Cyware Daily Threat Intelligence, September 04, 2025

Lurking in your inbox, Russia’s APT28 is wielding NotDoor to turn Outlook into an espionage tool. This VBA backdoor, triggered by email keywords, uses obfuscation and DLL side-loading to dodge detection, altering registry settings to steal sensitive data across NATO organizations.

Critical flaws in Hikvision’s HikCentral software are leaving security systems wide open to unauthenticated attackers. These vulnerabilities, including a high-severity access control issue, allow privilege escalation to manipulate logs, disable surveillance, or unlock doors, with patches now available.

Iran’s Homeland Justice APT is casting a wide phishing net, targeting over 50 global embassies and organizations. Using 100+ hijacked email accounts and malicious Word docs since August 19, they exploit trusted identities to deliver malware, hitting targets like the UN and World Bank.

Top Malware Reported in the Last 24 Hours

New NotDoor malware targets Outlook users

Russian state-sponsored hackers, known as APT28 or Fancy Bear, have developed a sophisticated malware called NotDoor that specifically targets Microsoft Outlook users. This stealthy backdoor, written in VBA, activates when it detects certain keywords in incoming emails, allowing attackers to execute malicious commands. NotDoor employs advanced evasion techniques, including code obfuscation and DLL side-loading, to avoid detection by security software. It modifies Outlook's registry settings to ensure persistence and suppress security alerts. Once activated, the malware exfiltrates sensitive data to an attacker-controlled email address while confirming its execution through web callbacks. NotDoor has already compromised multiple organizations across NATO member countries.

XWorm malware evolves with advanced tactics

XWorm, a sophisticated backdoor malware, has transitioned from predictable distribution methods to more deceptive and intricate infection chains. Initially relying on email-based attacks, it now employs .lnk files to initiate complex infections that drop disguised executables like discord.exe and system32.exe. This multi-stage deployment evades detection by using legitimate-looking filenames and advanced packing techniques. Once executed, XWorm disables Windows Firewall, checks for security applications, and establishes persistence through scheduled tasks and registry entries. It employs cryptographic methods, including Rijndael and Base64 encoding, to conceal communication with its command and control servers. 

Stealerium malware resurfaces in phishing attacks

Proofpoint researchers have observed a significant increase in phishing campaigns utilizing Stealerium, an open-source infostealer launched on GitHub in 2022. Initially overlooked, Stealerium has gained traction among cybercriminals who modify it for real-world attacks, leading to the emergence of variants like Phantom Stealer and Warp Stealer. Recent campaigns have targeted various sectors, employing tactics such as impersonating charitable organizations, travel booking requests, and legal threats. Stealerium is equipped with advanced features for credential theft, system reconnaissance, and cryptocurrency wallet targeting, alongside a sextortion capability that captures sensitive content. Its diverse exfiltration methods, including SMTP, Discord webhooks, and Telegram, complicate detection efforts, underscoring the growing appeal of open-source malware in the cybercriminal landscape.

Obscura: New ransomware strain spotted

Obscura is a newly identified ransomware variant that emerged on August 29. This ransomware targets domain controllers, executing from the NETLOGON folder, and employs scheduled tasks to facilitate its spread across networks. It disables recovery options by deleting shadow copies and utilizes a ransom note to threaten data exposure while demanding payment for decryption assistance. Obscura requires administrative privileges to operate, performing system reconnaissance and terminating security processes to prepare for encryption. It uses advanced encryption techniques, specifically XChaCha20, and appends a unique footer to encrypted files. The variant also includes a filtering mechanism to exclude certain file types, ensuring system functionality remains intact while maximizing damage to user data.

Top Vulnerabilities Reported in the Last 24 Hours

CISA adds two flaws to KEV catalog

CISA added TP-Link router vulnerabilities CVE-2023-50224 and CVE-2025-9377 to its KEV catalog due to evidence of active exploitation. CVE-2023-50224 involves an authentication bypass vulnerability, while CVE-2025-9377 allows remote code execution via command injection. TP-Link released firmware updates in November 2024 for affected models, but many have reached End-of-Life and no longer receive active support. Federal agencies are urged to apply mitigations by September 24, 2025, to secure networks.

Severe Hikvision HikCentral bugs

Severe vulnerabilities in Hikvision HikCentral software allow unauthenticated users to gain admin rights, risking control over configurations, logs, and critical monitoring. Three key vulnerabilities identified: CSV Injection (CVE-2025-39245), Unquoted Service Path (CVE-2025-39246), and Access Control (CVE-2025-39247). The Access Control vulnerability (CVE-2025-39247) is rated high severity, enabling attackers to escalate privileges without authentication and compromise security infrastructure. Exploiting these flaws could allow attackers to disable surveillance, unlock restricted doors, or alter audit trails during physical intrusions. Affected HikCentral versions span Master Lite, FocSign, and Professional builds, with fixed versions now available. 

Top Scams Reported in the Last 24 Hours

Iranian phishing campaign targets global embassies

Iranian state hackers, associated with the Homeland Justice APT group, launched a phishing campaign targeting over 50 embassies, ministries, and international organizations worldwide. Utilizing more than 100 compromised email accounts, the attackers sent emails disguised as official communications, often containing malicious Word document attachments that required users to enable macros. This tactic, although considered outdated, proved effective due to the credibility of the compromised accounts. The campaign began on August 19 and involved sophisticated evasion techniques, such as hiding malware within the victim's Documents folder. Targets spanned various regions, including the Middle East, Europe, Africa, Asia, and the Americas, with notable organizations like the UN and the World Bank among those affected. 

Californians face tax refund scam

The California Franchise Tax Board (FTB) warned taxpayers about a scam involving fraudulent text messages that appear to be from the FTB. These messages contain links to fake websites designed to steal personal and banking information. The scam uses urgent language, claiming that failure to respond will result in the permanent forfeiture of tax refunds. Messages often feature suspicious domain names and odd instructions for accessing links, raising red flags for recipients. Scammers exploit the urgency of tax-related communications to trick individuals into providing sensitive information. Indicators of the scam include generic sign-offs and grammatical errors, which can help users identify fraudulent messages.