Cyware Daily Threat Intelligence, September 23, 2025

With fake job portals as bait, Iran’s Nimbus Manticore targets Europe’s defense and telecom sectors. Their spear-phishing campaign uses multi-stage DLL sideloading to deploy MiniJunk and MiniBrowse, stealthy malware evading detection with obfuscation to hit aerospace and defense networks.

The fezbox npm package, a wolf in utility library clothing, hides a cookie-stealing payload in QR codes. Linked to “janedu,” it uses steganography and reversed-string obfuscation to swipe usernames and passwords, quietly exfiltrating them to remote servers via HTTPS.

Libraesva ESG’s email scanning engine has a chink in its armor, letting attackers slip through with crafted attachments. This command injection flaw, exploited by a state actor, triggered rapid patches for ESG 5.x to secure systems against unauthorized command execution.

Top Malware Reported in the Last 24 Hours

Nimbus Manticore drops new malware

Nimbus Manticore, an Iranian APT group, is executing a sophisticated malware campaign targeting defense, telecommunications, and aerospace sectors in Europe. Utilizing advanced spear-phishing techniques, the group impersonates HR recruiters through fake job portals, delivering malware via multi-stage DLL sideloading. Their main tools, the MiniJunk backdoor and MiniBrowse stealer, are designed to evade detection through heavy obfuscation and legitimate digital signatures. The infection chain begins with phishing links leading to malicious archives disguised as hiring-related software. The malware exploits low-level Windows APIs to manipulate DLL search paths, ensuring stealthy execution. 

Malicious IIS module fuels SEO attacks

Operation Rewrite is an advanced SEO poisoning campaign orchestrated by Chinese-speaking threat actors using a malicious IIS module called BadIIS. This malware enables attackers to manipulate search engine results, redirecting unsuspecting users to scam websites for financial gain. By compromising legitimate servers, the BadIIS module intercepts web traffic and serves specially crafted content designed to improve the compromised site’s search ranking. The operation primarily targets East and Southeast Asia, as indicated by the malware's configuration and behavior. Multiple variants of the BadIIS module were identified, each employing different techniques to achieve SEO manipulation. The activity cluster is tracked as CL-UNK-1037, with links to the Group 9 threat cluster.

Malicious npm package steals browser credentials

A malicious npm package named fezbox has been identified, employing an innovative technique that uses QR codes for steganography to steal browser cookies containing usernames and passwords. Disguised as a utility library, fezbox executes a payload hidden within a QR code fetched from a remote URL, enabling attackers to access sensitive user data. The code is heavily obfuscated, utilizing methods such as reversed strings to evade detection. Once operational, the malware extracts user credentials from cookies and sends them to a remote server via HTTPS. The threat actor behind this campaign has been linked to the alias "janedu," with the malicious package still active on npm at the time of discovery. 

Top Vulnerabilities Reported in the Last 24 Hours

Critical vulnerability in Libraesva ESG

A critical command injection vulnerability, identified as CVE-2025-59689, has been found in Libraesva ESG, affecting versions 4.5 and above. This flaw allows attackers to execute arbitrary commands by sending specially crafted compressed email attachments, exploiting improper sanitization during the processing of these files. The vulnerability particularly targets the email scanning engine’s archive handling, enabling embedded commands to bypass security controls and execute on the underlying system. Following the discovery, Libraesva released emergency patches for various ESG 5.x versions, deploying fixes rapidly and automatically updating cloud customers. The firm confirmed one incident of active exploitation, which has been attributed to a foreign state actor.

American Archive of Public Broadcasting patches bug

A vulnerability in the American Archive of Public Broadcasting (AAPB) website allowed users to download protected media for years before it was patched. Exploited since at least 2021, the flaw involved an insecure direct object reference, enabling unauthorized access to private media by tampering with request parameters. This method circulated among Discord preservation groups, leading to significant leaks, including the unauthorized sharing of a Sesame Street episode.