Cyware Daily Threat Intelligence, July 28, 2025
Daily Threat Briefing • July 28, 2025
Spear-phishing emails are slipping past defenses in Russia’s aerospace industry. Operation CargoTalon, tied to threat cluster UNG0901, targets organizations like the Voronezh Aircraft Production Association with EAGLET malware hidden in fake invoice files, quietly siphoning off sensitive data to a C2 server.
A slew of vulnerabilities in Tridium’s Niagara Framework demands urgent attention. Over a dozen high-severity flaws, including CVE-2025-3936 through CVE-2025-3945, could let attackers exploit misconfigured systems for remote code execution or persistent access, threatening critical infrastructure.
Scattered Spider is turning social engineering into a devastating weapon. By posing as employees to reset Active Directory passwords, the group swiftly escalates privileges, hijacks VMware ESXi hypervisors, and deploys ransomware to paralyze virtual environments in retail and transportation sectors within hours.
Top Malware Reported in the Last 24 Hours
Romance scam drops malware
A recent attack campaign targeting German speakers employs romance-themed scam emails to deliver malware through the Keitaro TDS. These emails contain malicious URLs that lead to a 300MB ISO file, which is designed to evade detection by inflating its file size. The ISO includes an executable named "lovely_photos.exe" that prompts users for a password, enabling the extraction of additional malicious files. The malware utilizes obfuscated batch scripts and AutoIT scripting to bypass antivirus detection, modifying system variables and creating a scheduled task to ensure persistence.
Operation CargoTalon targets Russian aerospace sector
Operation CargoTalon is a targeted cyber-espionage campaign attributed to threat cluster UNG0901, aimed at Russia’s aerospace and defense sectors. The campaign specifically targeted the Voronezh Aircraft Production Association (VASO) using spear-phishing emails to deliver the EAGLET malware. The operation employs advanced malware capabilities and social engineering tactics to infiltrate and exfiltrate sensitive data. The infection begins with spear-phishing emails containing a ZIP file that is actually a disguised DLL file. A similarly named LNK shortcut file is also included. When executed, these files trigger the EAGLET implant. The ZIP file, named in Russian as a TTN (goods and transport invoice), serves as a decoy to lure victims into executing the payload. EAGLET is a PE-based implant that generates a unique GUID to identify victims, collects system information, creates a hidden directory, and communicates with a C2 server via HTTP using disguised requests.
Top Vulnerabilities Reported in the Last 24 Hours
Critical bugs in Tridium’s Niagara Framework
Over a dozen security vulnerabilities in Tridium's Niagara Framework could allow attackers on the same network to compromise systems if misconfigured, disabling encryption. Severe vulnerabilities include CVE-2025-3936, CVE-2025-3937, CVE-2025-3938, CVE-2025-3941, CVE-2025-3944, and CVE-2025-3945, all with high CVSS scores. Exploitation could lead to root-level remote code execution, enabling attackers to intercept tokens, perform CSRF attacks, and gain elevated permissions for persistent backdoor access. Attackers could download private keys to conduct adversary-in-the-middle attacks, compromising both the Station and Platform components of the Niagara system.
Beware of this Post SMTP plugin flaw
A vulnerability in the Post SMTP plugin for WordPress, identified as CVE-2025-24000, has put over 200,000 websites at risk of hijacking attacks. This flaw arises from a broken access control mechanism in the plugin’s REST API, allowing low-privileged users to access sensitive email logs and potentially intercept password reset emails for administrator accounts. Despite the release of a fix in version 3.3.0 on June 11, which added necessary privilege checks, only 48.5% of users have updated to this secure version. Consequently, a significant number of sites remain exposed, with many still running outdated versions that are vulnerable to additional security issues.
Threats in Spotlight
Scattered Spider targets VMware ESXi
Scattered Spider hackers are aggressively targeting VMware ESXi hypervisors in various sectors, including retail and transportation, using sophisticated social engineering tactics. They initiate attacks by impersonating employees to convince IT help desks to reset Active Directory passwords, allowing them to gain initial access. This access enables them to identify and exploit high-value targets, such as domain administrators. The attackers then escalate their privileges by impersonating these users to gain control over the VMware vCenter Server Appliance, enabling SSH connections and executing a "disk-swap" attack to extract sensitive Active Directory data. Ultimately, they deploy ransomware to encrypt virtual machine files, achieving complete control over the virtualized environment in just a few hours.