Cyware Daily Threat Intelligence, September 26, 2025

China’s UNC5221 is sneaking Brickstorm into network appliances, lurking undetected for over a year. This Go-based backdoor, mimicking legit software, hits SaaS and tech firms with custom C2 servers, using zero-day exploits and obfuscation to maintain stealthy control.

North Korean hackers are reeling in crypto developers with fake LinkedIn job offers, hiding AkdoorTea malware. This Contagious Interview campaign uses BeaverTail and Tropidoor to pilfer data across platforms, spreading via deceptive GitHub projects and video assessments.

State-sponsored attackers are breaching Cisco ASA firewalls with zero-day exploits, unleashing RayInitiator and LINE VIPER. Linked to China’s UAT4356, these malware variants dodge detection by disabling logs, targeting government networks since May with persistent firmware tweaks.

Top Malware Reported in the Last 24 Hours

Brickstorm backdoor targets Edge devices

A China-linked cyber-espionage group, UNC5221, is exploiting network appliances that lack traditional EDR support to deploy a sophisticated backdoor called Brickstorm. Brickstorm mimics legitimate software, employs unique C2 servers per victim, and enables long-term stealth, with attackers persisting undetected for an average of 393 days. UNC5221 targets organizations like SaaS providers, tech companies, and BPOs, often exploiting both known and zero-day vulnerabilities in Linux and BSD-based systems. The malware is cross-platform, written in Go, and includes advanced features like SOCKS proxy functionality and delayed activation timers for stealth. Brickstorm uses obfuscation tools like Garble and dynamic domains for C2 servers, making detection and tracking difficult.

XCSSET malware evolves with new threats

A new variant of the XCSSET malware has emerged, specifically targeting macOS app developers by infecting Xcode projects. This advanced malware introduces sophisticated clipboard hijacking and improved data exfiltration capabilities. It utilizes encryption and obfuscation techniques, alongside persistent mechanisms like LaunchDaemon entries, making detection and removal more challenging. Notably, the malware features a module that continuously monitors the clipboard for cryptocurrency wallet addresses, replacing legitimate addresses with those controlled by attackers. Additionally, it targets Firefox browser data, extracting sensitive information such as passwords and credit card details, which are then sent to C2 servers.

Malicious Rust packages target crypto wallets

Two malicious Rust packages, faster_log and async_println, were found on Crates[.]io, the official Rust package repository, where they collectively garnered nearly 8,500 downloads. These packages impersonated the legitimate fast_log crate, copying its README and repository metadata to reduce suspicion. Once downloaded, the malicious code scanned developers' systems for sensitive information, specifically targeting Ethereum private keys and Solana addresses. The stolen data was then exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be operational during testing. Following the discovery, Crates[.]io removed the malicious packages and suspended the accounts of the attackers.

Contagious Interview campaign drops new backdoor

North Korean hackers associated with the Contagious Interview campaign are using a new backdoor called AkdoorTea to target cryptocurrency and Web3 developers across various operating systems. This campaign involves impersonating recruiters to lure victims with fake job offers on platforms like LinkedIn, leading them to install malware through deceptive video assessments or GitHub projects. Key tools employed include BeaverTail, InvisibleFerret, and TsunamiKit, which facilitate data exfiltration and cryptocurrency theft. The sophisticated malware Tropidoor, linked to the Lazarus Group, enhances stealth capabilities for file manipulation and monitoring. 

Top Vulnerabilities Reported in the Last 24 Hours

Cisco ASA firewalls targeted by malware attacks

Cisco ASA firewalls have been compromised by state-sponsored attackers exploiting recently disclosed zero-day vulnerabilities, CVE-2025-20362 and CVE-2025-20333. These attacks have led to the deployment of advanced malware known as RayInitiator and LINE VIPER, which utilize sophisticated techniques to evade detection, including disabling logging and intercepting commands. The threat actors, linked to a suspected China-based group, UAT4356, have targeted government agencies since May. The malware is designed to maintain persistence by modifying firmware and can execute commands, exfiltrate data, and bypass security measures. Additionally, a third critical vulnerability, CVE-2025-20363, has been identified but remains unexploited in the wild. 

Salesforce patches critical Agentforce bug

Salesforce's Agentforce platform was found to have a critical vulnerability known as ForcedLeak, which allows attackers to exfiltrate sensitive data from its CRM system through indirect prompt injection. This flaw exploits AI agents' expanded attack surface by inserting malicious instructions into external data sources. Attackers can manipulate the Web-to-Lead form to execute hidden commands, leading to the leakage of sensitive information to expired domains they control. The vulnerability stemmed from weaknesses in context validation and overly permissive AI model behavior, resulting in the potential for significant data breaches. Salesforce has since patched the issue.