Cyware Monthly Threat Intelligence

The Good

No bad deed goes unpunished, as the saying goes. It’s always good to see cybercriminals being punished for their actions. Several arrests were made this month, which clearly made us look forward to more such news. We also got to see some much-needed innovation in the cybersecurity field. The CISA released a tool that would help detect malicious activities related to the supply chain hack. One of the best news of the month is that researchers developed a novel system that can be used to generate cryptographic keys for maximum security.

The CISA unveiled its plans to work in tandem with internet service providers to obtain the personal data of their customers to warn them about existing vulnerabilities in their systems. Besides, the agency added two new Malware Analysis Reports (MARs) in its Mitigate Microsoft Exchange Server Vulnerabilities alert.
The Spanish Police confiscated servers and arrested the developers of Mobdro, an Android app that entrapped smartphones into proxies and DDoS botnets.
The U.S. Department of Justice (DOJ) indicted a Swiss national for attacking more than 100 organizations and publishing proprietary information on their online website. The department also confiscated the fifth domain faking the official site of Regeneron Pharmaceuticals involved in COVID-19 vaccine development.
The CISA released a Python-based forensics collection tool, named CHIRP, to identify post-compromise malicious activity related to the SolarWinds hack.
The FTC collaborated with nearly 40 U.S. states to put an end to a major charity fraud operation that scammed victims of more than $110 million via deceptive charitable fundraising calls.
Backed by GCHQ, the National Cybersecurity Center, the U.K, has launched a new online self-assessment tool for micro-businesses and sole traders. Depending on the security posture of these businesses, the tool will advise on ways to enhance security.
Scientists generated streams of entirely random numbers at approx. 100 times the speed of the fastest random number generator systems, using a single, chip-scale laser. This system can be utilized to generate cryptography keys.
A Memorandum of Understanding was signed by CERT-EU and ENISA as an outcome of the Cybersecurity Act to detect and fortify the synergies between the two agencies. The collaboration is believed to build and strengthen the cybersecurity capabilities at the Union Level.

The Bad

The month witnessed a constant influx of cyber breaches due to malware attacks on various organizations. Even educational institutions were not exempt. While the SolarWinds attack continued to stay in the spotlight, it was followed by the Accellion FTA and Exchange Server attacks. Furthermore, hackers pitting against hackers seem to have become quite a trend and we are watching what happens next.

Over 20TB and 800GB of sensitive data belonging to forex broker FBS and Ringostat, respectively, were leaked online due to unprotected Elasticsearch databases. In another vein, Descartes Aljex Software and Mariana Tek exposed millions of sensitive records due to misconfigured AWS S3 buckets.
The Israeli Autumn threat actor took credit for leaking the registration and personal details—full names, phone numbers, ID card numbers—of millions of Israeli citizens.
Honeywell, Sierra Wireless, and Oloron-Sainte-Marie hospital in Southwest France suffered various degrees of ransomware attacks, disrupting crucial operations and systems.
World’s largest PC and device maker, Acer, has reportedly been targeted by the REvil ransomware gang who demanded $50 million in ransom to release the decryption key.
A major cyberattack crippled the website of the Ministry of Defence academy, the U.K, in a state-sponsored attack, allegedly, conducted by Russian and Chinese hackers. An attack by Ryuk ransomware affected more than 700 government agencies across Spain.
CompuCom informed its customers of a ransomware attack by DarkSide following the acquiring of admin credentials for the Office Depot subsidiary by the adversaries.
Shell, Flagstar Bank, Qualys, the Norwegian Parliament, and the European Banking Authority became the victims of data breaches due to the compromise of Accellion’s File Transfer Appliance.
Mimecast revealed that SolarWinds attackers broke into its internal network and downloaded source code and gained access to a subset of email addresses, salted and hashed credentials, and contact info.
Video surveillance and AI security-based firm Verkada was breached by a member of the hacktivist group APT 69420 Arson Cats. Video feed from almost 150,000 cameras around the world was leaked.
Several universities—The University of Central Lancashire, the University of Highlands, Queen’s University, and the University of Texas—were hit by a series of cyberattacks.
The Russian-speaking Maza cybercriminal forum reportedly suffered a data breach leading to the leak of user data. In a similar incident, a threat actor leaked sensitive data from the now-defunct WeLeakInfo data breach site and published it on another hacker forum - RaidForums.

New Threats

Various malware from every corner of the cyber world wore new skins i.e. got upgraded to cause more damage with no repercussions. Take Purple Fox for instance; a new variant of the malware can now move like a worm. Cyberespionage operations have become mainstream and a dangerous operation targeting the telecom sector was spotted by researchers. Cryptocurrency has surged in popularity, thereby making it a lucrative target for threat actors as we can see by the range of attacks on crypto wallets this month.

A new version of Agent Tesla was spotted with the capability to steal information via HTTP, SMTP, or FTP. Speaking about upgraded variants, a new Purple Fox malware strain with worm capabilities was found to be deployed in an ongoing attack campaign. New variants of Phoenix CryptoLocker and Gafgyt botnet were responsible for attacking CNA and vulnerable D-Link and IoT devices, respectively. A new variant of Ryuk ransomware that includes self-propagation capabilities was uncovered by researchers.
ZHtrap is a new IoT botnet that inherits functionalities from the infamous Mirai botnet. The botnet works by exploiting vulnerabilities in DVRs, CCTV cameras, Netgear routers, and Realtek devices.
Threat actors are using Google Ads to distribute a fake version of the Telegram desktop app. Three links spoofing Telegram’s website have been detected so far. One of these sites was used to spread AZORult trojan.
Security researchers have discovered a new type of steganography technique that involves hiding data inside a PNG image file posted on Twitter. Threat actors can exploit the method to obscure their nefarious activities on social media platforms.
An espionage campaign, dubbed Operation Diànxùn, was identified by the McAfee Advanced Threat Research Strategic Intelligence team. Another cyberespionage campaign that distributes ObliqueRAT malware was traced by researchers.
CopperStealer is an actively developed password and cookie stealer that targets the users of major service providers including Google, Facebook, Amazon, and Apple.
A new sophisticated backdoor malware, dubbed RedXOR, has been found masquerading as a polkit daemon to target Linux endpoints and servers. In similar lines, XcodeSpy is a new malware that targets Xcode projects used in macOS to spread custom EggShell backdoors.
The TA800 threat actor group was found distributing a malware loader called NimzaLoader in an ongoing highly-targeted spear-phishing email campaign. The Lazarus Group has been found using its MATA malware framework to deploy TFlower ransomware.
A hybrid malware that includes both cryptominer and ransomware capabilities has hit 20,000 machines in the span of a few days. z0Miner botnet was upgraded to take control of Jenkins and Elasticsearch servers to mine Monero.
Several new phishing campaigns came to the forefront, including attacks on the Coinbase platform to steal funds from cryptocurrency wallets. Scammers were found targeting investors in a sophisticated BEC scam with an average payout of $809,000 and another phishing campaign was impersonating the IRS to propagate the Dridex banking trojan.
Research revealed that the SunCrypt ransomware shares similarities with QNAPCrypt ransomware. Three more malware strains—GoldMax, Sibot, and GoldFinder—related to the SolarWinds supply chain attack were discovered by Microsoft and FireEye.
Time for some trojan news. The Ursnif Trojan was traced back to attacks against at least 100 banks in Italy. Threat actors are leveraging SEO techniques in the Gootloader technique to spread the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Related Threat Briefings

Jul 1, 2025