Cyware Daily Threat Intelligence, October 06, 2025
Daily Threat Briefing • October 6, 2025
Revived from the shadows, new XWorm variants are flooding phishing campaigns with 35+ plugins. This modular RAT steals data, logs keystrokes, launches DDoS, and encrypts files with NoCry-like ransomware.
Oracle is scrambling with an emergency patch for a 9.8 CVSS flaw in its E-Business Suite. This unauthenticated RCE bug has fueled Cl0p ransomware's data theft spree, exploiting compromised emails to breach systems patched earlier this year.
Gamers beware: a Unity engine vulnerability is turning popular titles into attack vectors. It enables code execution on Android and privilege escalation on Windows in games like Hearthstone and DOOM.
Top Malware Reported in the Last 24 Hours
XWorm malware re-emerges with ransomware module
New variants of the XWorm malware, specifically versions 6.0, 6.4, and 6.5, have re-emerged in phishing campaigns, featuring over 35 plugins that enhance its malicious capabilities, including ransomware functionalities. Initially observed in 2022, XWorm is a modular remote access trojan known for its ability to steal sensitive data, track keystrokes, and launch DDoS attacks. Following the abandonment of the project by its original developer, XCoder, various cybercriminals have begun distributing cracked versions. Its ransomware module encrypts files, appending a .ENC extension, while providing victims with ransom instructions, demonstrating a notable overlap with the NoCry ransomware’s encryption techniques.
Malvertising campaign on WordPress sites
A recent malvertising campaign targeted WordPress websites by injecting malicious JavaScript into the theme’s functions.php file. This code fetched external scripts from attacker-controlled domains, resulting in forced redirects and pop-ups for unsuspecting visitors. The investigation revealed that the compromised function, ti_custom_javascript(), established a connection to a Command and Control server, allowing the attackers to deliver harmful payloads. The malicious script included techniques such as hidden iframes and mimicked legitimate Cloudflare actions to evade detection.
Top Vulnerabilities Reported in the Last 24 Hours
Oracle issues emergency update
Oracle has released an emergency patch for a critical vulnerability in its E-Business Suite, tracked as CVE-2025-61882, which has a CVSS score of 9.8. This flaw allows unauthenticated attackers to execute remote code via HTTP, making it highly exploitable. The vulnerability has been linked to recent data theft attacks by the Cl0p ransomware group, which reportedly exploited multiple weaknesses in Oracle systems, including those patched earlier in 2025. Mandiant noted that Cl0p's operations involved a high-volume email campaign launched from compromised accounts, resulting in significant data breaches.
Steam and Microsoft warn of Unity bug
A critical vulnerability in the Unity game engine, identified as CVE-2025-59489, poses significant risks to gamers by allowing code execution on Android devices and privilege escalation on Windows systems. This flaw affects all Unity versions starting from 2017.1 and has the potential to compromise numerous popular games, including Hearthstone and DOOM (2019). The vulnerability arises from Unity’s improper handling of Android Intents and command-line arguments, enabling malicious applications to execute code with the privileges of the vulnerable game. While Unity has acknowledged the issue and released fixes for supported versions, older versions will not receive any patches.