Cyware Daily Threat Intelligence, September 25, 2025

Cloaked in fake copyright notices, the Lone None group is sneaking Pure Logs and Lone None Stealer into systems. Spoofing legal firms, their phishing emails use Telegram bots and obfuscated Python to steal crypto wallet addresses, targeting social media accounts with high credibility.

Russia’s COLDRIVER is baiting victims with a fake CAPTCHA in the ClickFix campaign. Using BAITSWITCH to download SIMPLEFIX, a PowerShell backdoor, this multi-stage attack targets Russian civil society and Western groups, gathering system data via stealthy C2 communication.

A critical zero-day flaw in Cisco’s IOS and IOS XE software is under active attack. This SNMP stack overflow bug lets admins run root-level code, affecting Meraki and Catalyst devices, with patches addressing 14 vulnerabilities to curb DoS and authentication risks.

Top Malware Reported in the Last 24 Hours

Hidden WordPress backdoors compromise site security

During a recent cleanup of a compromised WordPress site, two malicious files were discovered that allowed attackers to maintain unauthorized access. The first file, DebugMaster.php, masqueraded as a legitimate plugin while creating a secret admin user and hiding its presence from plugin listings. It communicated with a remote server, sending stolen credentials encoded in JSON. The second file, wp-user.php, ensured that a specific admin account always existed, recreating it if deleted. Together, these files established a robust system for persistent access, enabling attackers to control the site, inject spam, or steal information. 

Lone None group exploits copyright takedowns

Threat actors from the Lone None group are leveraging copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and the newly identified Lone None Stealer. This campaign begins with spoofed emails that appear to come from legitimate legal firms, referencing real social media accounts to enhance credibility. The malware is delivered through obfuscated Python installers and malicious attachments disguised as legitimate applications. Lone None Stealer specifically targets cryptocurrency transactions by monitoring clipboard activity and replacing copied wallet addresses with those controlled by attackers. The campaign employs a novel C2 mechanism using Telegram bots, with payloads featuring multiple layers of obfuscation to evade detection.

LNK malware exploits Windows files for attacks

A recent campaign has seen the resurgence of LNK malware, where attackers exploit Windows shortcut files to deliver a RAT. Victims are tricked into downloading a file named “cyber security.lnk” from Discord, which, upon execution, opens a decoy PDF while running a hidden PowerShell script in the background. This script uses legitimate Windows binaries, such as odbcconf.exe, to stealthily register and execute malicious DLLs, complicating detection efforts. The malware creates a working directory to store its components and extracts an embedded decoy PDF from the LNK file. It modifies system registry settings to ensure persistence and establishes communication with a Command-and-Control server for further commands. 

COLDRIVER expands arsenal with new malware

Zscaler ThreatLabz identified a multi-stage ClickFix campaign linked to the Russia-based APT group COLDRIVER, targeting members of Russian civil society and Western organizations. This campaign utilizes social engineering techniques, tricking users into executing malicious commands through a fake CAPTCHA interface. The infection chain begins with BAITSWITCH, a downloader that establishes persistence and retrieves payloads to deploy SIMPLEFIX, a PowerShell-based backdoor. BAITSWITCH communicates with a C2 server using a specific user-agent and executes commands via PowerShell. SIMPLEFIX supports various reconnaissance commands, allowing the threat actor to gather information about the victim's system. 

Top Vulnerabilities Reported in the Last 24 Hours

Cisco patches 14 bugs and a 0-day

Cisco has released patches for 14 vulnerabilities in its IOS and IOS XE software, including a critical zero-day flaw, CVE-2025-20352, which is being actively exploited. This vulnerability allows remote attackers with administrative privileges to execute arbitrary code as the root user by exploiting a stack overflow in the Simple Network Management Protocol (SNMP) subsystem. All devices running vulnerable versions of IOS and IOS XE, along with certain Meraki and Catalyst switches, are affected. The updates also address additional high-severity vulnerabilities that could result in denial-of-service conditions, command execution with root privileges, and authentication bypass, among other risks. 

Supermicro BMC flaws enable persistent backdoors

Two critical vulnerabilities in Supermicro's Baseboard Management Controller (BMC) firmware, identified as CVE-2024-10237 and CVE-2025-6198, allow attackers to install malicious firmware, potentially creating persistent backdoors. The first vulnerability enables attackers to bypass security checks and inject malicious firmware while maintaining valid signatures, thus appearing legitimate. The second vulnerability stems from flawed validation logic, allowing modifications to the kernel and other firmware regions without proper authentication. Researchers from Binarly demonstrated that both vulnerabilities could lead to complete control over the server, enabling persistent threats across reboots and operating system reinstalls. Supermicro has confirmed these issues and released firmware fixes for affected models.