A spyware campaign targeting Russian industrial firms has been quietly escalating since mid-2024. Batavia spreads through phishing emails disguised as contract requests. Later stages drop Delphi-based malware that shows fake documents while harvesting data, followed by a payload that broadens file collection and ensures persistence, with signs of a potential fourth stage.

A new ransomware group named BERT is hitting victims across sectors and operating systems. Targeting both Windows and Linux, BERT launches fast, multi-threaded encryption attacks. The malware shuts down critical services and shares code similarities with REvil and Babuk, hinting at recycled tools and techniques.

SAP has released patches for 27 vulnerabilities, seven of them critical. The most severe, with a CVSS score of 10.0, affects the Live Auction Cockpit in SAP SRM. Other high-impact bugs include a code injection flaw in SAP S/4HANA and insecure deserialization issues in NetWeaver. Updates also address privilege escalation flaws in the SAPCAR utility.

Top Malware Reported in the Last 24 Hours

New Batavia spyware targets Russian orgs

A new spyware called Batavia has been targeting Russian industrial enterprises via phishing emails since July 2024, intensifying in early 2025. The phishing emails contain links disguised as contract attachments, downloading a malicious Visual Basic Encoded script (.VBE) file that profiles the system and sends data to a C2 server. The second stage deploys Delphi-based malware, which displays fake contracts while collecting system logs, documents, and screenshots, exfiltrating data to a separate server. The third-stage payload, 'javav.exe,' expands data collection to include additional file types, adds a startup shortcut for persistence, and potentially leads to a fourth payload ('windowsmsg.exe').

SEO poisoning campaign drops Oyster malware

A recent SEO poisoning campaign has targeted over 8,500 small and medium-sized business users by delivering malware disguised as popular tools like PuTTY and WinSCP. This campaign utilizes a known malware loader called Oyster, which installs a backdoor upon execution. Cybercriminals employ black hat SEO techniques to manipulate search results, directing victims to malicious websites that deliver various malware, including Vidar and Lumma Stealers. The campaign exploits AI-related keywords to enhance its reach, while also hijacking tech support searches for major brands, misleading users with fake phone numbers. Additionally, threat actors spread malware through deceptive ads on social media and fake websites impersonating legitimate services, facilitating the theft of sensitive information and targeting cryptocurrency wallets. 

New BERT ransomware group emerges

BERT is a newly emerged ransomware group targeting Windows and Linux platforms, with confirmed victims primarily in healthcare, technology, and event services across Asia, Europe, and the U.S. BERT employs PowerShell-based loaders and privilege escalation techniques to execute concurrent file encryption. The group’s Windows variant features straightforward code that terminates critical processes and encrypts files using AES, while the Linux variant operates with up to 50 threads for rapid encryption and can forcibly shut down ESXi virtual machines to hinder recovery efforts. BERT ransomware group may have derived code from REvil and Babuk ransomware, showcasing overlaps in tactics and tools.

Top Vulnerabilities Reported in the Last 24 Hours

CISA adds 4 bugs to KEV catalog

The CISA added four critical vulnerabilities to its KEV catalog due to confirmed active exploitation. These vulnerabilities include a buffer overflow in Multi-Router Looking Glass (CVE-2014-3931), a command injection flaw in PHPMailer (CVE-2016-10033), a path traversal issue in Ruby on Rails (CVE-2019-5418), and a Server-Side Request Forgery vulnerability in Zimbra (CVE-2019-9621). Notably, CVE-2019-9621 has been linked to a China-based threat actor known as Earth Lusca. Additionally, the Citrix NetScaler ADC vulnerability (CVE-2025-5777), known as Citrix Bleed 2, has also been confirmed as actively exploited, allowing attackers to access sensitive data through memory leaks.

SAP patches 27 flaws

SAP released critical security updates addressing 27 vulnerabilities across its software portfolio, with seven classified as critical. The most severe, CVE-2025-30012, affects the Live Auction Cockpit component of SAP Supplier Relationship Management and has a maximum CVSS score of 10.0. Other critical vulnerabilities include CVE-2025-42967, a code injection flaw in SAP S/4HANA, and several insecure deserialization issues in SAP NetWeaver components, all scoring 9.1 on the CVSS scale. Additionally, vulnerabilities in the SAPCAR utility, such as privilege escalation and directory traversal, were patched.