Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Jul 1, 2021

The Good

As the world inches toward more secured communication, a group of academic researchers devised a system that could enable smart home systems to respond to audio commands without invading users' privacy. A joint law enforcement operation by the U.S., European, and other national authorities resulted in a major crackdown on organized crime activities through the use of an encrypted chat platform. Meanwhile, the NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.

  • Researchers at the University of Michigan developed a system called PrivacyMic that can filter out audible sounds, thereby offering more security and privacy to users of smart home systems.

  • According to Europol, law enforcement authorities made more than 800 arrests in raids at 700 locations worldwide under Operation Trojan Shield, wherein the police followed upon criminals’ activities via AN0M, an encrypted chat platform.

  • Researchers at the University of Rochester devised an approach called TimeCache that protects against side-channel attacks like evict+reload and Spectre, with a tiny performance impact.

  • Google introduced a vulnerability interchange schema with the aim of fortifying open-source security. This new schema will address some major problems with managing open-source vulnerabilities.

  • The NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.

  • The DoJ announced that law enforcement agencies from the U.S., Germany, the Netherlands, and Romania took down Slillpp, the largest online marketplace for stolen credentials. The multinational operation seized the servers that hosted Slillpp’s infrastructure and domain names.

The Bad

Further, ransomware threats, malware operators, and misconfigured databases remained the top threats in the cybersecurity space in June. For instance, a Brazilian medical lab firm and a French fashion label were targeted by a notorious ransomware group. In other news, scammers were sending fake replacement devices to Ledger customers, whereas Crackonosh malware operators reportedly made at least $2 million in illegal Monero mining.

  • REvil ransomware was held responsible for the attacks on Brazil-based Grupo Fleury and France-based FCUK. The group has asked for $5 million in ransom if the victim wishes to receive a decryptor and avoid data leak.

  • Following the ransomware attack on the City of Tulsa in May, the attackers posted more than 18,000 stolen files, including police citations and internal department files on the dark web. These files included names, dates of birth, addresses, and driver’s license numbers.

  • The operator of a malware, named Crackonosh, was discovered to have made more than 9,000 Monero coins after compromising 222,000 Windows computers since 2018. The malware was hidden inside pirated and cracked copies of popular software.

  • The South Korean Atomic Energy Research Institute (KAERI) has confirmed a cyberattack by the Kimsuky threat actor group. The adversary had exploited a vulnerability in the VPN system used within the research institute’s environment to enter into the network.

  • Ragnar Locker ransomware group hit Taiwan-based memory and storage manufacturer ADATA and made more than 700GB of archived stolen data public in an attempt to pressurize and extort from the victim.

  • DirtyMoe, known for cryptomining and DDoS attacks, infected over 100,000 Windows systems, according to researchers. The initial infection process relies on spam emails to lure users to malicious sites hosting an exploit kit named PurpleFox.

  • Around 20GB of confidential files containing personal information of retail customers was exposed due to an unprotected Amazon AWS bucket. In the same vein, a misconfigured database belonging to Cognyte had exposed more than 5 billion records for three days before security professionals secured it.

  • An online database containing 204GB of data belonging to CVS Health disclosed over a billion records owing to a misconfiguration issue. The data includes production records of visitor IDs, session IDs, and device access information.

  • UF Health Central Florida witnessed a blow to its IT network caused due to a ransomware attack. UF Health The Village Hospital and UF Health Leesburg Hospital were incapable of accessing their computer systems and email because of the attack.

  • Scammers were spotted sending fake replacement devices to Ledger customers affected in a recent data breach in an attempt to steal from their cryptocurrency wallets. Although the device looked legitimate, the printed circuit board was modified.

  • NFT creators and digital artists were targeted in a Redline malware campaign, enabling the threat actor to swipe the former’s profits. According to reports, the attacker impersonated NFT creators and approached Twitter users with business deals that tricked them into downloading and running a malware-laced file.

  • Around 8.4 billion entries of passwords were disclosed on a popular hacker forum. The compilation—comprises a 100GB TXT file and goes by the name RockYou2021—was stored in plain text.

  • Ukrainian public and private sectors were targeted in a massive spear-phishing attack carried out by Russian threat actors. The attack was conducted via emails claiming to be from representatives for the Kyiv Patrol Police Department.

New Threats

A new cyberattack occurs every few seconds and the following incidents are just a glimpse of the evil creations of cybercriminals. Security researchers uncovered new ransomware operations, such as Ever101, DarkRadiation, and EpsilonRed, targeting various sectors worldwide. Cybercriminals launched a new Mirai variant that milks Tenda router bugs. Also, now we have the first-ever malware pervading through Kubernetes environments via Windows containers.

  • A new Ursnif trojan variant is being used in the wild to target online banking users in Italy. As a part of the attack, the trojan infects mobile devices with the Cerberus malware.
  • A new strain of REvil ransomware called LV ransomware was spotted in the wild. Experts believe it to be a work of GOLD NORTHFIELD and uses CRC32 hash to encrypt files. Three ransom payment Tor domains used by the LV gang have been discovered by security experts.
  • A new ChaChi trojan was being used as a critical part of ransomware operations targeting government organizations and schools in the U.S. The trojan was associated with the operations of the PYSA ransomware gang.
  • A newly discovered Ever101 ransomware targeted an Israeli computer firm and encrypted its devices. When encrypting files, the ransomware appends the .ever101 extension and later drops a ransom note named !=READMY=!.txt.
  • The new DarkRadiation ransomware was found targeting Linux and Docker cloud containers, while banking on Telegram messaging service for C2 communications.
  • A new SEO poisoning tactic is propagating the SolarMaker malware via PDF documents filled with keywords and malicious links. The backdoor malware is capable of stealing data and credentials from browsers.
  • A Mirai variant Moobot was discovered scanning Tenda routers for known but uncommon vulnerabilities. This malware strain primarily targets exposed and vulnerable Docker APIs to include them in its DDoS botnet.
  • A faux DarkSide threat actor has been sending threatening emails to several organizations in the energy and food sector, claiming to have breached their network. The actor is demanding a ransom of 100 BTC in lieu of public disclosure of sensitive data.
  • Experts discovered new Vigilante malware that aims at piracy by preventing unauthorized downloading of pirated software or games. It also tries modifying the victims’ computers so that they can’t access pirate sites.
  • Siloscape became the first known malware targeting Kubernetes clusters through Windows containers. This heavily obfuscated malware opens a backdoor into poorly configured clusters to launch malware.
  • A new attack technique dubbed Cut-and-Mouse and Ghost Control can be used to bypass ransomware defense in antivirus solutions. Researchers demonstrated that these twin attacks leverage security weaknesses in popular software applications and can enable attackers to take over applications.
  • A new backdoor dubbed Facefish was reported by security analysts at Qihoo 360 NETLAB. It allows attackers to take over Linux systems and steal sensitive data. It targets Linux x64 systems and capable of dropping multiple rootkits at different times.
  • A new ransomware named Epsilon Red, which shares similarities with the REvil gang, targeted a U.S. company in the hospitality sector. Written in Golang, the ransomware is distributed via unpatched Microsoft Exchange servers.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.