Cyware Daily Threat Intelligence, September 09, 2025

Slipping through phishing emails like a digital ninja, MostereRAT is targeting Japanese users with encrypted payloads. This malware grabs SYSTEM-level control, disables antivirus and Windows defenses, and uses AnyDesk and TightVNC to steal data and capture screens via secure C2 channels.

SAP’s latest patch day is a wake-up call, tackling four critical vulnerabilities threatening enterprise systems. The worst, an insecure deserialization flaw in NetWeaver’s RMI-P4, allows unauthenticated attackers to run arbitrary commands, with patches addressing file uploads and access control issues.

China-linked Salt Typhoon and UNC4841 are lurking behind 45 newly uncovered domains, some active since May 2020. Using fake identities and Proton Mail, these espionage groups exploit vulnerabilities like Barracuda’s, revealing a persistent threat to global networks.

Top Malware Reported in the Last 24 Hours

Ongoing malvertising campaign targets IT workers

A malvertising campaign has been targeting IT workers in the EU by using fake GitHub Desktop installers to deliver malware. The attackers employ malicious Google Ads to redirect users to a compromised GitHub repository, where a modified README file links to a fake download page. Users who download the software receive malicious executables from a lookalike domain, with MacOS users getting the Atomic Stealer and Windows users receiving a bloated MSI file. This MSI contains a malicious executable designed to evade detection by complicating analysis and is programmed to avoid execution in virtual machines. If installed on a suitable system, the malware executes PowerShell scripts for persistence and privilege escalation, ultimately allowing attackers to access sensitive enterprise information and infrastructure.

APT37 drops new malware

APT37, a North Korean-aligned threat group, has enhanced its cyber capabilities by deploying sophisticated Rust and Python-based malware targeting Windows systems. APT37's latest campaign utilizes a coordinated approach with a single C2 server managing multiple malware components. The newly identified Rustonotto backdoor is complemented by the established Chinotto PowerShell backdoor and the comprehensive surveillance tool FadeStealer. FadeStealer offers extensive capabilities, including keystroke logging, audio recording, and data exfiltration, employing advanced evasion techniques such as Transactional NTFS and Process Doppelgänging. 

MostereRAT: New RAT bypasses EDR

MostereRAT is a sophisticated malware that initiates attacks through phishing emails targeting Japanese users, leading to the download of malicious payloads. It employs Easy Programming Language to create encrypted tools that bypass security measures and gain full control over infected systems. The malware operates by establishing SYSTEM-level privileges, using custom RPC communication, and creating persistent services. It effectively disables antivirus solutions and Windows security features, blocking their traffic to evade detection. MostereRAT communicates with C2 servers using mutual TLS for secure operations and leverages popular remote access tools like AnyDesk and TightVNC to maintain control. Additionally, it collects sensitive victim information and performs screen captures for data exfiltration.

Supply chain attack hits software packages

Hackers executed a significant supply chain attack on npm, compromising nearly two dozen software packages with over two billion weekly downloads. The breach was initiated when a maintainer fell victim to a phishing email, which led to the unauthorized injection of malicious code into foundational JavaScript packages. This malware monitored cryptocurrency transactions and redirected payments to wallets controlled by the attackers. The incident is notable not only for its scale but also for its impact on essential packages relied upon by numerous applications. Additionally, two other recent supply-chain attacks targeted PyPI, DockerHUB, and GitHub, exposing numerous authentication secrets and further highlighting vulnerabilities within the open-source software ecosystem.

Top Vulnerabilities Reported in the Last 24 Hours

SAP patches four critical bugs

SAP released 21 new Security Notes during its monthly Security Patch Day, addressing four critical vulnerabilities that pose significant risks to enterprise environments. The most severe, CVE-2025-42944, involves an insecure deserialization flaw in SAP NetWeaver’s RMI-P4 module, allowing unauthenticated attackers to execute arbitrary commands with a CVSS score of 10.0. Another critical vulnerability, CVE-2025-42922, permits authenticated non-administrative users to upload arbitrary files in SAP NetWeaver AS Java, potentially leading to full system compromise. Additionally, CVE-2023-27500 presents a directory traversal risk in SAP NetWeaver AS for ABAP, threatening system availability, while CVE-2025-42958 involves a missing authentication check that could allow unauthorized access to sensitive information. SAP also addressed 17 other vulnerabilities with varying severity levels.

Multiple flaws in Hiawatha web server

Hiawatha, an open-source web server, has been found to have multiple vulnerabilities, including a significant request smuggling issue (CVE-2025-57783) in the fetch_request function, which allows unauthenticated attackers to bypass authentication and access restricted resources. Additionally, an authentication timing attack (CVE-2025-57784) exists in the Tomahawk component due to the use of the strcmp function, enabling local attackers to access the management client. Another critical vulnerability involves a double free error (CVE-2025-57785) in the XSLT show_index function, which can lead to arbitrary code execution. These vulnerabilities pose significant risks, including session hijacking and potential data corruption, as they can be exploited by attackers to execute malicious actions on the server. 

Threats in Spotlight

Salt Typhoon linked to unreported domains

Threat hunters have discovered 45 previously unreported domains associated with the China-linked cyber espionage groups Salt Typhoon and UNC4841, with some domains dating back to May 2020. These findings indicate that Salt Typhoon was involved in activities prior to the notable attacks in 2024. The identified domains share some overlap with UNC4841, known for exploiting a critical vulnerability in Barracuda Email Security Gateway appliances. Investigations revealed that many domains were registered using fake identities and Proton Mail addresses, with some pointing to high-density IP addresses. The oldest domain linked to these espionage campaigns, onlineeylity[.]com, was registered on May 19, 2020, by a fictitious persona, underscoring the long-term nature of these cyber threats.