Cyware Monthly Threat Intelligence

The Good

Despite a spike in cybersecurity incidents in July, security experts and researchers have managed to make progress in the right direction. In a recent development, Microsoft added a Data Loss Prevention (DLP) feature in Office 365 to prevent data leaks and inappropriate data sharing. On a tangent, Google added 11 new security features to its G Suite products and a Zoom-Bombing prevention feature to Google Meet to thwart growing threats.

Microsoft Office 365 now includes a DLP feature, making it easier for organizations to prevent data leaks, inappropriate data sharing, and other similar risks. The new extension will protect sensitive data and details on devices running Windows 10.
The National Cyber Security Centre (NCSC), the U.K., released a new set of free tools and roleplay exercises to protect remote workers from cyberattacks. The exercises focus on safe access to networks, securing employee collaboration, and managing cyber incidents remotely.
A group of academics developed a new SSO algorithm that aims at securing user information, including usernames and passwords, from being accessed by third-party services and applications.
Google Cloud announced 11 new G Suite security features to help IT administrators manage and secure their devices more effectively. The updates also apply to other G Suite products: Gmail, Chat, and Meet.
Google Meet added a ‘Zoom-Bombing’ prevention feature to protect educators from unwanted intrusion. This will be especially useful for users joining Google Meet video conferences organized through G Suite.

The Bad

Last month, several firms confirmed being targeted by cyber adversaries and spilling confidential details. According to reports, Xerox Corporation, Blackbaud, Promo[.]com, IndieFlix, and a few other organizations underwent a massive data breach. Meanwhile, the ShinyHunters group was offering over 386 million user records of 18 companies on a hacker forum for free. In other news, a hacker laid bare data from 8,200 databases in a revenge attack.

Blackbaud, the cloud computing provider, notified dozens of charities, organizations, and universities about a data breach it suffered in May. The company had to pay a ransom to stop threat actors from infecting the network further. The Blackbaud breach has affected at least 125 organizations and the victim count is expected to rise.
Xerox Corporation was targeted by the Maze ransomware group. The attackers had breached one of the company’s branches in Europe and stole nearly 100GB worth of data. The group threatened to leak the data if the company doesn’t participate in negotiations for a ransom.
A research team discovered an unsecured Amazon S3 bucket belonging to IndieFlix leaking over 90,000 files related to scans of confidential motion picture acquisition agreements, tax ID requests, and contact details of film professionals.
ShinyHunters was spotted offering data of 18 companies—containing over 386 million user records—on a hacker forum for free. It also contains data from some of the latest breaches, including Promo[.]com and a Microsoft private GitHub repository.
Cosmetic giant, Avon, leaked 19 million records containing personal information and technical logs, due to a misconfigured Elasticsearch database. Among the personal data exposed, it included full names, phone numbers, dates of birth, and email addresses of users.
A trove of 4.8 million records belonging to a well-known U.K.-based ticketing provider was put up for sale on the dark web. The data was sold at a price of $2500 by a user named ‘Jamescarter.’ The affected users are located mainly in the U.K, the U.S., New Zealand, Australia, South Africa, Germany, and France.
FireEye uncovered a pro-Russia disinformation-focused group, dubbed Ghostwriter, that has been spreading fake news about the NATO and the U.S. troops stationed in Poland and the Baltics, by infiltrating Eastern European media outlets. The methods included pushing fake stories on authentic but compromised websites using made-up personas.
McAfee researchers revealed details about Operation North Star that lured employees through fake job offers in the U.S. defense and aerospace sectors via spearphishing campaigns. The operation began in late March and ended around May end.
Drizly, an online alcohol delivery startup, suffered a data breach that affected its 2.5 million customers. Leaked details include email IDs, birth dates, hashed passwords, and delivery addresses. It wasn’t clear how the hack happened; however, the firm has advised users to change their passwords.
A hacker took over nearly 23,000 unsecured MongoDB databases with an intent to get ransom from victim companies. The affected companies were given two days to pay the ransom, failing which the data would be leaked online. Additionally, the hacker threatened to contact the local GDPR authorities to report the leak.
Four misconfigured AWS S3 buckets and one unsecured Elasticsearch database belonging to five e-learning platforms leaked nearly one million records of online students. The five affected platforms were Okoo, Square Panda, Playground Sessions, MyTopDog, and Escola Digital.
Cybercriminals dumped a stolen database of Bhinneka, Indonesia’s largest online store, in the underground marketplace. The database contained over 1.2 million account records with users’ personal information such as full names, addresses, emails, gender, contact numbers, social media IDs, and salted passwords.
Around 15 billion credentials, which could give access to individuals’ bank accounts and companies’ networks, were found for sale on the dark web. These credentials were harvested from over 100,000 discrete data breaches.
A hacker, under the alias NightLion, hijacked more than 8,200 databases and exposed billions of information from the servers of DataViper, a data leak monitoring service firm run by a researcher working at Night Lion Security, in a revenge attack.
Unsecured databases belonging to two Chinese firms—Xiaoxintong and Shanghai Yahua Smartech—had leaked millions of user records. The compromised information included mobile numbers, hashed passwords, and more.

