TransferLoader doesn’t just sneak in, it evolves. Active since early 2025, this modular loader combines a downloader, backdoor loader, and backdoor into one stealthy package. It uses anti-analysis tricks, dynamic C2 updates via IPFS, and has already been linked to Morpheus ransomware deployments. Once inside, it enables arbitrary command execution and long-term persistence.

Two ransomware gangs, BianLian and RansomExx, are now exploiting the same SAP NetWeaver vulnerability as Chinese APTs. Using CVE-2025-31324, the attackers deliver PipeMagic alongside privilege escalation flaws like CVE-2025-29824. Infrastructure links tie the activity to BianLian, with payloads deployed via web shells and C2 managed through Brute Ratel and inline assembly.

Fancy Bear is broadening its reach. Operation RoundPress shows the group leveraging XSS zero-days to breach webmail platforms. Its spearphishing campaigns use malicious JavaScript to deploy SpyPress variants aimed at stealing credentials and exfiltrating emails, often bypassing 2FA in the process. Targets span government and defense sectors from Eastern Europe to South America.

Top Malware Reported in the Last 24 Hours

Another day, another bad npm package

Researchers discovered a malicious npm package, os-info-checker-es6, which uses Unicode steganography to hide its code and Google Calendar as a dynamic C2 dropper. The package was initially posed as benign, but later versions included obfuscated code to extract a payload and contact a remote server. It has been downloaded 2,001 times. Google Calendar is leveraged as a trusted intermediary to obscure attacker infrastructure, complicating detection and blocking efforts.Three other npm packages appear to be part of the same campaign, indicating a broader attack strategy.

New TransferLoader deliver Morpheus

TransferLoader is a newly identified malware loader active since at least February 2025. It comprises three main components—a downloader, a backdoor loader, and a backdoor—each employing advanced anti-analysis and obfuscation techniques. TransferLoader has been observed delivering Morpheus ransomware and is capable of executing arbitrary commands, maintaining persistence, and updating its C2 infrastructure via IPFS.

Top Vulnerabilities Reported in the Last 24 Hours

Google issues emergency update

Google released emergency updates to address a high-severity vulnerability (CVE-2025-4664) in Chrome, which could allow full account takeover through exploitation. The vulnerability involves insufficient policy enforcement in Chrome's Loader component, enabling attackers to leak sensitive cross-origin data via malicious HTML pages. Exploitation could lead to stealing sensitive query parameters, such as OAuth tokens, potentially resulting in account takeovers.

BianLian and RansomEXX abuse SAP bug

BianLian and RansomExx have exploited a security flaw (CVE-2025-31324) in SAP NetWeaver, leveraging it to deploy malicious payloads like the PipeMagic trojan. Evidence links BianLian to incidents through IP addresses and infrastructure associated with their previous activities. PipeMagic was used alongside a Windows CLFS privilege escalation vulnerability (CVE-2025-29824) in targeted attacks across multiple countries. The trojan was delivered via web shells after exploiting the SAP NetWeaver flaw, with subsequent attacks involving Brute Ratel C2 framework and exploitation of CLFS vulnerability through inline assembly. 

Threats in Spotlight

Operation RoundPress targets webmail servers

ESET researchers have uncovered Operation RoundPress, a cyberespionage campaign attributed to the Sednit group (aka Fancy Bear, APT28), targeting webmail servers via XSS vulnerabilities. The campaign expanded from targeting Roundcube in 2023 to include Horde, MDaemon, and Zimbra in 2024. Sednit used a zero-day XSS vulnerability (CVE-2024-11182) in MDaemon, which was patched in version 24.5.1. The primary targets are governmental entities and defense companies in Eastern Europe, with additional victims in Africa, Europe, and South America. The attack chain begins with spearphishing emails that exploit XSS vulnerabilities to execute malicious JavaScript payloads. SpyPress payloads (e.g., SpyPress.HORDE, SpyPress.MDAEMON, SpyPress.ROUNDCUBE, and SpyPress.ZIMBRA) are used for credential theft, email exfiltration, and bypassing security measures like 2FA.