Cyware Monthly Threat Intelligence

Monthly Threat Briefing • February 1, 2024

The Good

With cloud environments facing an ongoing battle against complex cyber threats, the NCSC stepped in to help SMBs enhance cloud service security. Account takeovers are the ultimate impersonation tactic and pose a significant threat. To tackle it, a research group devised a method to quickly identify account takeover vulnerabilities before criminals abuse them.

The NCSC-U.K released a guideline, named Using Online Services Safely, to help SMBs reduce the likelihood of cyberattacks when using cloud services. Some of the recommendations include having a backup for critical data and protecting admin accounts. The guidelines aim to protect organizations’ data, assets, and reputations from rising cybercrimes.
The Australian Cyber Security Center published a guideline on how business leaders can secure their devices, social media accounts, and communication channels from cyber threats. Some recommendations include enabling MFA, updating software and applications, installing programs from trusted sources, enabling security features on messaging apps, using screen locks on all devices, and backing up important files.
Computer science researchers developed a new method to identify security weaknesses that make people vulnerable to account takeover attacks, where unauthorized access is gained to online accounts. They found that device manufacturers and app developers could adopt the method to understand complex hacking attacks and improve security measures.
Amidst the surge in the adoption of AI technologies globally, the Aspen Institute, in collaboration with Global Cybersecurity Working Groups, released a list of cybersecurity recommendations for governments and industries to mitigate the security risks related to AI. Some of these recommendations include ensuring rules of engagement, reviewing logs, and improving understanding of AI software.

The Bad

It wasn’t a great month for some entities in the crypto industry including the likes of Orbit Chain and Ripple as millions were lost. Meanwhile, LockBit looked determined with several victims under its belt with Foxsemicon and Capital Health to name a few. Schneider Electric and Mercedes-Benz also suffered breaches in separate incidents.

