Cyware Monthly Threat Intelligence, March 2025
The Good
ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors.
Microsoft recently took down several GitHub repositories that were part of a large malvertising campaign, which affected nearly one million devices globally. The campaign was discovered in early December 2024, with threat analysts noticing devices downloading malware from GitHub repositories, which were then used to deploy additional malicious payloads.
The BadBox Android malware botnet, which primarily targets low-cost Android devices, has been disrupted by removing 24 malicious apps from Google Play and sinkholing communications for half a million infected devices. The botnet, now referred to as 'BadBox 2.0,' is supported by multiple threat groups. Researchers sinkholed an undisclosed number of BadBox 2.0 domains, preventing over 500,000 infected devices from communicating with command-and-control servers. Google removed 24 apps from Google Play, added a Play Protect enforcement rule, and terminated publisher accounts associated with the BadBox operation.
Starting from April 1, operators of critical infrastructure in Switzerland will be legally obligated to report cyber-attacks to the NCSC within 24 hours of discovery. This mandate is part of an amendment to the Information Security Act and applies to incidents that threaten the functioning of critical infrastructure, result in information manipulation or leakage, or involve blackmail, threats, or coercion. Affected entities include energy and drinking water suppliers, transport companies, and cantonal and communal administrations.
The NCSC has released new guidance on transitioning to Post-Quantum Cryptography (PQC) by 2035, to mitigate future security risks posed by quantum computing. The guidance sets specific milestones for organizations, with critical organizations expected to complete the migration by 2035. The NCSC recommends using NIST-approved PQC algorithms, such as ML-KEM, ML-DSA, SLH-DSA, and HQC, for the migration. The NCSC acknowledges challenges in the migration process and plans to launch a pilot scheme to connect U.K organizations with cryptography specialists for assistance.
British law enforcement recently conducted Operation Henhouse, a major crackdown on fraud, resulting in 422 arrests and the seizure of £7.5 million in cash and assets, a 91% increase from the previous year. The operation was coordinated by the National Economic Crime Centre and the City of London Police. Fraud is currently the most common crime in the UK, accounting for 41% of all police reports and costing an estimated £6.8 billion annually. The operation saw several successes, including the return of nearly £1 million to a scam victim and the arrest of individuals involved in multimillion-pound investment and money laundering schemes.
The European Telecommunications Standards Institute (ETSI) has released new quantum-safe encryption standards, introducing a key encapsulation mechanism with access control (KEMAC) scheme called Covercrypt. This system allows data encryption based on user attributes, ensuring only authorized users can decrypt the data. Covercrypt is efficient, taking only hundreds of microseconds to encapsulate and decapsulate session keys, and is designed to protect against current and future quantum-based threats.
The Bad
Medusa isn’t just encrypting files, it’s dismantling defenses first. The RaaS has been leveraging a malicious driver called ABYSSWORKER in BYOVD attacks to disable endpoint protections. A threat actor briefly exposed their entire playbook. Researchers found a public server hosting tools tied to a campaign targeting South Korea, including a Rust-compiled payload delivering Cobalt Strike Cat and a list of over 1,000 potential targets. Phishing messages on Signal are leading to full system compromise. Cybercriminals are upgrading their toolkit for long-term access. Ragnar Loader is being leveraged by ransomware groups like FIN7, FIN8, and Ragnar Locker, evolving into a stealthier and more modular malware for persistent system compromise.
The Medusa RaaS operation has been using a malicious driver, ABYSSWORKER, to disable anti-malware tools in a BYOVD attack. The ransomware is delivered through a loader packed using a packer-as-a-service called HeartCrypt. The ABYSSWORKER driver, signed with likely stolen, revoked certificates from Chinese companies, mimics a legitimate CrowdStrike Falcon driver. The malware's signed status allows it to bypass security systems. Once launched, ABYSSWORKER can add the process ID to a list of global protected processes and perform various operations, including file manipulation, process and driver termination, and disabling EDR systems.
The Chinese threat actor, FamousSparrow, has been associated with a cyberattack in July 2024 targeting a trade group in the U.S. and a research institute in Mexico. The attack involved the deployment of a web shell on an IIS server, leading to the installation of the SparrowDoor backdoor and ShadowPad malware. The group has also deployed two new versions of SparrowDoor, one of which is modular and supports nine different modules for various malicious activities.
