Cyware Daily Threat Intelligence, July 17, 2025

A persistent backdoor is giving UNC6148 quiet, long-term access to SonicWall SMA appliances. The group is using stolen credentials—and possibly a zero-day—to deploy OVERSTEP malware. It steals sensitive data, maintains stealth, and executes commands through web requests.

Over 600 malicious domains are distributing fake Telegram APKs to unsuspecting users. Most are hosted in China and exploit the Janus vulnerability in Android. These APKs request broad permissions, bypass security protocols, and enable full device control.

Oracle’s July 2025 patch update is a heavyweight. It includes 309 fixes across products like Communications, MySQL, Java SE, and Fusion Middleware. Of the nearly 200 CVEs addressed, 127 can be exploited remotely without authentication. An additional 20 Solaris patches target flaws with similar reach.

Top Malware Reported in the Last 24 Hours

Hackers abuse SonicWall SMA, drop malware

An ongoing campaign by the financially motivated threat actor UNC6148 targets SonicWall Secure Mobile Access (SMA) 100 series appliances. It exploits stolen credentials and deploying a persistent backdoor known as OVERSTEP. This malware modifies the boot process to ensure continuous access and conceal its presence while stealing sensitive data. Evidence suggests that UNC6148 may have exploited known vulnerabilities or a zero-day vulnerability to gain initial access. The campaign has been linked to data exfiltration and potential ransomware deployment, with overlaps observed in previous incidents involving Abyss-branded ransomware. OVERSTEP employs LD_PRELOAD hijacking to inject malicious code into system processes, allowing it to operate undetected and execute commands through web requests, further complicating detection efforts.

Matanbuchus 3.0 malware spreads via Teams

Hackers are using Microsoft Teams to distribute Matanbuchus 3.0 malware, a sophisticated MaaS loader. Delivery methods for the malware include phishing emails, compromised websites, and malvertising, often involving social engineering tactics like impersonating IT help desks via Microsoft Teams. The loader uses a renamed Notepad++ updater (GUP) and malicious DLL for sideloading attacks. Matanbuchus impersonates Skype Desktop traffic for sending encrypted data to its C2 server. The loader supports multiple next-stage capabilities, including MSI installation, process hollowing, CMD/PowerShell execution, and WQL queries.

Malicious Telegram APK campaign

Over 607 malicious domains were identified distributing fake Telegram APK files, linked to phishing and malware campaigns, primarily hosted in Chinese and registered via the Gname registrar. These domains use QR codes to redirect users to a phishing site (zifeiji[.]asia) that mimics Telegram’s appearance to distribute malicious APKs. The fake APKs exploit the Janus vulnerability in Android 5.0–8.0, allowing attackers to craft undetectable malicious applications. The APKs bypass secure protocols, request broad permissions, and execute remote commands, enabling data theft, surveillance, and device control. Typosquatted domains (e.g., “teleqram”, “telegramapp”) and malicious JavaScript files are used for tracking and promoting the fake apps, collecting user data for cybercriminal purposes.

Top Vulnerabilities Reported in the Last 24 Hours

Oracle releases critical patch update

Oracle's July 2025 CPU includes 309 patches, addressing approximately 200 unique CVEs, with 127 vulnerabilities remotely exploitable without authentication.Oracle Communications received 84 patches, the highest among products, with 50 exploitable remotely but none rated as critical severity. Other affected products include MySQL, Fusion Middleware, Financial Services Applications, Java SE, and Retail Applications, among others. Oracle also released 20 additional patches in its July 2025 Solaris Third Party Bulletin, addressing 12 remotely exploitable flaws.

Cisco warns of critical ISE bug

Cisco has disclosed a critical vulnerability (CVE-2025-20337) in its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC), which allows unauthenticated attackers to execute arbitrary code with root privileges. This maximum-severity flaw arises from insufficient validation of user-supplied input and impacts ISE and ISE-PIC releases 3.3 and 3.4. The vulnerability has been assigned a CVSS score of 10.0, indicating its severity. Cisco has released patches for the affected versions, specifically in 3.3 Patch 7 and 3.4 Patch 2.

Threats in Spotlight

Chinese hackers target Taiwan's semiconductor sector

Between March and June, several China-aligned threat actors intensified phishing campaigns targeting Taiwan's semiconductor industry, primarily for espionage purposes. These actors, identified as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp, employed spearphishing and credential phishing to infiltrate organizations involved in semiconductor manufacturing, design, and investment analysis. UNK_FistBump posed as job seekers to lure HR personnel, delivering malware like Cobalt Strike and the custom Voldemort backdoor through compromised emails. Meanwhile, UNK_DropPitch focused on financial analysts, using deceptive emails to distribute a simple backdoor known as HealthKick.