Cyware Monthly Threat Intelligence

The Good

A coordinated law enforcement operation successfully shut the shop for ValidCC, a dark web marketplace involved in trading stolen payment card data for more than six years. Meanwhile, the rise in ransomware incidents on healthcare facilities compelled CIS to launch a malicious domain identifier and blocker service. Also, an open-source tool is now available for those who are willing to find unsecured databases.

The Center for Internet Security launched Malicious Domain Blocking and Reporting (MDBR), a no-cost ransomware protection service, available for every healthcare facility through the Multi-State Information Sharing and Analysis Center.
A coordinated law enforcement operation successfully shut the shop for ValidCC, a dark web marketplace involved in trading stolen payment card data for more than six years.
Cyber analysts and researchers from ten organizations, including the Scottish Government and Police Scotland, have joined hands to collaborate and enhance cyber-resilience while educating organizations and individuals on cybersecurity.
The Password Checkup feature was introduced for Android devices, as a part of the Autofill with Google mechanism. This feature will check stored passwords against a database containing records from public data breaches to see if the password was previously leaked.
CyberArk researchers released BlobHunter, an open-source tool organizations can use to discover unsecured Azure blobs containing sensitive files. It audits Azure storage accounts and checks their file access levels.

The Bad

The month touched a new low when state actors attempted to poison a water facility in Florida and risk tens of thousands of lives. Further, the incidents at Accellion and SolarWinds software continue to claim victims while acting as a wake-up call for organizations and government agencies that work with third-parties. Besides, there was a utility scam threatening customers to make immediate payments for fake overdue bills.

Singtel, Bombardier, QIMR Berghofer Medical Research Institute, Washington’s State Auditor office, QIMR Berghofer Medical Research Institute, and Transport for NSW suffered breaches due to vulnerabilities in Accellion’s file-sharing system. While Singtel exposed data of 129,000 customers, the State Auditor office leaked data of 1.6 million employment claims.
A new report from the White House revealed that the SolarWinds hack had breached almost 100 U.S. companies, making them potential targets for follow-up attacks. Moreover, it was disclosed that more than 1,000 hackers rewrote around 4,000 of the millions of lines of code in the SolarWinds Orion update to launch the attack.
Finnish therapy psychotherapy practice firm, Vastaamo, declared bankruptcy after falling victim to a horrific security breach. The problem first began in 2018, when the firm discovered that a database of customer details and notes had been accessed by hackers.
French authorities warned the country’s healthcare sector of the discovery of stolen credentials, apparently belonging to hospital workers. The credentials were put for sale on the dark web.
Texas-based Austin Energy issued a warning about a scam that threatens customers to pay their pending bills. The scammers pretend to be from the company and warn customers that their utilities will be disconnected if they don’t make immediate payment.
Conti ransomware operators published patients’ data stolen from two U.S. hospital chains. The affected organizations are the Florida-based Leon Medical Centers and Nocona-General Hospital in Texas.
The IRS and Security Summit financial industry partners warned against scams aimed at stealing personal information from taxpayers. Adversaries reportedly sent fake emails impersonating IRS Tax E-Filing and asked recipients for their EFIN.
The Cuba ransomware gang launched an attack against the Automatic Funds Transfer Services (AFTS) leading to several data breach notifications from agencies in Washington and California.
A database belonging to Ukraine’s PrivatBank was offered for sale on a popular hacking forum. It contained 40 million records consisting of full names, dates of birth, places of birth, passport details, and phone numbers of customers.
An attacker hacked into a water treatment plant in Oldsmar, Florida, in an attempt to poison the water supply by increasing the level of sodium hydroxide, also known as lye.
The website of the U.K cryptocurrency exchange EXMO was knocked offline following a DDoS attack. This had affected the whole network infrastructure, including the website, API, Websocket API, and exchange charts.
The data of 3.2 million DriveSure clients were available on the Raidforums hacking forum late last month. The information exposed included names, addresses, phone numbers, email addresses, IP addresses, car makers, car service records, dealership records, and car models.

New Threats

The world witnessed threats that were complex, multi-staged, and had capabilities to subdue security controls. In a disclosure, experts revealed that at least four attack groups exploited multiple zero-day in Accellion software. Researchers uncovered two mysterious Mac M1 malware with distinct abilities. Actors hijacked about 500 Windows and Linux devices in one of the largest Monero cyptojacking attacks.

Researchers identified UNC2546 and UNC2582 threat actors in connections with the FIN11 and the Clop ransomware gang as the cybercriminal groups behind the global zero-day attacks on users of the Accellion FTA product.
Cyber experts discovered two new pieces of malware, in a span of two weeks, impacting Apple’s recently introduced M1 System-on-Chip (SoC). The first malware was an adware variant of Pirrit and less harmful, whereas the second malware, dubbed Silver Sparrow, had infected at least 30,000 devices across 153 countries.
Researchers tracked a cryptojacking campaign that was active for almost two years and involved the use of the WatchDog botnet. The operators had used 33 different exploits to target 32 vulnerabilities in Drupal, Elasticsearch, Redis, SQL Server, ThinkPHP, Oracle WebLogic, and Spring Data Commons.
A new variant of the Masslogger trojan was discovered to be used in attacks aimed at stealing Microsoft Outlook, Google Chrome, and Messenger service account details. The campaign is currently focused on victims in Turkey, Latvia, Spain, Bulgaria, Hungary, Estonia, Romania, and Italy.
Russian-linked threat actor group Sandworm was linked to a three-year-long stealthy operation that targeted several French entities. The intrusion, which started in late 2017 and lasted until 2020, was carried out by exploiting an IT monitoring tool called Centreon.
Researchers demonstrated a new class of attacks called Shadow attacks that could let attackers replace content in digitally signed PDF documents. The attack has been successful on 16 PDF viewers, including Adobe Acrobat, Foxit Reader, Perfect PDF, and Okular.
BendyBear, a highly sophisticated malware, was potentially linked to the BlackTech hacking group. The malware has features and behavior that strongly resembles the WaterBear malware family that has been active since 2009. It leverages the existing Windows registry key that is enabled by default on Windows 10.
Security experts warned of a new COVID-19 vaccine phishing scam that tricks users into handing over their personal and financial information. The scams involved informing recipients that they have been selected for a job based on their family and medical history.
Chinese cyberespionage gang TA413 launched attacks against Tibetan organizations using a malicious Firefox add-on. Dubbed FriarFox, this add-on allowed the hackers to steal Firefox and Gmail browser data, along with delivering malware on infected computers.
Researchers spotted a new component of the Trickbot malware that performs local network reconnaissance. Named masrv, the component enables threat actors to send a series of Masscan commands to scan the local networks for the further infection process.
New details emerged about malicious extensions for Chrome and Edge browsers. These extensions collectively called CacheFlow were found hijacking clicks to links in search result pages to redirect unsuspecting users to phishing sites and ads.
A new variant of the Mirai botnet Matryosh came to light that has primarily been designed to launch DDoS attacks. Research claims that the botnet’s command format and its use of TOR C2 are highly similar to that of another botnet called LeetHozer.
Researchers uncovered two malware families called Hornbill and Sunbird targeting military, nuclear, and election entities in India and Pakistan. The two malware are capable of exfiltrating SMS messages, encrypted messaging app content and geolocation, and other sensitive information.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Related Threat Briefings

Jun 1, 2025