What looks like support for defectors may actually be spyware in disguise. Kimsuky launched a stealthy campaign, targeting defense entities, activists, and crypto exchanges through Facebook impersonations, spear-phishing emails, and Telegram messages. Malware is delivered via EGG archives and disguised outreach, using encoded scripts, malicious DLLs, and registry tweaks.

Malicious packages are creeping into trusted ecosystems under familiar names. A new supply chain attack compromised 16 packages linked to GlueStack, enabling command execution, data theft, and file deletion. The packages posed as developer tools or Instagram growth apps, stealing credentials and relaying them to external bot services.

An old botnet just found a new way in. A Mirai variant is actively exploiting a command injection vulnerability in TBK DVR-4104 and DVR-4216 devices, to conscript them into a botnet for DDoS attacks. The exploit enables attackers to run shell commands via POST requests.

Top Malware Reported in the Last 24 Hours

Kimsuky’s AppleSeed campaign 

Kimsuky, a North Korea-aligned APT group, launched a sophisticated cyber-espionage campaign named AppleSeed, targeting defense sectors, activists, and cryptocurrency exchanges through Facebook, email, and Telegram. The group employed impersonation tactics on Facebook, spear-phishing emails with malicious EGG archives, and Telegram for delivering malware disguised as support for North Korean defectors. The malware payload involved encoded scripts, malicious DLLs, and registry modifications for persistence, using advanced techniques like VMProtect and encryption to evade detection.

Blitz malware targets gamers

Blitz malware targets gamers by distributing backdoored cheat packages for the mobile game Standoff 2, compromising systems, stealing data, and mining cryptocurrency. The malware uses legitimate platforms like Hugging Face Spaces for C2 operations and stores malicious payloads. Distributed through Telegram, the malware operates in two stages: a downloader and a bot capable of keylogging, screenshot capture, file transfer, DDoS attacks, and cryptojacking. Researchers identified 289 active infections across 26 countries, with Russia, Ukraine, Belarus, and Kazakhstan being most affected.

New DuplexSpy RAT emerges

DuplexSpy RAT is a newly emerged modular remote access trojan developed in C# and available on GitHub. It features a GUI for surveillance, persistence, and anti-analysis, mimicking legitimate processes to avoid detection. Key capabilities include keylogging, live streaming, audio spying, remote command execution, and system shutdowns. The RAT uses AES/RSA encryption and DLL injection for secure, in-memory payload execution. It mimics legitimate system processes, such as "Windows Update," to avoid suspicion. 

Supply chain attack targets npm and PyPI

A supply chain malware operation has targeted npm and PyPI ecosystems, compromising 16 packages associated with GlueStack. Malicious code allows attackers to execute commands, take screenshots, and steal data. Two rogue npm packages, express-api-sync and system-health-sync-api, were found to delete files and exfiltrate information via email. Additionally, a Python package named imad213 masqueraded as an Instagram growth tool, harvesting user credentials and distributing them to multiple bot services. The first compromise was detected on June 6, with nearly 1 million weekly downloads affected.

Top Vulnerabilities Reported in the Last 24 Hours

New Mirai variant abuses TBK DVR bug

A new variant of the Mirai botnet is exploiting a command injection vulnerability (CVE-2024-3721) in TBK DVR-4104 and DVR-4216 devices to hijack them. This flaw, disclosed in April 2024, enables shell command execution through crafted POST requests. The exploit uses a PoC to drop malware and connect devices to a botnet for DDoS attacks and malicious traffic proxying. An estimated 50,000 devices remain exposed globally, with infections primarily affecting countries such as China, India, and Brazil. 

Critical SOQL injection flaw in Salesforce

A critical SOQL injection vulnerability was discovered in Salesforce's default Aura controller, potentially exposing millions of user records across thousands of deployments. The flaw allowed attackers to inject malicious input into dynamically constructed SOQL queries, enabling unauthorized data access. The vulnerability could allow attackers to extract sensitive data such as user emails, names, addresses, and potentially password hashes, depending on the deployment configuration. The researcher reported the issue to Salesforce, which quietly patched the vulnerability without issuing a CVE or public advisory.