Threat actors are using a cybercrime tool called Atlantis AIO Multi-Checker to carry out credential stuffing attacks. This tool enables attackers to test millions of stolen credentials rapidly, posing a significant threat to various online platforms and services. Atlantis AIO offers pre-configured modules to target a range of platforms and cloud-based services, leading to fraud, data theft, and account takeovers. The tool can also conduct brute-force attacks and automate account recovery processes.
A GitHub repository, named FizzBuzz is being used to distribute an info-stealer disguised as a recruitment challenge, especially targeting Polish-speaking developers. The repository contains an ISO file that holds a JavaScript exercise and a malicious LNK shortcut. When the LNK file is executed, it runs a PowerShell script that installs a backdoor called FogDoor, which is designed for data theft, remote command execution, and persistence while avoiding detection. The malware communicates with a social media platform via a Dead Drop Resolver (DDR) technique to retrieve attack commands and uses geofencing to restrict execution to Polish victims. The malware systematically steals browser cookies, Wi-Fi credentials, and system data, staging them for exfiltration before deleting traces. The malware also uses remote debugging to extract Chrome cookies and harvest Firefox credentials from profile directories.
Hunt researchers discovered a publicly exposed web server containing tools linked to a cyber intrusion campaign targeting South Korean organizations. The server, which was accessible for less than 24 hours, hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat (CS Cat), a modified version of the popular penetration testing tool. The actor also used open-source tools such as SQLMap, Web-SurvivalScan, and dirsearch to identify and exploit vulnerable web applications. The attacker compiled a list of over 1,000 Korean domains associated with government agencies, local municipalities, and private businesses for target selection.
Ukraine's CERT-UA issued a security alert about targeted cyberattacks using the DarkCrystal RAT against defense industry workers and military entities. These attacks, ongoing since March 2025, use the Signal messenger to spread phishing messages containing harmful files. Attackers use social engineering, often sending messages pretending to be from trusted contacts. The harmful files include a bogus “.pdf” and an executable named DarkTortilla, which launches the remote administration tool DarkCrystal RAT (DCRAT) to give attackers remote access to systems.
Two malicious extensions, "ahban.shiba" and "ahban.cychelloworld," were found on the VSCode Marketplace that were capable of deploying ransomware. These extensions were able to bypass Microsoft's safety review processes and remained on the store for an extended period. The ransomware, however, appeared to be in development, only encrypting files in a specific test folder and demanding 1 ShibaCoin for recovery.
WhatsApp reported addressing a zero-click, zero-day vulnerability in December 2024, which allowed remote exploitation without user interaction. This flaw, patched server-side without a client update or CVE-ID, was uncovered after Citizen Lab’s findings on Paragon’s Graphite spyware attacks, though specifics remain undisclosed. The vulnerability enabled attackers to bypass interaction, potentially through a crafted PDF, targeting devices via WhatsApp group chats.
Several cybercrime and ransomware groups, including Ragnar Locker (aka Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis have been using the Ragnar Loader malware toolkit. Ragnar Loader helps attackers maintain access to compromised systems for long periods. Ragnar Loader is crucial for maintaining access to compromised systems and enabling long-term operations. Its developers are constantly adding new features, making it more modular and harder to detect. The malware is offered to affiliates as an archive file containing multiple components for reverse shell, local privilege escalation, and remote desktop access.
A Chinese threat group known as UNC3886 has infected various organizations' Juniper Networks routers with custom backdoors. Their attacks mainly targeted older Juniper MX routers that do not support security monitoring tools. UNC3886 initially accessed the routers through terminal servers with legitimate credentials and then infiltrated the routers' operating systems. Once inside, the attackers deployed customized versions of the TinyShell backdoor. The attackers were able to bypass security measures, specifically a feature in Junos OS designed to protect against unauthorized code.
Microsoft reported that a North Korea-linked APT group called Moonstone Sleet has been using Qilin ransomware in limited attacks since February, marking a shift from its previous use of custom ransomware. Moonstone Sleet, also known as Storm-1789, employs various tactics, including fake companies, trojanized tools, and malicious games for financial gain and espionage. They target victims via LinkedIn and freelance sites, using software developer personas to engage organizations.
