Cyware Daily Threat Intelligence, September 10, 2025

Masquerading as harmless GitHub files, Kimsuky is sneaking malware into systems with malicious LNK files. These trigger PowerShell scripts to steal system metadata and upload it to private repositories, using scheduled tasks for persistent espionage targeting sensitive networks.

Slipping into devices like a digital ghost, Buterat backdoor is hitting government and enterprise systems via phishing and trojanized downloads. It hides in processes, tweaks registry keys for persistence, and uses encrypted C2 channels to drop payloads and evade detection.

Microsoft’s latest patch tackles 81 flaws, including two zero-day vulnerabilities in Windows SMB and Newtonsoft.Json. With nine critical fixes addressing remote code execution and privilege escalation, enabling SMB protections is urged, though compatibility hiccups may arise.

Top Malware Reported in the Last 24 Hours

DarkSamural APT targets organizations in Pakistan

DarkSamural, a newly identified subgroup of the OceanLotus APT, has initiated a sophisticated cyber campaign against high-value organizations in Pakistan. Utilizing malicious LNK files disguised as PDF documents and advanced MSC containers powered by GrimResource technology, the group executes a multi-stage payload aimed at exfiltrating sensitive data. Researchers attribute this operation to Patchwork, an APT group known for its espionage tactics, particularly spear-phishing. The attackers exploit Windows MSC files, misleading victims with PDF icons, and employ heavily obfuscated JavaScript to download additional payloads. The campaign showcases a range of proprietary and open-source tools, ensuring persistent control over compromised systems while evading detection. 

Kimsuky exploits GitHub, drops malware

North Korea–backed Kimsuky has been observed exploiting GitHub repositories for malware delivery and data exfiltration. They utilize malicious LNK files that execute PowerShell scripts to download additional payloads from private GitHub repositories. These scripts, which include hardcoded GitHub Private Tokens, gather system metadata such as boot time, OS configuration, and running processes, subsequently uploading this information to attacker-controlled repositories. The malware establishes persistence by creating scheduled tasks that enable the execution of updated scripts at regular intervals. Investigations have linked Kimsuky to nine private repositories containing exfiltrated logs, decoy documents, and files resembling payment reminders.

New malware variant targets Docker APIs

A new strain of malware has been discovered that specifically targets exposed Docker APIs, showcasing advanced infection capabilities. This variant differs from earlier iterations by blocking access to the Docker API from the internet, effectively preventing other attackers from exploiting the compromised instance. The malware utilizes Base64-encoded scripts to create malicious containers, which download and execute additional payloads from Tor domains. It establishes persistence by appending attacker-controlled SSH keys and installs various tools for propagation. Additionally, it scans for other open Docker API ports and has the potential to exploit Telnet and Chromium debugging ports, posing significant security risks.

New Buterat backdoor malware unveiled

A new backdoor malware known as Buterat is spreading through phishing emails and trojanized downloads, primarily targeting government and enterprise networks. Once it infiltrates a device, Buterat hides within normal system processes and modifies registry keys to ensure persistence even after reboots. Utilizing advanced techniques like SetThreadContext and ResumeThread, it hijacks execution flow to evade detection by security systems. The malware communicates with remote C2 servers through encrypted channels, complicating identification efforts. During live testing, researchers noted that Buterat drops multiple payloads, such as amhost.exe and bmhost.exe, which enhance the attackers' control and capabilities. 

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft September 2025 Patch Tuesday

Microsoft released security updates for 81 flaws, including two zero-day vulnerabilities: CVE-2025-55234 (Windows SMB Elevation of Privilege) and CVE-2024-21907 (Improper Handling of Exceptional Conditions in Newtonsoft.Json). The updates address nine critical vulnerabilities, including remote code execution, information disclosure, and elevation of privilege issues. Microsoft recommends enabling SMB Server Signing and SMB Server Extended Protection for Authentication to mitigate relay attacks, but warns of potential compatibility issues. Updates for Microsoft SQL Server include fixes for vulnerabilities in Newtonsoft.Json, addressing denial of service risks caused by crafted data.  

Adobe patches critical SessionReaper flaw

Adobe has addressed a critical vulnerability, CVE-2025-54236, known as SessionReaper, in its Commerce and Magento Open Source platforms. This flaw allows unauthorized exploitation through the Commerce REST API, potentially enabling attackers to take control of customer accounts without authentication. Although Adobe has not detected any active exploitation in the wild, a leaked hotfix may provide threat actors with a head start in developing exploits. Researchers indicate that the vulnerability is particularly severe, comparable to past significant issues within the Magento ecosystem, such as CosmicSting and Shoplift. The vulnerability's exploitation appears to depend on default configurations for session data storage.

Top Scams Reported in the Last 24 Hours

Phishing campaign impersonates Google AppSheet

A recent phishing campaign has exploited Google’s AppSheet platform to harvest user credentials by leveraging its trusted email infrastructure. Attackers have utilized legitimate AppSheet mail servers and authentication protocols, evading traditional security measures. They employed tactics such as account compromise, feature abuse, and template injection, leading to significant phishing incidents. This trend began in March 2025, with a notable increase in AppSheet-based phishing emails, primarily targeting organizations using Google Workspace.