Cyware Daily Threat Intelligence, September 19, 2025

In a rare crossover of Russian APT playbooks, Gamaredon and Turla have joined forces to target Ukrainian defense entities with coordinated malware operations. Researchers have uncovered joint activity involving the use of Gamaredon's custom tools to deploy Kazuar, a powerful Turla-developed backdoor known for its stealth and persistence.

Malware deployment is getting more modular and more menacing. CountLoader is a newly developed malware loader tied to Russia-affiliated ransomware groups like LockBit, BlackBasta, and Qilin. Disguised as Ukrainian police messages in phishing campaigns, CountLoader excels at blending into enterprise traffic, gathering detailed system data, and maintaining persistent access through varied execution techniques.

No clicks, no downloads, no warnings - just data theft by design. A critical flaw in OpenAI’s ChatGPT Deep Research agent has been patched following the discovery of ShadowLeak, a zero-click vulnerability that enabled attackers to exfiltrate sensitive information from user inboxes via maliciously crafted emails. The exploit abused the agent’s autonomous email-processing capabilities to embed covert instructions.

Top Malware Reported in the Last 24 Hours

Russian hackers collaborate on Kazuar attacks

Russian hacking groups Gamaredon and Turla have joined forces to target Ukrainian entities, deploying the Kazuar backdoor through a series of sophisticated cyberattacks. Evidence from ESET indicates that Gamaredon utilized tools like PteroGraphin and PteroOdd to execute Turla's Kazuar malware, suggesting a collaborative effort to gain access to specific machines in Ukraine. The attacks have primarily focused on the Ukrainian defense sector, intensifying since Russia's invasion in 2022. Kazuar, a frequently updated malware, has evolved through various versions, with v3 introducing additional capabilities for data gathering and exfiltration. 

New CountLoader malware discovered

Silent Push has identified a new malware loader named CountLoader, closely linked to Russian ransomware gangs such as LockBit, BlackBasta, and Qilin. This evolving threat is delivered in three versions: .NET, PowerShell, and JScript, and has been utilized in phishing campaigns targeting individuals in Ukraine, often impersonating Ukrainian police. CountLoader is capable of dropping various malware agents, including Cobalt Strike and Adaptix C2, and employs sophisticated techniques for persistence and communication. It gathers extensive system information from victims and utilizes multiple methods for file downloading and execution. The malware's infrastructure is designed to blend into legitimate enterprise traffic.

SystemBC malware exploits vulnerable VPS systems

SystemBC malware targets vulnerable commercial VPS worldwide, exploiting critical vulnerabilities to create a proxy network that facilitates malicious traffic. Active since 2019, it has been utilized by various threat actors, including ransomware gangs, to obscure C2 activities. With over 1,500 daily bots, SystemBC operates more than 80 C2 servers, showing little concern for stealth as it powers other criminal proxy networks. Infected VPS systems often have an average of 20 unpatched vulnerabilities, with some remaining compromised for over a month. Researchers noted that one particular IP address generated over 16 GB of proxy data in just 24 hours, highlighting the significant volume of traffic facilitated by this malware. 

Kawa4096 ransomware group targets multinational firms

Kawa4096, a ransomware group that emerged in June, is targeting multinational organizations across various sectors, including finance, education, and services, with a significant focus on companies in Japan and the U.S. This group employs a systematic approach, utilizing a Tor-based data leak site to publicly disclose information about its victims and employing double extortion tactics by exfiltrating data before encryption. The ransomware exhibits visual similarities to the Akira ransomware group, suggesting a deliberate branding strategy to instill fear and credibility. The encryption process involves specific command-line arguments and exclusion rules to avoid critical system files, enhancing the effectiveness of its attacks. Ransom notes issued by Kawa4096 closely resemble those from the Qilin ransomware, outlining stolen data and threatening public exposure if demands are not met, while also deleting backup data to hinder recovery options for victims.

Top Vulnerabilities Reported in the Last 24 Hours

Novakon HMIs face serious security vulnerabilities

Novakon's human-machine interfaces (HMIs) are vulnerable to critical security flaws that allow for remote code execution and information exposure. These vulnerabilities include an unauthenticated buffer overflow, directory traversal, and weak authentication issues, which can be exploited without authentication. The HMIs, which are widely used in critical infrastructure, could face severe consequences if these vulnerabilities are exploited, as they interact with essential systems like PLCs and production lines. 

OpenAI patches zero-click ShadowLeak bug

OpenAI has addressed a serious zero-click vulnerability known as ShadowLeak in its ChatGPT Deep Research agent, which allowed attackers to extract sensitive information through malicious emails without any user interaction. This vulnerability exploited the agent's ability to process emails, enabling attackers to send seemingly innocuous messages that contained hidden commands. These commands could instruct the agent to retrieve personal data from the user's inbox and send it to an attacker-controlled server, all without the victim's knowledge.