Cyware Daily Threat Intelligence, September 15, 2025

From the shadows of the darknet, the Yurei ransomware group has emerged, targeting organizations in Sri Lanka, India, and Nigeria with a double-extortion scheme that encrypts files and leaks sensitive data. Operating from a suspected base in Morocco, the group’s darknet blog pressures victims with data leak threats, highlighting the growing risk of low-skill ransomware operations.

Masquerading as legitimate tools, the WhiteCobra group has infiltrated VS Code and OpenVSX marketplaces with 24 malicious extensions aimed at stealing cryptocurrency and sensitive data. By inflating download counts, WhiteCobra exploits developer trust, exposing critical weaknesses in marketplace security.

A flaw in the CUPS printing system has left Linux systems vulnerable to remote crashes and authentication bypasses. Stemming from unsafe deserialization in the libcups library, this vulnerability disrupts printing services and can be exploited with simple Python scripts, requiring only network adjacency.

Top Malware Reported in the Last 24 Hours

New Yurei ransomware emerges

Yurei is a newly emerged ransomware group that adopts a double-extortion model, encrypting files and exfiltrating sensitive data from victims, primarily targeting organizations in Sri Lanka, India, and Nigeria. Yurei is derived from the open-source Prince-Ransomware, featuring only minor modifications that lower the barrier for cybercriminals. The ransomware employs the ChaCha20 encryption algorithm and utilizes goroutines for concurrent encryption of drives, while its lack of anti-analysis features indicates a low skill level among its developers. Notably, Yurei does not delete Shadow Copies, allowing potential recovery for victims. With a rapid increase in victims, the group operates a darknet blog for communication and negotiation, leveraging the threat of data leakage to pressure victims into paying ransoms. Investigations suggest the threat actors may be based in Morocco, linking them to other ransomware operations.

Phishing campaigns exploit RMM tools for access

Malicious actors are increasingly using phishing campaigns to install RMM software on victim machines, as reported by Red Canary. These campaigns exploit various lures, including fake browser updates that prompt users to download the ITarian RMM tool, misleading meeting invites that install Atera or PDQ software, and deceptive party invitations that deliver RMM tools via trusted domains like Cloudflare R2. Additionally, government forms such as W9s and tax returns are used to entice victims into installing malicious software. Additionally, threat actors leverage compromised websites and malicious domains to manage large-scale malware campaigns.

WhiteCobra's malicious extension campaign exposed

A coordinated campaign by the threat actor group WhiteCobra has infiltrated the VS Code and OpenVSX marketplaces, deploying 24 malicious extensions designed to steal cryptocurrency and sensitive information. This sophisticated operation, which has already claimed high-profile victims like crypto influencer zak.eth, reveals a detailed playbook outlining a five-phase attack strategy: packaging, deployment, promotion, download inflation, and exfiltration. WhiteCobra manipulates download counts to create false credibility, employing social engineering tactics that exploit developer psychology through social media. Their multi-stage payload delivery chain utilizes obfuscated code to evade detection, ultimately delivering malware such as LummaStealer, which targets cryptocurrency wallets and other sensitive data.

New HybridPetya ransomware bypasses Secure Boot

HybridPetya is a newly discovered ransomware strain that can bypass UEFI Secure Boot, allowing it to install malicious software on the EFI System Partition. This ransomware appears to draw inspiration from the notorious Petya and NotPetya malware, incorporating their visual style and attack methods while adding new features such as installation in the EFI System Partition and exploiting the CVE-2024-7344 vulnerability. Upon execution, HybridPetya drops a bootkit into the EFI System partition, which includes various files for encryption and validation. It encrypts Master File Table (MFT) clusters using a Salsa20 key, displays a fake CHKDSK message, and demands a ransom of $1,000 in Bitcoin for decryption. 

Top Vulnerabilities Reported in the Last 24 Hours

LangChainGo vulnerability allows file access exploitation

A vulnerability in LangChainGo (CVE-2025-9556) allows attackers to perform arbitrary file reads via malicious prompt injections using the Gonja template engine. The flaw enables attackers to reference critical system files like /etc/passwd through server-side template injection (SSTI), compromising sensitive data. Exploitation requires only access to the prompt input field, making systems like chatbots particularly vulnerable, with potential for further attacks like privilege escalation. A fix has been implemented with the RenderTemplateFS function, isolating template rendering from filesystem access. Users should update LangChainGo and review custom templates for compliance.

Critical CUPS bug poses major risks

A critical vulnerability in the CUPS printing system, tracked as CVE-2025-58364, allows attackers to remotely crash Linux systems and bypass authentication. This flaw arises from unsafe deserialization and validation of printer attributes in the libcups library, particularly during IPP operations. When exploited, the vulnerability triggers crashes in both the CUPS daemon and the cups-browsed service, disrupting printing capabilities. Exploitation requires network adjacency, but systems with unpatched vulnerabilities could face remote attacks. Proof-of-concept demonstrations reveal that attackers can easily exploit this flaw using simple Python scripts, highlighting significant risks to Linux infrastructure.

CISA warns of critical Dassault flaw

The CISA warned of active exploitation of a critical RCE vulnerability, tracked as CVE-2025-5086, in Dassault Systèmes' DELMIA Apriso software. The vulnerability, caused by deserialization of untrusted data, affects all versions of DELMIA Apriso from Release 2020 to Release 2025. A tThreat researcher observed exploitation attempts using malicious SOAP requests that execute Base64-encoded, GZIP-compressed .NET executables. Malicious requests were traced to the IP 156.244.33[.]162, possibly linked to automated scanning.