Cyware Daily Threat Intelligence, July 18, 2025

The H2Miner botnet has resurfaced with updated scripts that mine Monero, kill rival malware, and deploy multiple malware. Bundled with it is Lcrypt0rx, a likely AI-generated ransomware that exhibits sloppy logic, malformed syntax, and weak encryption using XOR.

Cisco Talos uncovered a MaaS campaign targeting Ukraine, where attackers used Amadey malware and GitHub repositories to stage payloads. The setup mimics tactics from a SmokeLoader phishing operation, with obfuscated JavaScript loaders and Emmenthal plugins helping evade detection and filter-based defenses.

In a sharp postmortem from Pwn2Own Berlin, VMware patched four zero-day flaws exploited during the contest. Three high-severity bugs let attackers break out of guest VMs, while a fourth in VMware Tools leaks sensitive host info. Separately, the Scanception campaign is sneaking into inboxes via QR code phishing PDFs.

Top Malware Reported in the Last 24 Hours

H2Miner resurfaces, brings new ransomware

H2Miner botnet has been active since 2019 and resurfaces with updated configurations to mine Monero cryptocurrency. Lcrypt0rx ransomware appears AI-generated, exhibiting flawed encryption logic, malformed syntax, and ineffective defense evasion techniques. H2Miner scripts deploy malware such as Kinsing and terminate security software, database processes, and competing miners. Lcrypt0rx ransomware disrupts system usability, encrypts files using XOR logic, and deploys scare tactics rather than effective ransomware measures. Tools used include commercial hacking utilities like Cobalt Strike, Lumma Stealer, and DCRat, targeting multiple operating systems. Lcrypt0rx introduces destructive actions like overwriting the Master Boot Record and deploying redundant embedded scripts.

LameHug malware uses LLM

The LameHug malware uses a LLM to dynamically generate commands for data theft on compromised Windows systems, marking a novel approach in cyberattacks. LameHug was discovered by CERT-UA and attributed to Russian state-backed APT28, with malicious emails impersonating Ukrainian ministry officials to distribute the malware. The malware leverages the Hugging Face API to interact with the Qwen 2.5-Coder-32B-Instruct LLM, which converts natural language into executable code or commands. LameHug is delivered via ZIP email attachments containing loaders with names such as ‘Attachment.pif,’ ‘AI_generator_uncensored_Canvas_PRO_v0.9.exe,’ and ‘image.py.’

GitHub exploited for malware distribution

Cisco Talos identified a MaaS operation using Amadey malware and fake GitHub accounts to host payloads and plugins, targeting Ukrainian entities. The operation overlaps with tactics from a SmokeLoader phishing campaign observed earlier in 2025. Phishing emails targeting Ukrainian entities used compressed archives containing obfuscated JavaScript files to download SmokeLoader. Emmenhtal loaders were used to deliver Amadey malware and other payloads, bypassing email delivery in some cases by hosting files on GitHub. GitHub repositories served as open directories for staging malware, leveraging public access to evade web filtering.

Top Vulnerabilities Reported in the Last 24 Hours

VMware patches ESXi zero-days

VMware fixed four zero-day vulnerabilities in ESXi, Workstation, Fusion, and Tools that were exploited during the Pwn2Own Berlin 2025 hacking contest. Three vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238) have a severity rating of 9.3 and enable programs in guest virtual machines to execute commands on the host. The fourth flaw, CVE-2025-41239, rated at 7.1, is an information disclosure vulnerability impacting VMware Tools for Windows. 

Hackers abuse TeleMessage SGNL bug

Hackers are exploiting a flaw in TeleMessage SGNL, exposing sensitive data due to outdated Spring Boot configurations. The vulnerability, CVE-2025-48927, has led to real-world attacks. The vulnerability remained active in TeleMessage instances until at least May 2025 and was added to CISA’s KEV catalog on July 14. GreyNoise observed active reconnaissance and exploitation attempts, with 11 IPs targeting CVE-2025-48927 and 2,009 IPs scanning for Spring Boot Actuator endpoints within the last 90 days.

Top Scams Reported in the Last 24 Hours

Scanception quishing campaign 

The Scanception campaign uses QR codes in phishing PDFs to bypass email security and endpoint protection by targeting personal mobile devices outside organizational security perimeters. Over 600 unique phishing PDFs and emails were identified in three months, with 80% of them undetected by VirusTotal. These PDFs mimic legitimate enterprise workflows, increasing user interaction. The campaign targets industries such as technology, healthcare, manufacturing, and BFSI, with a global reach across North America, EMEA, and APAC regions. Trusted platforms like YouTube, Google, Bing, Cisco, and Medium are abused for hosting or redirecting malicious content, evading reputation-based detection systems. Credentials are harvested via multi-stage processes, including real-time interception of MFA tokens and session cookies for account takeover.