Cyware Monthly Threat Intelligence

The Good

Small and medium-sized enterprises (SMEs) are just as exposed to the risk of cyberattacks as larger organizations. The Ransomware Task Force (RTF) has released a new blueprint—containing over 40 recommendations—to help SMEs defend against growing ransomware threats. The number of autonomous (unmanned) vehicles is growing and so is the concern for their safety. A cybersecurity company has been roped in to study threats and outline cybersecurity standards for the same. Also, read about the new Traffic Light Protocol standard (TLP 2.0) for information disclosure, introduced after five long years.

The RTF introduced the ‘Blueprint for Ransomware Defense.’ It includes a set of actionable measures for SMEs to protect against and respond to ransomware and other common cyberattacks. It contains defensive actions and preventive controls for enterprise asset and software inventory management, vulnerability management, malware defense, training, data recovery, incident response, and more.
A trade group representing producers of unmanned drones, airplanes, boats, cars, and other vehicles has teamed up with a cybersecurity company to develop security standards for the autonomous vehicles market. These include applying effective encryption and authentication tools around remote operations and connectivity, looking at third- and fourth-party suppliers in the supply chain, and evaluating the security of products.
The U.S. Cyber Command’s Cyber National Mission Force has successfully concluded 35th ‘Hunt Forward’ operations in 18 countries, including Estonia, Lithuania, Montenegro, North Macedonia, and Ukraine. The last one took place in Croatia. These operations are carried out to help countries across the globe to uncover advanced malware and defend against incoming cyberattacks.
The Forum of Incident Response and Security Teams (FIRST) has released the version 2.0 of Traffic Light Protocol (TLP), five years after the release of the initial version. In the new update, the TLP:WHITE level has now been renamed TLP:CLEAR. Also, TLP:AMBER has been modified to add another sub-level named TLP:AMBER+STRICT.

The Bad

The month of August witnessed the first known phishing attack against PyPI; it included a message about implementing a validation process in the targeted package repository but contained a link to a fraudulent site. Threat groups from China, such as APT41 and RedAlpha, were also in the spotlight for claiming victims in the government and private sectors. Attacks on crypto and other blockchain-based platforms continued with adversaries swiping $200 million from Nomad and another group draining nearly $6 million from the Solana network.

Group-IB researchers estimated that the state-sponsored APT41 hacker group, aka Winnti, had targeted at least 13 organizations worldwide in 2021. The targeted organizations included the public sector, manufacturing, healthcare, logistics, hospitality, and media. In its campaigns, the group used tools such as Acunetix, Nmap, SQLmap, subdomain3, subDomainsBrute, and Sublist3r for reconnaissance.
In a mix-up, the Cl0p ransomware gang claimed attacks and stole data belonging to South Staffs Water believing it to be for Thames Water. The attackers had stolen more than 5TB of data from the organization and also asserted that they had access to some SCADA systems.
Cryptocurrency service Nomad suffered a major setback after hackers drained almost $200 million in digital funds from the company within a few hours. The attacker exploited a security flaw in the blockchain bridge to steal the funds.
For the past three years, the China-based cyberespionage group RedAlpha, aka Deepcliff and Red Dev 3, has been observed targeting numerous government organizations, humanitarian entities, and think tanks. The purpose of these campaigns is to harvest credentials from the targeted individuals and organizations.
An unknown actor drained funds from approximately 8,000 wallets on the Solana network, causing a loss of approximately $8 million. The funds were drained from internet-connected hot wallets that include Phantom, Slope, and TrustWallet.
One of the largest platforms for trading CS:GO in-game skins, CS.MONEY was attacked and the website was pulled down. Attackers reportedly stole 20,000 items worth nearly $6 million. The attack spurred out of 100 controlled bot accounts pursuing thousands of transactions, stealing the items to their own accounts. All the stolen skins transferred are in trade-lock now.
Over 35,000 software repositories on GitHub were discovered distributing malware. Threat actors created copies of legitimate projects including crypto projects, Golang, Python, Docker, JavaScript, and bash to trick unsuspecting developers into downloading the malware.
More than 20 malicious PyPI packages designed to steal passwords and other sensitive information from victims’ machines were uncovered in a new software supply chain attack. In a similar vein, PyPI warned Python project managers about the first known phishing attack against its community, aimed at stealing credentials and initiating supply chain attacks.
The sophisticated scam-as-a-service operation dubbed Classiscam has now expanded to Europe. Active for more than a year, the scam especially targets people using online marketplaces and services relating to property rentals, hotel bookings, online bank transfers, online retail, ride-sharing, and package deliveries.
A large-scale phishing campaign was found abusing Google Sites and the Microsoft Azure Web app to create fake websites for Coinbase, MetaMask, Kraken, and Gemini. These fake websites are being used as channels to target people’s crypto wallets and their assets.
Microsoft disclosed a potential connection between the Raspberry Robin malware and a Russian cybercrime group - Evil Corp. The company’s researchers discovered that the Raspberry Robin Windows worm was being used to deliver the FakeUpdates malware. It is believed that the Raspberry Robin malware was deployed on the networks of hundreds of organizations across a wide range of industry sectors.
A massive phishing campaign codenamed 0ktapus leveraged compromised Okta identity credentials and bypassed two-factor authentication to gain initial access to victims’ computers. Over 130 organizations, including Twilio, MailChimp, and Klaviyo, located in the U.S. and Canada are affected by the campaign.
Accelya—a technology firm providing services to Delta, British Airways, JetBlue, United, Virgin Atlantic, and American Airlines—confirmed that it was targeted by the BlackCat ransomware group. The group has reportedly stolen emails, and worker contracts from the firm, a part of which was also published on the group’s data leak site.
Hospitality and travel industry firms located in Latin America, North America, and Western Europe are under attack from TA558 threat actors. The actors are using phishing emails to pivot the campaign that has been ongoing since the beginning of the year.

