May 2, 2025

Cyware Daily Threat Intelligence, May 02, 2025

In the shadows of the cybersecurity landscape, MintsLoader emerges as a formidable adversary, orchestrating a multi-faceted infection strategy that deploys the notorious GhostWeaver RAT. This malware loader ingeniously employs a blend of obfuscated JavaScript and PowerShell scripts to execute its malicious agenda, utilizing sophisticated evasion techniques and a DGA for C2 communications. Two new malware families—TerraStealerV2 and TerraLogger—are now linked to the Golden Chickens threat group. TerraStealerV2 steals credentials and crypto wallet data but can’t yet bypass Chrome’s built-in encryption, suggesting it’s still in progress. TerraLogger, meanwhile, operates as a standalone keylogger with no exfiltration module, hinting at a plug-and-play role in a broader MaaS toolkit. A fake refund for a real blackout. A phishing campaign is spoofing TAP Air Portugal, preying on confusion after the Iberian power outage. Victims are promised compensation for delayed flights, only to be directed to phishing pages that steal payment details. The lure is simple, but effective, and the infrastructure, as usual, runs through compromised WordPress sites.

Apr 30, 2025

Cyware Daily Threat Intelligence, April 30, 2025

A familiar threat actor is back with sharper tools. A new spear-phishing wave from Earth Kasha is hitting government targets in Taiwan and Japan. Using a malicious Excel file, the group drops an updated ANEL backdoor and maintains stealthy persistence with SharpHide. The second-stage malware hides C2 traffic behind DNS over HTTPS - signaling renewed focus on quiet, long-term access. TheWizards aren’t casting spells, they’re hijacking software updates. This Chinese-linked threat group is abusing IPv6 SLAAC to perform AitM attacks with the Spellbinder lateral movement tool. Spellbinder redirects traffic to attacker-controlled domains to deliver malware-laced updates to apps like Tencent QQ and Sogou Pinyin. Once inside, a modular backdoor takes over. New vulnerabilities in Apple’s AirPlay protocol, collectively dubbed AirBorne, expose billions of devices to remote code execution without user interaction. Attackers could silently hijack devices via use-after-free and buffer overflow vulnerabilities, affecting not only Apple hardware but also third-party products using the AirPlay SDK.

Apr 29, 2025

Cyware Daily Threat Intelligence, April 29, 2025

Sharp and TX stealers are back, donning a new cloak - named Hannibal Stealer. It is going after credentials from browsers, crypto wallets, FTP clients, and VPN apps. It even captures Discord tokens and Steam sessions. While its core is largely unoriginal, its control panel and delivery updates point to a more commercialized approach, complete with dark web subscriptions. Privilege escalation is just a pointer error away. Attack of the Vsock exposes a critical use-after-free bug in the Linux kernel’s VMware vsock driver. A mishandled reference count allows attackers to reclaim memory and more. With exploit code already circulating, this one has the potential to hit millions of virtualized systems. They sound urgent. They look official. And they’re emptying wallets. TA2900, a newly identified BEC actor, is impersonating landlords to trick renters in France and Canada into sending payments to attacker-controlled accounts. Messages come from compromised university inboxes and often swap out IBANs mid-thread.

Apr 28, 2025

Cyware Daily Threat Intelligence, April 28, 2025

Ransomware groups aren’t always the ones breaking the door open. Researchers have uncovered ToyMaker, an initial access broker selling network entry to ransomware groups. Using a custom malware strain called LAGTOY, ToyMaker establishes reverse shells and executes commands on compromised systems. After gaining access, ToyMaker hands over the keys - leaving ransomware operators to finish the job. Industrial remote access just got a lot more dangerous. Three vulnerabilities have been discovered in the IXON VPN client, affecting both Windows and Linux. Attackers can exploit temporary file handling flaws to escalate privileges. Full details remain under wraps until patches are ready. One bad notification and your iPhone could be stuck in an endless reboot loop. A critical iOS flaw allowed malicious apps to abuse the Darwin notification system and brick devices with a single command. Apple’s fix in iOS 18.3 now requires special entitlements to send sensitive notifications but unpatched devices remain at risk.

Apr 25, 2025

Cyware Daily Threat Intelligence, April 25, 2025

An APT group with deep roots in Southeast Asia is quietly siphoning data through everyday cloud platforms. Earth Kurma has been active since late 2020, targeting government and telecom entities across the Philippines, Vietnam, Thailand, and Malaysia. Its extensive toolkit enables credential theft, stealthy surveillance, and Dropbox-based exfiltration. One patch, two problems. Microsoft’s fix for CVE-2025–21204 may have closed a privilege escalation bug but it opened the door to a DoS vulnerability. By creating junction points, non-admin users can block future Windows updates from installing. There’s no fix yet, and unless the rogue junction is manually removed, security updates will fail silently. Logos, lures, and lies - the Power Parasites campaign is using all three. Fraudsters are impersonating global energy brands to scam victims in Bangladesh, Nepal, and India through fake jobs and investment offers. With over 150 domains and active Telegram and YouTube promotion, the scheme blends fake onboarding forms with identity theft and financial fraud, all under the guise of renewable energy.

