Cyware Monthly Threat Intelligence

The Good

It’s always better to have strategic cybersecurity defenses and programs—and sufficient funds—in place than to be caught unaware by cyber threats. Realizing this, the DHS has taken the lead to fund cyber education for K-12 schools and the Senate has earmarked billions to help state and local agencies overcome security challenges. On the same lines, big tech companies have decided to come along and invest billions to bolster U.S. cybersecurity defenses.

The DHS is funding a program led by Cyber.org to bridge the infosec gap by teaching young children about cybersecurity. A framework of standards has been released, which details what needs to be taught to children until 12th grade.
The CobaltSpam tool developed by Mario Henkel can flood Cobalt Strike servers with fake beacons to debauch the internal databases of compromised systems. This would prevent attackers from differentiating between real and fake infections.
The U.S. Senate set aside more than $1.9 billion in cybersecurity funds for state and local governments to strengthen their cybersecurity posture and help organizations defend themselves.
Researchers presented a scheme—Pretty Good Phone Privacy—that can hide users’ locations from carriers with just a software upgrade.
Post a cybersecurity meeting at the White House, several tech companies, including Microsoft, Google, and Amazon, pledged to invest billions to enhance the nation’s cyber resilience.
The World Bank launched a new Cybersecurity Multi-Donor Trust Fund under the broader Digital Development Partnership umbrella program.

The Bad

In August, cryptocurrency theft reached a new high after hackers fleeced over around $730 million in cryptocurrency funds from Liquid Global, Cream Finance, and Poly Network. In a different stream, massive troves of personal records were exposed across different sectors, including healthcare, telecom, government, and others. Furthermore, insider threats came under the limelight as cybercriminals eye employees to be recruited as rogue insiders to plant malware.

Hackers robbed Liquid Global of crypto-assets worth at least $90 million from warm wallets. The firm has published cryptocurrency addresses from which the criminals exfiltrated their funds.
Indiana-based Eskenazi Health disclosed that a ransomware attack pilfered patient data and leaked the stolen information. In the aftermath, its EHR experienced a downtime.
A glitch found in Palantir—a secretive software program used by the FBI—enabled some employees to gain unauthorized access to confidential data. This went on for more than a year.
Cybercriminals swindled nearly $2.3 million from the employees of the Town of Peterborough, New Hampshire, using spoofed email accounts and forged documents, the Town administrator announced in a press release.
Attackers walked off with over $29 million in cryptocurrency assets from Cream Finance. Hackers used a reentrancy attack in its flash loan feature to steal AMP tokens and ETH coins.
Continued investigation of the T-Mobile breach revealed that over 40 million records of former or prospective customers were stolen, along with the personal data of about 7.8 million current postpaid customers. The same threat actor was observed selling 70 million AT&T user records.
Abnormal Security identified and blocked some emails from a hacker who attempted to recruit insiders to infect their employers’ networks with ransomware. The threat actor, allegedly, has ties with the DemonWare group.
Patient care services at Memorial Health System were disrupted owing to a ransomware attack by the Hive group. Clinical and financial operations also suffered. An alert was released later by the FBI warning against its increased activities.
DeFi platform Poly Network lost more than $600 million in a massive cryptocurrency heist. Hackers reportedly reversed more than $4,772,000 worth of assets in less than 24 hours. However, a majority of the funds have been returned to the firm.
The Joplin City government had to pay $320,000 in ransom to a ransomware group that briefly impacted the city’s COVID-19 dashboard, online utility payments, and court functions.
WizCase reported a breach affecting Reindeer, an American marketing company. The incident exposed over 50,000 files in a 32GB trove of data, owing to a misconfigured Amazon S3 bucket.
An unsecured Elasticsearch database exposed the household details of about 35 million residents across Chicago, San Diego, and Los Angeles online. The data included gender, full names, dates of birth, and marital status of users.
Scammers masqueraded as members of the SEC, FINRA, and other state securities regulators to trick investors into sharing more information. They created fake social media profiles and fake websites as a part of the phishing campaign.
An unsecured database at OneMoreLead laid bare a trove of PII containing around 126 million records for 63 million people in the U.S.

New Threats

Last but not least, a flurry of new threats emerged in the cybersecurity space last month. A new AdLoad malware variant was discovered bypassing Apple’s XProtect. In another rare occurrence, cybercriminals took advantage of Google’s reCAPTCHA function to hide their phishing campaigns. In other news, experts revealed that criminals can amplify DDoS attacks by abusing configurations in firewalls and middleboxes.

SentinelOne warned against a new AdLoad malware variant that bypasses Apple’s YARA signature-based built-in antivirus tech, XProtect, to infect macOS. The malware variant is connected with an ongoing attack campaign active since November 2020.
Pysa ransomware has been using a PowerShell script to seek out files containing the financial and personal information of victims. The script includes a list of 123 keywords that helps the threat actors perform manual sweeps of data.
A U.S.-based computer retail firm was targeted by the new SideWalk backdoor in a recent campaign by a Chinese APT. The backdoor shares multiple similarities with CROSSWALK, another backdoor used by the group.
A new malware campaign is distributing njRAT and AsyncRAT and targeting travel and hospitality facilities in Latin America. Techniques used in this campaign bear a resemblance to those of the Aggah group.
The CISA and FDA warned against BadAlloc security flaws in BlackBerry’s QNX RTOS used by critical infrastructure organizations, including healthcare, aerospace and defense, and industrial networks.
Cybercriminals are increasingly deploying CAPTCHA-protected malicious URLs to bypass security walls while adding counterfeit login for lottery and survey pages, according to researchers at Palo Alto Networks.
New research explains how firewalls and other network middleboxes can be exploited by cybercriminals to launch massive TCP-based DDoS reflection amplification attacks.
AllWorld Cards, a new criminal carding marketplace, is being promoted by a threat actor who published a million credit cards stolen between 2018 and 2019. As per a ransom sampling of 98 cards, 27% of them were still active.
A new strain of the eCh0raix ransomware has been seen targeting Synology NAS and QNAP NAS devices. Findings until June suggest that the gang has earned a considerable amount of ransom from Small Office and Home Office (SOHO) users.
FlyTrap, a new Android trojan packaged under fraudulent apps, reportedly compromised Facebook accounts of more than 10,000 users in at least 144 countries since March 2021.
Virtual meetings, such as Zoom, Microsoft Teams, and Skype, can fall prey to an exotic attack named Glowworm. This enables threat actors to eavesdrop on confidential conversations by measuring the LED power light changes in an audio output device and converting them to audio reproductions.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

Jul 1, 2025