New Threats

Let’s now learn about the new threat developments in the cybercrime world over the past month. At least two separate campaigns were linked to the infamous North threat group, Lazarus. In one of the campaigns, it distributed a stealthy macOS malware disguised as a job description for Coinbase. In other news, criminals impersonated Atomic Wallet to try and distribute the Mars Stealer malware. Meanwhile, cybercriminals are dumping Cobalt Strike for Sliver to make their attacks even more destructive.

A new class of HTTP request smuggling attacks can enable threat actors to compromise multiple popular websites. Named browser-powered desync, the attack can be used to compromise Amazon sites and those using the AWS Application Load Balancer, Cisco ASA WebVPN, Akamai, Varnish Cache servers, and Apache HTTP Server 2.4.52.
Andariel, a subgroup of Lazarus, uses Maui ransomware and DTrack spyware, to carry out financially motivated attacks on companies. Reports suggest that multiple organizations located in India, Vietnam, and Russia were the target of such attacks in 2021.
DeathStalker APT has upgraded the capabilities of VileRAT to perform more sophisticated attacks on foreign exchange and cryptocurrency trading companies. Researchers have observed multiple samples of the malware in the wild, with the latest sample identified in June.
A new signed macOS malware sample developed by Lazarus APT group is being distributed via fake job offer emails from Coinbase. It is linked to the infamous ‘Operation Interception’ campaign that had earlier targeted high-profile aerospace and military organizations.
A new RAT called Escanor is being advertised on the dark web and Telegram by attackers who go by the same name. The malware is delivered via weaponized Microsoft Office documents. The malware can target Android phones and computers.
Hackers are adopting the Sliver toolkit as an alternative for Cobalt Strike to launch a variety of attacks, including ransomware operations. One group that adopted Sliver is tracked as DEV-0237. However, the use of Sliver by cybercriminals isn’t new. Russian APT29 has also used Sliver to keep access to compromised environments.
A dodgy Chrome extension called ‘Internet Download Manager’ installed by more than 200,000 users was found to be adware in disguise. Once installed, it exhibited unwanted behavior such as opening links to spammy sites, changing the default search engine browser, and showing pop-ups about patches and unwanted programs.
A new data extortion group named Donut Leaks was linked to recent cyberattacks on various organizations including DESFA, Sheppard Robson, and Sando. The hacker group is likely a pentester or an affiliate for Hive, Ragnar, and possibly other ransomware groups.
A new ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. Dubbed Agenda, the ransomware can be customized and shares similarities with the BlackBast, BlackMatter, and REvil ransomware.
Researchers have documented PoC exploits for Evil PLC attacks against seven ICS manufacturers: Rockwell Automation, Schneider Electric, GE, B&R, Xinje, OVARRO, and Emerson. A hijacked PLC can be used to compromise engineering workstations, which in turn, can open doors to other potential cyberattacks.
Security researchers discovered a new vulnerability called ParseThru affecting Golang-based applications. The issue stems from changes introduced to Golang's URL parsing logic that's implemented in the "net/url" library. It could be abused to gain unauthorized access to cloud-based applications.
A new malware called Woody RAT has been in the wild for at least one year. This advanced custom trojan is used to target Russian entities by using lures in the form of archive files and, more recently, Office documents leveraging the Follina vulnerability.
A fake website masquerading as the official Atomic Wallet website was found spreading copies of Mars infostealer. The website was promoted on social media, with direct messages on various platforms, SEO poisoning, and spam emails. The fake site even featured a contact form, email address, and FAQ section.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

Jun 1, 2025