Apr 24, 2025

Cyware Daily Threat Intelligence, April 24, 2025

It starts with a fake sales order and ends with FormBook silently stealing your data. A recent phishing campaign has been abusing a long-patched Microsoft flaw to deliver a fileless variant of the malware. The attack uses a Word document, a fake PNG file follows, carrying an encrypted payload that’s decrypted and run entirely in memory - leaving no trace on disk. A single request is all it takes to bring SonicWall firewalls to a halt. CVE-2025-32818 targets the SSLVPN Virtual Office interface and can trigger a DoS condition on affected Gen7 appliances. The vulnerability, rated 7.5 in severity, has been patched in recent firmware updates. Signal and WhatsApp are the new frontline for cloud compromise. Russian actors are running OAuth phishing campaigns against Microsoft 365 users tied to Ukraine and human rights work. Victims are tricked into handing over legitimate Microsoft auth codes, often via chats impersonating European officials.

Apr 23, 2025

Cyware Daily Threat Intelligence, April 23, 2025

One compromised package, five tainted versions, and private keys silently siphoned away. A supply chain attack hit a widely used JavaScript library for the XRP Ledger. Malicious code was slipped into several recent versions, enabling private key theft via an external domain. The incident is linked to a compromised npm account tied to a Ripple employee. Docker containers aren’t always what they seem. A new threat named TenoBot is targeting systems running outdated Teneo Web3 node software, deploying malicious containers to hijack environments. Once inside, it enables attackers to conduct multiple actions, all while blending in with legitimate processes to avoid detection. A hidden flaw could turn Moodle into an unintentional threat vector. A recent audit exposed a TOC-TOU bug in the LMS’s URL validation process, enabling SSRF. By tampering with DNS responses, attackers can redirect requests to internal endpoints. Features like Calendar imports and File Picker are directly impacted, potentially affecting millions of users.

Apr 22, 2025

Cyware Daily Threat Intelligence, April 22, 2025

Apr 21, 2025

Cyware Daily Threat Intelligence, April 21, 2025

An unfamiliar name is showing up in ransomware notes and it’s backed by code, not bureaucracy. FOG ransomware is being distributed through phishing emails that reference the “Department of Government Efficiency,” deploying payloads that encrypt data. Victims receive ransom notes alongside scripts for data collection and privilege escalation. Since January, the campaign has claimed 100 victims across multiple sectors. A single enabled feature could open your network to remote control. ASUS has warned of a critical vulnerability in its routers when AiCloud is active. The flaw allows attackers to send specially crafted requests to run commands without authentication. Firmware updates are available, but until patched, users are advised to disable internet-facing services and secure admin interfaces. A forged email that passes every security check - that’s the new phishing trick. Attackers are using DKIM replay tactics to forward legitimate Google security alerts to unsuspecting victims. The alerts, signed and verified, redirect users to fake support pages hosted on trusted platforms.

Apr 18, 2025

Cyware Daily Threat Intelligence, April 18, 2025

Six million users and 57 extensions they probably shouldn’t trust. A wave of Chrome add-ons, many unlisted and quietly distributed through ads, have been caught with invasive capabilities. Laced with obfuscated code, several have been removed from the Chrome Web Store, but others still linger. A trio of exploited vulnerabilities just made CISA’s KEV list. Two affect Apple device, both patched in the latest iOS and macOS updates. The third, a Windows NTLM hash leak, has reportedly been used by groups like APT28. All three are now confirmed as actively exploited and fully patchable. Reward points and toll notices are the new bait. Researchers have flagged a surge in global SMS phishing attacks through two campaigns: PointyPhish and TollShark. Both rely on urgency, fake branding, and thousands of rapidly deployed domains via the Darcula Suite platform. From iMessage to RCS, no inbox is safe.

Apr 17, 2025

Cyware Daily Threat Intelligence, April 17, 2025

Mustang Panda has updated its arsenal and stealth is a priority. In a new campaign, it rolled out an upgraded version of its backdoor. Alongside it, new tools like StarProxy, Paklog, Corklog, and SplatCloakdriver were delivered through a dropper engineered to hunt down security products. Researchers have observed a fresh wave of Agent Tesla attacks using multi-stage loaders. The chain starts with a JavaScript file hidden in an archive, then pivots to PowerShell for in-memory execution. The malware finishes the job by injecting into trusted processes, effectively vanishing from traditional antivirus scans. A long-patched flaw is back in the spotlight and now it’s being exploited. SonicWall has updated its advisory for CVE-2021-20035, confirming active abuse in the wild. The bug affects SMA 100 series devices and allows authenticated users to execute arbitrary commands.

Apr 16, 2025

Cyware Daily Threat Intelligence, April 16, 2025

UNC5174 is keeping it quiet and clean. Since late 2024, the Chinese state-linked group has been targeting Linux environments using a domain-squatting infrastructure to deliver SNOWLIGHT malware and a new RAT. The campaign leans on stealth, — WebSockets for C2, bash scripts for delivery, and zero on-disk footprint — pointing to a mix of espionage and access brokering. It looks like a PDF tool, acts like malware. A new phishing campaign is spoofing a legitimate website to deliver a stealthy SectopRAT variant. Victims are funneled through cloned interfaces and fake CAPTCHAs before unknowingly executing PowerShell commands that drop the payload. Browser security just got a round of urgent fixes. Chrome 135 and Firefox 137 patch several critical bugs, including memory corruption issues that could lead to remote code execution. Thunderbird updates close off serious risks too.