Cisco Talos disclosed a Miniaudio and three Adobe vulnerabilities, all of which have been patched by their respective vendors. The Miniaudio vulnerability (CVE-2024-41147) is an out-of-bounds write issue. It can cause a buffer overflow leading to memory corruption when a specially crafted FLAC file is played. The three Adobe vulnerabilities are in Adobe Acrobat's font functionality. Two are out-of-bounds read vulnerabilities (CVE-2025-27163 and CVE-2025-27164) that can lead to the disclosure of sensitive information, and one is a memory corruption vulnerability (CVE-2025-27158) that could potentially allow arbitrary code execution. These Adobe vulnerabilities can be triggered by a specially crafted font file embedded in a PDF.
Researchers discovered a targeted cybercriminal campaign that impersonates the Electronic Frontier Foundation (EFF) to target Albion Online players. The attackers used phishing strategies and decoy documents to steal in-game assets, employing the Stealc malware and Pyramid C2 infrastructure. The threat actors exploited the game's player-driven economy, where in-game assets are traded for real money through third-party markets. The campaign involved phishing emails that tricked victims into downloading malicious PDF reports, supposedly from the EFF, which claimed unauthorized transactions on their accounts. Once opened, the document launched a malware infection chain designed to steal sensitive data.
An advanced cyber-espionage campaign, named Operation Sea Elephant, has been found primarily targeting research institutions, universities, and government organizations in South Asia. The campaign, allegedly orchestrated by the CNC group, utilizes custom plug-ins and malware for surveillance, data theft, and lateral movement within networks. The attack begins with targeted phishing emails containing malicious attachments, exploiting trusted relationships within academic and research communities. Once a target is compromised, the malware spreads laterally by hijacking WeChat and QQ accounts to distribute trojanized programs. The CNC group employs various custom plug-ins for specific attack objectives, including RCE backdoors, a GitHub API-based trojan (windowsfilters.exe), a keylogger, a USB worm (YoudaoGui.exe), and file theft modules.
The Black Basta and Cactus ransomware groups have added the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines. In a campaign, the attackers gained initial access through social engineering, abusing Microsoft Teams for impersonation and privilege escalation, and manipulating users into granting unauthorized access via Quick Assist and similar remote access software. The BackConnect malware was then used to control the compromised machine persistently. The malware has links to QakBot, a loader malware subject to a takedown effort in 2023.
New Threats
A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.
Lucid is a sophisticated Phishing-as-a-Service (PhaaS) platform developed by Chinese malware developers. Lucid exploits the advanced features of mobile messaging protocols like iMessage and Rich Communication Services (RCS) to bypass security measures and carry out effective phishing campaigns. The platform impersonates various organizations across the globe, luring victims into providing their credit card information through legitimate-looking landing pages. Lucid campaigns have a high success rate of approximately 5%, targeting individuals and organizations on six continents. Lucid takes advantage of end-to-end encryption in iMessage and RCS to avoid detection and constantly rotates phone numbers and domains to evade spam filters. The group behind Lucid, "XinXin" or "Black Technology," claims to harvest over 100,000 credit card numbers per day.
Bitdefender discovered a new ransomware named QWCrypt used by a long-running, stealthy hacking group known as RedCurl. This group, previously known for corporate espionage and data exfiltration, has now diversified into targeted ransomware attacks. The ransomware was found on an unnamed North American customer's system in mid-February. The new attack strategy involves the use of ransomware, with the group targeting hypervisors to inflict maximum damage with minimum effort. The attackers appear to have a deep understanding of the network before the attack, with the ransom note threatening to dump stolen data to a darkweb data-leak site.
Cybereason investigated PlayBoy Locker, a new Ransomware-as-a-Service (RaaS). PlayBoy Locker offers frequent updates, anti-detection features, and customer support for affiliates. The group has been active since September 2024 and operates on an affiliate model. It supports Windows, NAS, and ESXi systems. PlayBoy Locker performs LDAP scans to search for available machines in the network and then tries to copy the ransomware executable to the remote device. It exploits the Restart Manager DLL in a malicious way and stops services and processes to unlock and safely close open files before encrypting them. The list of targeted services and processes includes Telegram, Skype, Firefox, Chrome, and Oracle, among others.
The creators of the macOS malware loader, ReaderUpdate, have developed new versions using Crystal, Nim, Rust, and Go programming languages. The malware is distributed through free and third-party software download sites, targeting the x86 Intel architecture. The Go variant collects system hardware information upon execution, which is used to create a unique identifier and sent to the C2 server. The threat can also parse and execute responses from the server, suggesting it could execute any commands sent by its operator. Although ReaderUpdate infections have only been linked to adware, the loader could potentially deliver more malicious payloads. SentinelOne has identified nine samples of the Go variant, which is less common than the Nim, Crystal, and Rust variants.
