Cyware Daily Threat Intelligence, September 05, 2025

Slipping through digital cracks, China-aligned GhostRedirector is hijacking Windows servers with a stealthy C++ backdoor called Rungan. Paired with the Gamshen IIS module for SEO fraud, it boosts gambling sites on Google while exploiting EfsPotato and BadPotato to compromise 65 servers across multiple countries.

A zero-day flaw in Sitecore deployments is opening doors for hackers to unleash WeepSteel malware. By exploiting a reused ASP.NET key, attackers achieve remote code execution, using tools like Earthworm and Dwagent to steal data and maintain access through local admin accounts and SYSTEM services.

A macOS flaw is exposing sensitive data despite System Integrity Protection. This vulnerability, tied to the gcore utility, allows attackers to read process memory, extract login Keychain Master Keys, and decrypt iOS app binaries, patched in macOS 15.3 after a researcher’s discovery.

Top Malware Reported in the Last 24 Hours

New HexStrike-AI exploits n-day bugs

Hackers are increasingly exploiting vulnerabilities using HexStrike-AI, an AI-powered security framework designed for penetration testing. This tool automates the exploitation of newly disclosed n-day flaws, such as Citrix vulnerabilities CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424, significantly reducing the time required for attacks from days to mere minutes. With nearly 8,000 endpoints still vulnerable as of early September, attackers have begun discussing HexStrike-AI on hacking forums, sharing methods to deploy it for unauthorized access. The tool’s open-source nature has made it popular among malicious actors, enabling them to achieve remote code execution and maintain persistence through automated processes. 

SVG files used in phishing attacks

Cybersecurity researchers have uncovered a malware campaign utilizing SVG files to carry out phishing attacks that impersonate the Colombian judicial system. These SVG files, distributed via email, contain embedded JavaScript payloads that decode and inject Base64-encoded phishing pages, mimicking the Fiscalía General de la Nación's official portal. This deceptive page simulates a document download process while secretly downloading a ZIP file in the background. VirusTotal identified 44 unique SVG files that evade antivirus detection through techniques like obfuscation and junk code. Additionally, the campaign is part of a larger trend where attackers are increasingly targeting macOS users with the Atomic macOS Stealer (AMOS), which extracts sensitive data, including credentials and cryptocurrency information.

GhostRedirector poisons Windows servers

GhostRedirector is a newly identified China-aligned threat actor targeting Windows servers. It uses a passive C++ backdoor named Rungan for remote command execution. A malicious IIS module, Gamshen, is used for SEO fraud, manipulating Google search rankings to promote gambling websites. GhostRedirector exploits public vulnerabilities like EfsPotato and BadPotato for privilege escalation. The campaign compromised at least 65 Windows servers, mainly in Brazil, Thailand, Vietnam, and the U.S., affecting diverse sectors such as healthcare, education, and retail. GhostRedirector deploys tools like Zunput to collect website information and install webshells.

Sitecore 0-day abused to drop backdoor

Hackers exploited a zero-day vulnerability (CVE-2025-53690) in legacy Sitecore deployments caused by the reuse of a sample ASP.NET machine key, leading to RCE. Attackers used the '/sitecore/blocked.aspx' endpoint to drop WeepSteel reconnaissance malware, which collects system, process, disk, and network information disguised as standard ViewState responses. The multi-stage attack involved deploying tools like Earthworm (network tunneling), Dwagent (remote access), and 7-Zip for data exfiltration and archiving. Privilege escalation was achieved by creating local administrator accounts, dumping cached credentials, and using tools like GoTokenTheft for token impersonation. Persistence was ensured through disabling password expiration and registering Dwagent as a SYSTEM service.

Top Vulnerabilities Reported in the Last 24 Hours

Bug in Linux kernel actively exploited

A high-severity vulnerability, CVE-2025-38352, has been identified in the Linux kernel. This Time-of-Check Time-of-Use (TOCTOU) race condition affects the handling of POSIX CPU timers and has been added to CISA’s Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation of this vulnerability can lead to significant compromise of system confidentiality, integrity, and availability. It allows attackers to exploit race conditions during task exit, potentially bypassing timer checks and leading to undefined behavior or system instability. The vulnerability arises from a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() in the Linux kernel. When a non-autoreaping task exits and invokes handle_posix_cpu_timers() from an interrupt context, it may be reaped by its parent or debugger immediately after unlock_task_sighand().

​​macOS flaw allows unauthorized memory access

A recently disclosed macOS vulnerability (CVE-2025-24204) allowed attackers to read the memory of any process, even with System Integrity Protection enabled. This issue arose from Apple mistakenly granting the gcore utility elevated permissions in macOS 15.0, which was later revoked in macOS 15.3. Security researcher Koh M. Nakagawa discovered the flaw while testing Microsoft's ProcDump-for-Mac tool, which utilizes gcore. The vulnerability enabled the extraction of sensitive information, including the Master Key for decrypting the login Keychain without a password, and allowed access to decrypted FairPlay-encrypted iOS app binaries.