Cyware Monthly Threat Intelligence

The Good

Considering the exigency around COVID-19 themed cyberattacks, various industry leaders have stepped up to ensure enhanced and collaborative security practices. Last month, Microsoft released new security guidelines to safeguard against attacks on employees working from home during the pandemic. Also, the US Office for Civil Rights (OCR) dropped HIPAA penalties for community-based testing sites to assuage the operations of healthcare providers. Meanwhile, the two tech giants, Microsoft and Google, updated their respective cloud computing services to improve the security of data processing.

Microsoft published new threat intel and security guidance for individuals and organizations in the wake of rising incidents of phishing and social engineering attacks that have hit every country during the coronavirus pandemic.
The Office for Civil Rights (OCR) announced to lift penalties around HIPAA compliance for 19 community-based testing sites during the pandemic. Previously, the agency had also carved out exceptions for business associates, first responders, and telehealth use to ease operations during the COVID-19 pandemic.
Google has adapted its machine learning models to improve Gmail’s security against COVID-19-themed phishing email attacks. Using these models, Gmail malware scanners have blocked around 18 million phishing and malware emails, and more than 240 million spam messages (using COVID-19 baits), within seven days.
Microsoft and Google announced updates for their respective virtual machine (VM) instances storing highly confidential information processed in Microsoft Azure and Google Compute Engine cloud platforms.

The Bad

While the lockdown keeps everyone worried, hackers continue to upgrade capabilities of malicious exploits while enhancing their attack techniques. A security researcher reported multiple online firms blurting out email data of their customers to third-party advertising and analytics companies. In other news, hackers put 530,000 Zoom login credentials for sale on an underground marketplace. Also, Travelex paid $2.3 million ransom in bitcoin to get hold of their stolen data.

A researcher reported multiple popular websites exposing millions of user email addresses to advertising and analytics companies. The websites included Quibi.com, JetBlue.com, KongHQ.com, NGPVan.com, Mailchimp’s Mandrill.com, WashingtonPost.com, and Wish.com.
Hackers put 530,000 Zoom login credentials for sale on hacker forums for a price of $0.0020 per account. The hacker(s) had gathered these account details from third-party data breaches rather than hacking Zoom directly.
Le Figaro, a popular French daily newspaper, exposed 7.4 billion records due to a misconfigured Elasticsearch database. The exposed PII data included full names, emails, home addresses, countries of residence, postcodes, IP addresses, server access tokens, and passwords for new users.
Unknown activists posted nearly 25,000 email addresses and passwords belonging to the National Institutes of Health (NIH), World Health Organization (WHO), Gates Foundation, and other groups working to combat the coronavirus pandemic. The lists were posted on 4chan, Pastebin, Twitter, and Telegram.
An unsecured database owned by the email delivery and marketing firm, Maropost, leaked about 95 million email records and email logs in a data breach. The leaked email logs contained relevant metadata, such as the exact date and time when the emails were sent. The database, which was hosted on a Google cloud server, was taken offline on April 1, 2020.
Cybercriminals breached the database of the Aptoide app store to steal 39 million user records. Out of these, 20 million user details, including login emails and hashed passwords, were published on a popular hacker forum.
Nearly 9 million travel logs belonging to British citizens were exposed due to a glitch in Sheffield City Council’s automatic number-plate recognition (ANPR) system. The exposed records included number plates and travel logs going through Sheffield’s road network. In a different incident, GDPR.EU had also leaked Git data and passwords due to a flaw in the website.
The US Small Business Administration (SBA) revealed that the personally identifiable information (PII) for some of the financial relief loan applicants may have been exposed to other applicants online. The incident occurred due to a security flaw in the loan application site. The issue was immediately resolved and the application portal was relaunched to avoid exposure of sensitive data.
Personal and contact details of 1.41 million US-based doctors stolen from qa.findadoctor[.]com were also put up for sale by a cybercriminal. The compromised data included full names, genders, locations, mailing addresses, country, phone numbers, and license numbers of doctors.
Travelex disclosed that it paid a ransom of $2.3 million in bitcoin to the Sodinokibi group to get back their stolen data and restore operations. The attack had taken place during the New Year’s eve of 2020. The Sodinokibi ransomware operators had stolen nearly 5 GB of data from the firm during the attack.

New Threats

Among new threats, FPGA chips were found to be affected by two flaws that could expose several critical systems to attack. Also, researchers discovered several new malware like EventBot, LeetHozer botnet, Asnarök trojan, and more, last month. Additionally, the Trickbot trojan made a comeback, leveraging the Family and Medical Leave Act (FMLA) to create lures related to COVID-19.

A group of academics demonstrated a new technique to break into Field Programmable Gate Array (FPGA) systems by using FPGA’s own encryption engine. The technique involved abusing a MultiBoot function that allows users to specify an address to begin execution after reboot.
Researchers discovered EventBot, which targeted banking apps and cryptocurrency wallets for Android, whereas LeetHozer botnet exploited the telnetd service on targeted devices to launch DDoS attacks. The Asnarök trojan was used in an attack campaign that exploited a zero-day SQL injection vulnerability in Sophos firewall products.
A new campaign, dubbed ‘Project Spy’ distributed spyware through a fake ‘Coronavirus Update’ app to infect Android and iOS devices. The app gained a small number of downloads in Pakistan, India, Afghanistan, Bangladesh, Iran, Saudi Arabia, Austria, Romania, Grenada, and Russia.
Researchers observed a new bitcoin-mining campaign, targeting misconfigured open Docker Daemon API ports. It has been found that thousands of attempts are being made every day to compromise such containers as part of the campaign. The purpose of these attacks is to deploy Kinsing malware in the final stage of the infection to run cryptominers.
Kpot v2.0 trojan made a comeback in a COVID-19-themed attack campaign that targeted Internet Explorer users. The malware was distributed through the Fallout exploit kit embedded in malicious advertisements on websites.
A sophisticated PhantomLance campaign, which has been active since 2015, continues to target Android users in Southeast Asia. The campaign is still ongoing and is operated by the OceanLotus APT group.
US taxpayers were targeted by a new variant of NetWire RAT designed to steal credentials and tax information from victims. The malware was distributed via IRS-themed phishing emails that carried an attachment with a legacy Microsoft Excel 4.0 macro to evade detection.
Trickbot trojan made a comeback in a phishing campaign that leveraged the Family and Medical Leave Act (FMLA) to create lures related to COVID-19. The trojan was distributed via emails that appeared to come from the US Department of Labor (DoL).
Ten critical vulnerabilities were found in HP Support Assistant, exposing Windows computers to remote code execution attacks. Those could allow attackers to elevate privileges or to delete arbitrary files. The flaws include five local privilege escalation flaws, two arbitrary file deletion vulnerabilities, and three remote code execution vulnerabilities.
The cryptomining botnet dubbed DDG was updated by its authors to adopt a proprietary peer-to-peer (P2P) mechanism. The botnet, first reported by Netlab 360 researchers in January 2018, had undergone 16 different updates over the past three months to become a highly sophisticated and seemingly unstoppable threat, according to the researchers. The botnet can fully function using its P2P protocol as a failsafe, even after its C2 servers are taken down.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

Jun 1, 2025