow bug that enables unauthenticated remote code execution, with no available mitigations; Citrix urges immediate firmware updates. Vulnerable configurations include NetScaler devices set as Gateway or AAA virtual servers and certain IPv6-based load balancing configurations. Citrix also addressed two other vulnerabilities: CVE-2025-7776 (memory overflow causing denial of service) and CVE-2025-8424 (improper access control on the management interface).