New Threats

Though cybercriminals are known to work on new threats, they may sometimes return to their old tricks. Recently, researchers disclosed about an old EMV-Bypass cloning technique in use by threat actors to abuse card transactions. In another revelation, security experts said seven ransomware families could be expanding activities to target processes within Operation Technology (OT) software. Moreover, a new Android malware, dubbed BlackRock, was found affecting at least 337 apps.

The newly discovered Meow attack wiped over 1800 unsecured Elasticsearch and MongoDB databases without leaving any explanation or even a ransom note. It is presumed that the operators behind the attack intend to give administrators a hard lesson in security by destroying the unsecured data.
An old technique from 2008 called EMV-Bypass Cloning was found to be exploited in the wild. The method can allow attackers to conduct fraudulent purchases by copying the information stored on the magnetic stripes present on EMV chip cards.
The latest intel on Dacls trojan, which Kaspersky refers to as MATA, revealed that the trojan is capable of distributing VHD ransomware and exfiltrating data from databases. The malware is associated with the Lazarus threat actor group and has been employed against users in Poland, Germany, Turkey, Korea, Japan, and India.
A total of seven ransomware families could be targeting around 2,500 processes associated with OT software. The ransomware in question included SNAKE, DoppelPaymer, LockerGoga, Maze, MegaCortex, CLOP, and Nefilim.
A hacking group, dubbed Keeper, has been held responsible for the attacks on more than 570 online e-commerce portals over the last three years. The gang conducted the attacks by inserting malicious scripts into the checkout pages of the sites.
According to security experts, the terror of Snake ransomware is spreading far and wide. The ransomware is expected to pose a unique threat to companies with industrial control systems. Since its inception, Snake has struck two giants—Honda and Enel Group.
Researchers claimed that the Valak information stealer is being distributed in ongoing campaigns targeted at enterprises in North America, South America, and Europe. The malware is propagated via malicious spam alongside secondary payloads, such as Gozi and IcedID.
The FBI warned against the abuse of new network protocols being used to launch large scale DDoS attacks. The three new attack vectors are Constrained Application Protocol (CoAP), Web Services Dynamic Discovery (WS-DD), and Apple Remote Management Service (ARMS), along with the Jenkins web-based automation software.
Researchers exposed a malicious cyber operation being carried out by 29 fake photo editing apps. These apps, downloaded 3.5 million times in total from the Google Play store, enabled their operators to compromise devices as a part of a nefarious cyber scheme named Chartreuse Blur.
Researchers reported a new Bazar backdoor malware that exhibits behavior similar to previous TrickBot campaigns. The malware first emerged in April 2020 and can be used to deploy additional malware and ransomware and steal sensitive data from organizations.
Cerberus banking trojan made a comeback disguised as the Calculadora de Moneda app. The trojan’s capabilities included logging keystrokes and stealing credentials from Google Authenticator and SMS messages.
A survey revealed that 127 routers from seven different vendors are affected by several vulnerabilities. The vendors have failed to fix these flaws despite the available security patches. The affected vendor names are AVM, D-Link, Linksys, TP-Link, Zyxel, and Netgear.
Experts spotted a new Android malware strain named BlackRock, which includes a wide range of data theft capabilities, targeting a whopping 337 Android applications related to banking, dating, social media, and instant messaging. The malware is based on the leaked source code of Xerxes.
New details reveal that the Evilnum threat actor group has shifted its focus on targets located in Europe. Some of its victims are also located in Australia and Canada. The APT group is specialized in targeting financial firms.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

Jun 1, 2025