A new phishing campaign using complex browser-in-the-browser attacks has been targeting the Steam Gaming Platform and Counter-Strike 2 players while abusing the brand of the pro eSports team Navi. The campaign employs fake but realistic-looking browser pop-up windows to trick victims into logging into the scams, with the likely intention of reselling the compromised accounts through online marketplaces. The campaign primarily targets English-speaking users, with one Chinese site in Mandarin and some English words.
EncryptHub is a rising cybercriminal entity that has been observed using multi-stage attack chains, distributing trojanized versions of popular applications, and employing third-party PPI distribution services. It has been targeting QQ Talk, WeChat, DingTalk, VooV Meeting, Google Meet, Microsoft Visual Studio 2022, and Palo Alto Global Protect users. The attackers are also developing a product called EncryptRAT and have been observed incorporating popular vulnerabilities into their campaigns.
A new botnet, Eleven11bot, has infected over 86,000 IoT devices, primarily security cameras and network video recorders, to conduct DDoS attacks. The botnet, which is loosely linked to Iran, has already targeted telecommunication service providers and online gaming servers. The Shadowserver Foundation reported that most infected devices are in the U.S., the U.K, Mexico, Canada, and Australia. The botnet's attacks have reached several hundred million packets per second in volume, often lasting for multiple days. The malware spreads by brute-forcing weak admin credentials, leveraging default credentials for specific IoT models, and scanning networks for exposed Telnet and SSH ports.
Positive Technologies uncovered a malicious campaign targeting the Middle East and North Africa since September 2024. The campaign, named Desert Dexter, leverages social media to distribute a modified version of the AsyncRAT malware, which targets cryptocurrency wallets and communicates with a Telegram bot. The attackers host the malware in legitimate online file-sharing accounts or Telegram channels set up for this purpose. Approximately 900 victims have been identified across various countries, with Egypt, Libya, the UAE, Russia, Saudi Arabia, and Turkey being the most targeted.
Socket has discovered a malicious PyPI package called set-utils that steals Ethereum private keys by exploiting common account creation functions. The package is disguised as a simple utility for Python sets and mimics popular libraries, tricking developers into installing it. Since January 29, it has been downloaded over 1,000 times, targeting Ethereum developers and organizations working with Python-based blockchain applications. The package intercepts Ethereum account creation and exfiltrates private keys via the blockchain using a C2 server.
The Ballista botnet is exploiting an unpatched vulnerability (CVE-2023-1389) in TP-Link Archer routers. This remote code execution flaw allows unauthenticated command injection due to lack of input sanitization in the locale API of the routers' web management interface. The Ballista botnet has been targeting over 6,000 Archer routers since early 2025, spreading automatically through this vulnerability. The botnet uses Tor domains for stealth and has been linked to an Italian-based threat actor. It installs a dropper that downloads and executes malware binaries on compromised devices, employing persistence, system exploration, and anti-detection techniques. The malware can execute remote shell commands, launch DoS/DDoS attacks, and has affected various sectors in the U.S., Australia, China, and Mexico.
A clipboard hijacking operation called MassJacker uses over 778,000 cryptocurrency wallet addresses to steal digital assets from compromised computers. The operation was discovered by CyberArk, who found that around 423 wallets linked to the operation had $95,300 at the time of analysis, with a single Solana wallet amassing over $300,000 in transactions. The malware is distributed via pesktop[.]com, a site that hosts pirated software and malware. The operation uses clipboard hijacking malware to replace copied cryptocurrency wallet addresses with ones controlled by the attackers, causing victims to unknowingly send money to the attackers.
The Black Basta ransomware group has developed an automated brute-forcing framework, named BRUTED, to breach edge networking devices such as firewalls and VPNs. This framework has allowed Black Basta to streamline initial network access and scale up their ransomware attacks on vulnerable internet-exposed endpoints. The ransomware group has been using BRUTED since 2023 to conduct large-scale credential-stuffing and brute-force attacks on edge network devices. The framework is specifically designed to target popular VPN and remote-access products such as SonicWall NetExtender, Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet SSL VPN, Citrix NetScaler, Microsoft RDWeb, and WatchGuard SSL VPN.