Cyware Daily Threat Intelligence, September 29, 2025

Exploiting SonicWall firewalls like a battering ram, Akira ransomware is surging through malicious SSL VPN logins. By targeting CVE-2024-40766, attackers bypass MFA, swiftly move laterally, and deploy ransomware within hours, harvesting credentials and exfiltrating data.

A cunning malvertising scheme lures victims with a fake Microsoft Teams installer to unleash Oyster malware. Using SEO poisoning via Bing, this signed installer creates a backdoor in under 15 seconds, though Microsoft Defender blocks its C2 communication attempts.

A zero-day flaw in Fortra’s GoAnywhere MFT software opens the door to remote command injection. This deserialization bug, exploited since September 10, allows attackers to create backdoor admin accounts, urging immediate upgrades to patched versions and restricted console access.

Top Malware Reported in the Last 24 Hours

First malicious MCP server discovered in npm

Researchers have identified the first-ever malicious Model Context Protocol (MCP) server, discovered within a rogue npm package named "postmark-mcp." This package, which imitated an official Postmark Labs library, introduced harmful functionality in version 1.0.16, released on September 17. The malicious code forwarded every email sent via the MCP server to the developer's personal email address. Despite attracting 1,643 downloads, the package was removed shortly after being flagged. 

Akira campaign targets SonicWall VPNs

Arctic Wolf has observed a significant increase in Akira ransomware attacks targeting SonicWall firewalls through malicious SSL VPN logins. Threat actors exploit the CVE-2024-40766 vulnerability, allowing them to gain initial access and bypass multi-factor authentication using valid credentials. Following the breaches, they quickly execute lateral movement within compromised networks, utilizing tools for internal scanning and Active Directory enumeration. The campaign features rapid deployment of ransomware, often within hours of initial access, with tactics including credential harvesting and data exfiltration. 

Hackers exploit Microsoft Teams, drop Oyster

A sophisticated malvertising campaign has targeted organizations using a weaponized Microsoft Teams installer to deliver the Oyster malware. This attack employs a multi-stage approach, starting with SEO poisoning that redirects victims from legitimate Bing searches to a malicious domain, teams-install.icu, disguised as a Microsoft property. The installer, digitally signed with a valid but short-lived certificate, allows attackers to bypass traditional security measures. Once executed, the malware establishes a backdoor for persistent access and attempts command-and-control communication with a server, but Microsoft Defender successfully blocks this connection. The rapid attack sequence is capable of compromising users in under 15 seconds.

Top Vulnerabilities Reported in the Last 24 Hours

Hackers exploit 0-day in GoAnywhere MFT

A critical vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT software is being actively exploited as a zero-day, allowing remote command injection without authentication. The flaw, a deserialization vulnerability in the License Servlet, can be exploited using a forged license response signature to gain unauthorized access. WatchTowr Labs confirmed evidence of exploitation dating back to September 10, eight days before Fortra's public advisory. Attackers used the vulnerability to create backdoor admin accounts and execute secondary payloads. System administrators are urged to upgrade to patched versions (7.8.4 or 7.6.3) and mitigate exposure by removing public internet access to the GoAnywhere Admin Console.

Severe bugs in Tile tracking tags

Researchers have uncovered significant privacy and security vulnerabilities in Tile tracking tags, which are used by over 88 million users globally. These flaws allow malicious actors to track users, bypass anti-stalking protections, and even impersonate Tile tags to falsely implicate individuals. The issues stem from unencrypted broadcasts and static MAC addresses, making Tile’s infrastructure susceptible to mass surveillance and abuse. Researchers found that Tile tags broadcast unencrypted MAC addresses and unique IDs, which can be intercepted by nearby Bluetooth devices or radio-frequency antennas. These broadcasts are also sent unencrypted to Tile’s servers, where they are likely stored in cleartext. This design flaw enables persistent tracking of users and their devices.