Cyware Monthly Threat Intelligence

The Good

The month of March started off with several new developments and large data breaches in the cybersecurity world, but it ended with our timelines filled with COVID-19 updates. To begin with, Google developers created a new USB Keystroke Injection Protection tool to defend users against USB keystroke injection attacks. Meanwhile, The DHS’s CISA along with NIST has published guidelines for federal workers and contractors on securing data and systems while working remotely during the COVID-19 epidemic. Also, the NIST published its first draft for SP 800-53 (revision 5) after seven long years.

Google’s open-source developers released a new tool dubbed USB Keystroke Injection Protection to fend off stealthy USB keystroke injection attacks. The tool is effective on machines using the Linux operating system.
Academics at the University of Notre Dame came up with a project that utilizes artificial intelligence to identify deep fake videos, disinformation online and manipulated images. The project aims at protecting online users from spreading inaccurate information that can be harmful.
Amid the Coronavirus epidemic, the Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) issued guidelines for federal workers and contractors working remotely to prevent cyberattacks on their networks.
The NIST published the draft for SP 800-53 (revision 5). This publication, titled “Security and Privacy Controls for Information Systems and Organizations,” reflects the major changes to the security landscape over the last few years. It intends to protect organizational operations and assets from cyberattacks.
The Cyber Security Agency of Singapore (CSA) announced the launch of a new Cybersecurity Labelling Scheme (CLS) to improve the security of IoT products against cyberattacks. The scheme is part of the country’s new Safer Cyberspace and will initially include Wi-Fi routers and smart home hubs.

The Bad

Amidst Coronavirus fears, data breach incidents did not come to a halt. While Weibo witnessed a major backlash after 538 million users were uploaded on a hacking forum, General Electric suffered a breach too, revealing the PII of its employees. In other news, AMD also reported the theft of its confidential source code of its graphics products.

Personal data of 538 million Weibo users were put up for sale on the dark web this week. The stolen data were priced at $250 as it did not include passwords. Among the personal data exposed, it included real names, site usernames, gender, and locations of users.
Hackers stole Advanced Micro Devices’ (AMD) source code files for both its current and future graphics processing units (GPUs) and demanded the company $100 million in return . The stolen blueprints, seemingly written in Verilog, were uploaded on GitHub over the previous weekend.
Virgin Media is facing a potential class-action lawsuit that could cost the company up to $5.6 billion in compensation payout for the customers affected in an April 2019 incident that left the personal details of 900,000 customers exposed online.
An unprotected Elasticsearch database exposed over 5 billion records collected by a UK-based research firm between 2012 and 2019. The leaky database contained extensive information on the breaches including domains, sources, contact email addresses, and passwords.
A data leak at Doxzoo affected over 270,000 records belonging to more than 100,000 users. The incident occurred due to a leaky S3 bucket. The leaked data included print jobs for many high-profile clientele, such as elite universities, Fortune 500 companies, and more.
General Electric (GE) suffered a data breach, affecting the PII of current and former employees as well as beneficiaries. The information exposed in the breach included direct deposit forms, drivers’ licenses, passports, birth certificates, marriage certificates, tax withholding forms, Social Security numbers, and more.
Personal data of over 6.9 million organ donors was compromised following the loss of two external hard storage drives. The external hard drives belonged to the Dutch government and included electronic copies of all donors filed with the Dutch Donor Register between February 1998 and June 2010.
Whisper app leaked 900 million secret posts and all the metadata related to those posts due to a misconfigured database. The firm took down the database on March 9, 2020, after it learned about the leak from other sources.
A web server containing records of about 76,000 unique fingerprints was left exposed on the internet. The unsecured fingerprint data along with employees’ email addresses and telephone numbers, had been collected by a Brazilian company called Antheus Tecnologia.
An unsecured database hosted on Google Cloud had exposed more than 200 million records related to US residents. The exposed data included a victim’s name, address, email address, age, gender, ethnicity, employment, credit rating, and property information.
The wireless carrier T-Mobile came under fire again for failing to protect users’ information after a security breach. The potentially leaked data included names, addresses, phone numbers, account numbers, rate plans, and billing information of users.
Sodinokibi ransomware operators published over 12 GB of stolen data belonging to a company named Brooks International for not paying the ransom. The exposed data includes usernames and passwords, credit card statements, tax information, and much more.

New Threats

Further, as we know, hackers are always innovating and experimenting with new hacking techniques. Security experts stumbled upon the notorious TrickBot trojan disguised as a malicious TrickMo app to bypass 2FA protection. Another cybercrime group targeted D-Link and Linksys’ DNS settings to infiltrate the routers with Oski information-stealing malware. The APT41 group was also spotted, exploiting vulnerabilities in Cisco routers, Citrix ADC, and Zoho ManageEngine last month.

The TrickBot gang used a malicious Android application called TrickMo to bypass 2FA protection and infect Android devices. Though it could be used anywhere and against any target, or bank or region, the campaign was observed focusing on German users for now.
Researchers discovered a new version of Ginp Android trojan that targeted online banking users in Spain and the UK. The operators were found sending a special command that opened a fake website called ‘Coronavirus Finder.’
Attackers were found hijacking D-Link and Linksys’ DNS settings to propagate the Oski information-stealing malware. Once the attacker gained access to the router and changed the DNS settings, the victims were notified with a fake COVID-19 alert that distributed the malware.
In a widespread attack campaign, the APT41 threat actor group exploited vulnerabilities in Cisco routers, Citrix ADC, and Zoho ManageEngine to infect several organizations across the US, the UK, France, Italy, Japan, Saudi Arabia, and Switzerland.
Many Intel CPU processors were found to be affected by a new Snoop-assisted L1D Sampling vulnerability. The flaw is a variant of domain-bypass transient execution attack and it takes advantage of CPU mechanisms like cache levels, cache coherence, and bus snooping.
Ransomware operators continue to dominate the threat landscape with their newly adopted ‘naming-and-shaming’ technique. This week, the authors of Nemty ransomware launched a website to disclose the data and files of victims that refused to pay ransoms. Apart from this, there was also a discovery of a new ransomware called PwndLocker targeting the US businesses and local government with ransom demands over $650,000.
Attacks from a new variant of Pysa ransomware and a newly discovered Nefilim ransomware were also discovered this week. While the latest Pysa ransomware variant uses the .newversion file extension at the end of each encrypted file, the new Nefilim ransomware uses a combination of AES-128 and RSA-2048 algorithms to encrypt victims’ files.
A group of academics from universities demonstrated a new variant of the Rowhammer attack that bypasses Target Row Refresh (TRR) protections on RAM cards. Termed as TRR-bypassing Rowhammer, the flaw affects all DDR3 and DDR4 memory chips. It also impacts LPDDR4 and LPDDR4X chips embedded in most modern smartphones.
A group of hackers from Vietnam infected hacking tools of fellow hackers with a version of the njRAT trojan. The widespread hacking campaign was aimed at hijacking hackers’ machines to conduct DDoS attacks and steal sensitive data.
A MalBus attack that involved the use of four popular Korean language transit apps were compromised to target military and political data. These applications, all related to bus information, were available for more than five years on the Google Play Store.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Related Threat Briefings

Jun 1, 2025