Ripple co-founder and executive chairman, Chris Larsen, fell victim to a cryptocurrency theft, losing around $112 million worth of XRP from his personal wallet. The hackers targeted Larsen's accounts, while the official @Ripple account remained unaffected. Larsen, along with support from other exchanges, swiftly detected the fraudulent activity and froze the compromised address. The theft involved an attempt to launder the stolen funds through various crypto exchanges and platforms.
Concentra Health Services, a Texas-based therapy provider, disclosed a data breach impacting nearly 4 million patients due to a hack at Perry Johnson & Associates (PJ&A), a medical transcription vendor. The PJ&A incident, affecting at least 14 million patients, involved unauthorized access to PJ&A's network between March 27, 2023, and May 2, 2023. Concentra, Northwell Health, Crouse Health, and others were affected.
The Kansas City Area Transportation Authority (KCATA) revealed that it experienced a ransomware attack. While services such as fixed-route buses and paratransit remain unaffected, call centers faced operational disruptions. The Medusa ransomware gang claimed responsibility for the attack and demanded $2 million in ransom. To extend the deadline for payment, the group has asked to pay $100,000/day.
Schneider Electric suffered a data breach in its Sustainability Business division. The Cactus ransomware group claimed responsibility, asserting the theft of terabytes of corporate data. The incident disrupted Schneider Electric's Resource Advisor cloud platform services, while other company divisions remained unaffected. Notably, experts are unaware of the presence of the ransomware group’s leak site.
Researchers from RedHunt Labs discovered a significant security lapse at Mercedes-Benz, where a private key and authentication token were unintentionally left accessible online. The exposed token could provide unrestricted access to the company's GitHub Enterprise Server, resulting in the exposure of source code, cloud access keys, blueprints, single sign-on passwords, API keys, and more. The affected repositories also contained Azure and AWS credentials.
An unsecured storage instance leaked over 12TB of data, including 26 billion records, from several companies such as X, Tencent, Weibo, Dropbox, LinkedIn, Adobe, and Canva, among others. The leak also included records of various government organizations in the U.S., Brazil, Germany, Turkey, and the Philippines.
A ransomware group called Slug claimed that it stole 1TB of data in an attack at AerCap, the world's largest aircraft leasing company. While the group revealed no further information, the firm claimed in the SEC filing that there was no financial loss and that all systems were under control.
Semiconductor manufacturer Foxsemicon and healthcare service provider Capital Health fell victim to a LockBit ransomware attack last month. It threatened to leak 7TB of allegedly stolen data from Capital Health. In another instance, the group added two new victims to its dark web portal - Maisons de l’Avenir in France and Shinwa Co in Japan.
A €10 million ($11 million) ransom demand followed after a crippling attack on the Calvià City Council in Majorca, Spain, impacting municipal services. Administrative deadlines were suspended until January 31. Forensic analysis was underway to understand the impact of the attack. While citizen services were reachable by phone, urgent document submissions can be made through the General State Administration portal. The mayor refused to pay the ransom.
Melbourne-based travel agency Inspiring Vacations experienced a significant data leak, with a 26.8GB database left publicly accessible without any security measures. The database contained 112,605 records, including high-resolution passport images, travel visa certificates, itinerary or ticket files, and personal information of 13,684 customers. The incident also impacted internal company documents, including 17,000 tax invoices to partners and affiliates.
A cyberattack at VF Corp affected the personal data of 35.5 million customers. The firm reported the data breach to regulators in a filing, however, there was no mention of the kind of data stolen in the attack. ALPHV (or BlackCat) ransomware group claimed credit for the breach.
Documents belonging to the Swiss Air Force were leaked on the dark web following a data breach at U.S. security company Ultra Intelligence & Communications. The breach, attributed to the BlackCat ransomware group, exposed approximately 30GB of sensitive data, including a $5 million contract between the Swiss Department of Defence and Ultra Intelligence & Communications for encrypted communication technology.
The Ministry of Foreign Affairs for the Kingdom of Saudi Arabia suffered a massive data breach that exposed the personal information of more than 1.4 million employees. The incident came to light after a threat actor named Zelda shared details of the data breach on a dark web forum, along with a 600MB file containing records of ID, GUID, Arabic names, display names, full names, associated departments, and job titles of employees.
Orbit Chain lost $86 million in Ether, Dai, Tether, and USD Coin in a security breach. Although the identity and origin of the attackers could not be determined immediately, it is believed to be the work of state-sponsored attackers based out of North Korea. The blockchain platform was working with South Korean police authorities to track the stolen funds and warned users to be wary of phishing sites pretending to be connected with their wallets.
A hacker group, identified as ‘irleaks’, claimed to have stolen more than 3TB of data associated with Snappfood, an online food delivery service in Iran. This included 130 million records containing details of over 20 million customers, data from 180 million devices, information of 35,000 bikers, and records of 240,000 vendors. The company acknowledged the breach.

New Threats

Threats against Ivanti VPN and solutions intensified with more vulnerabilities being reported around the end of the month. Separately, Phobos operators launched a new ransomware variant dubbed FAUST. Added to the macOS malware threats list is SpectralBlur. Watch out!

While zero-day vulnerabilities in Ivanti Connect Secure VPN devices continue to face exploitation attempts, two newly discovered high-severity vulnerabilities surfaced in its Connect Secure and Policy Secure solutions. In an update, Ivanti clarified that the patches for the two zero-day vulnerabilities revealed earlier will be delayed. Thousands of systems have already been compromised by cybercriminals and more appear to be on the way if users don’t take precautionary measures.
A threat actor was found uploading malicious packages to the PyPI repository, delivering an information-stealing malware called WhiteSnake Stealer. The campaign, tracked as PYTA31 by Checkmarx, aims to exfiltrate sensitive data, including crypto wallet information. While Windows systems infected with the packages deploy Whitesnake Stealer, Linux hosts run a Python script for information harvesting. The malware targets web browsers, cryptocurrency wallets, and other applications.
FortiGuard Labs exposed a fresh attack vector involving the FAUST ransomware, a Phobos variant. The attackers employed a Visual Basic script in an Office document to propagate FAUST. They utilized the Gitea service to store encoded files, initiating a file encryption attack when injected into a system's memory. The ransomware employs advanced evasion tactics, adds persistence, and carries an exclusion list.
Alpha, a newly discovered ransomware group emerged, launching its Dedicated/Data Leak Site (DLS) on the Dark Web. Despite its recent appearance. The ransomware appends a random 8-character alphanumeric extension to encrypted files, and its DLS, titled "MYDATA," is considered unstable and frequently offline. Victims, spanning various sectors in the U.K, the U.S., and Israel, were featured on the site.
A sensitive security flaw in the GNU C library could allow malicious local attackers to gain full root access on Linux machines. Exploiting this flaw required specific conditions but could lead to significant consequences due to the widespread use of the affected library. The vulnerability impacts major Linux distributions, including Debian, Ubuntu, and Fedora. Three additional flaws, including CVE-2023-6779, CVE-2023-6780, and a bug in the qsort() function, were also identified in glibc.
Security researchers uncovered SpectralBlur, a new macOS backdoor linked to the North Korean malware family KandyKorn. The sample, which is believed to have links with the Lazarus group, was uploaded to VirusTotal in August 2023 but went undetected until recently. The malware’s capabilities include file operations, shell execution, and communication with a command-and-control server using RC4-encrypted sockets.
Researchers discovered a supply chain attack called MavenGate that allowed hackers to hijack Java and Android apps by exploiting vulnerabilities in the dependency repositories. The attack impacted over 200 companies, including Google, Facebook, Signal, and Amazon. Researchers suggested using DNS TXT records for identity confirmation in group ID registration.
Researchers discovered an updated version of a backdoor malware called LODEINFO, distributed through spear-phishing attacks. The malware, attributed to the Chinese nation-state actor Stone Panda, had evolved to include new features and anti-analysis techniques. It could execute arbitrary shellcode, take screenshots, and exfiltrate files.
ESET researchers laid bare a sophisticated implant called NSPX30, developed by a new China-aligned APT group named Blackwood. It has been used in cyberespionage operations targeting individuals and companies in China, Japan, and the U.K. The implant includes an orchestrator, backdoor, and plugins, and can extract various data from compromised systems.
Microsoft reported Mint Sandstorm, an Iranian APT35 subgroup, using spear-phishing to target researchers and university staff in the U.S., Belgium, France, Gaza, Israel, the and U.K. Employing custom phishing lures, the hackers deliver a new, evasive backdoor called MediaPl. This malware disguises itself as Windows Media Player, utilizing encrypted communication channels to interact with its command-and-control server.
Security researchers discovered more than 178,000 SonicWall NGFW appliances vulnerable to potential DoS and RCE attacks. Two DoS security flaws, tracked as CVE-2022-22274 and CVE-2023-0656, affect these appliances. While SonicWall PSIRT claims no knowledge of these vulnerabilities being exploited in the wild, the exposure posed a significant risk.
A new Python-based hacking called FBot was found targeting web servers, cloud services, CMS, and SaaS platforms such as AWS, Microsoft 365, PayPal, Sendgrid, and Twilio. Criminals appeared to hijack these services and harvest credentials to obtain initial access and monetize it by selling the access to other actors. Besides, the tool contains multiple utilities, such as an IP address generator and port scanner.

Related Threat Briefings

Jul 1, 2025

Cyware Monthly Threat Intelligence, June 2025

Jun 1, 2025

Cyware Monthly Threat Intelligence, May 2025

May 1, 2025

Cyware Monthly Threat Intelligence, April 2025

Apr 2, 2025

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Mar 4, 2025

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Sep 30, 2024