Cyware Monthly Threat Intelligence

The Good

Cybersecurity experts are constantly seeking innovative solutions to keep them ahead of threats and address various challenges. Last month, a research group devised a new and advanced IDS/IPS system that inspects internet traffic for malicious activities. In other news, experts discovered a way to authenticate and optimize DNS traffic on the client-side of the domain-name resolution process. Meanwhile, the U.S. Congress passed a significant cybersecurity bill concerning the safety of 5G wireless networks.

Researchers at Carnegie Mellon University’s CyLab developed the fastest open source intrusion detection and prevention system (IDS/IPS) using a single five-processor core server and a field-programmable gate array (FPGA). Named Pigasus, the system is designed to demonstrate a more cost-effective approach to inspect internet traffic for malicious activities.
Verisign’s research and development group developed new ways to authenticate and optimize DNS traffic on the client-side of the domain-name resolution process. It would, furthermore, allow organizations to filter out known bad actors and instead send them to a honeypot or deception decoy.
The cyberworld witnessed a new development about the rollout of 5G wireless networks when the Government Accountability Office in the U.S. made recommendations that policymakers should consider the creation of cybersecurity standards to guarantee user safety and privacy.

The Bad

With the arrival of the holiday season, cybercriminals have doubled up their efforts into making life tough for organizations and users. For instance, attackers compromised Peatix, an event organizing platform, and leaked the personal data of over 4.2 million registered users. In another vein, Campari Group was blackmailed by criminals by running Facebook ads about the 2TB of stolen data. In addition, bitcoin hackers swindled about $20 million from DeFi protocol Pickle Finance.

Baltimore County Public Schools suffered a ransomware attack, resulting in the shut down of all the schools. The attack crippled the school network system. However, the ransom money demanded has not been disclosed by the school authorities yet.
Peatix users found themselves in hot water as soon as security experts discovered millions of records being circulated online. The breach at Peatix impacted the data of more than 4.2 million registered users, which were posted by threat actors via ads posted on Instagram stories, Telegram channels, and several other hacking forums.
The decentralized finance protocol Pickle Finance found itself in quite a pickle recently when it was hacked and around $20 million in DAI tokens was drained off from its wallet. The attackers allegedly exploited the vulnerability in DAI PickleJar using fake swaps.
The Campari Group fell victim to a new extortion scheme by the RagnarLocker ransomware gang and lost 2TB of files to the threat actors. The extortion scheme involved running Facebook ads to pressure victims into paying the ransom.
The personal and health information of more than 16 million Brazilian COVID-19 patients were leaked online. This was caused by a hospital employee who uploaded a spreadsheet on GitHub containing usernames, passwords, and access keys to sensitive government systems.
A database containing 8.3 million user records including personal information of 123RF was exposed on a hacker forum. The stolen data consisted of members’ full names, email addresses, MD5 hashed passwords, company name, phone number, address, PayPal emails, and IP addresses. However, no financial information was present in the database.
Prestige Software, a Spain-based hotel booking software provider, exposed over 10 million log files dating back to 2013, due to a misconfigured Amazon S3 bucket. The leaked data included hotel guests’ full names, email addresses, contact details, national ID numbers, and, in some cases, even their payment information.
Last month, American Bank Systems (ABS) and Managed.com were targeted in different ransomware attacks. While the attack on ABS resulted in the compromise of around 53GB of data, the attack on Managed.com impacted a limited number of its clients.
Folksam accidentally leaked private data of about one million of its Swedish customers to tech giants such as Facebook, Google, Microsoft, and LinkedIn. The shared data included a wide variety of information of its customers.
Luxottica disclosed a data breach that exposed the personal and health information of patients of LensCrafters, Target Optical, and EyeMed. In another camp, BigBasket, India’s largest online grocery delivery company, became a victim of a massive data breach. The leak contained a 15GB database of 20 million user records.

New Threats

Cyber experts highlighted some trending threats from November. They marked the resurgence of TrickBot malware with the release of its 100th version. Moreover, there was a new multistage infostealer malware strain detected during an attack on the MercadoLivre, an Argentinian e-commerce platform. Adding to the woes, an attacker leaked Fortinet VPN credentials of about 50,000 devices installed at government offices and banks.

The 100th version of the TrickBot malware was released with additional features to evade detection. With this release, TrickBot is now injecting DLL into the legitimate Windows executable, wermgr.exe, directly from memory using code from the MemoryModule project. Adding fuel to the fire, the gang released a new lightweight reconnaissance tool called LightBot.
A new malware family called WAPDropper has been found stealthily targeting mobile phone users to subscribe to premium services. The multi-function dropper is delivered as second-stage malware and uses a machine learning solution to bypass image-based CAPTCHA challenges.
A new malware strain, dubbed Chaes, was used against MercadoLivre’s e-commerce platform to target Brazilian customers. Written in multiple languages such as JavaScript, Vbscript, .NET, Delphi, and Node.js, the malware’s capabilities include pilfering sensitive information from Chrome browser sessions and exfiltrating financial information.
A hacker has posted a list of one-line exploits to steal VPN credentials from almost 50,000 Fortinet VPN devices. The list of vulnerable targets include domains belonging to high-street banks and government organizations around the world.
The threat landscape also witnessed the emergence of new Jupyter malware that stole information from its victims. The capabilities of the malware include collecting data from multiple applications such as popular web browsers and installing backdoors on targeted systems.
A new mobile banking trojan, dubbed Ghimob, was found infecting mobile devices to target financial apps from banks, exchanges, and cryptocurrencies in Brazil, Paraguay, Peru, Portugal, Germany, Angola, and Mozambique.
BlackBerry published details about CostaRicto, a new hacker-for-hire mercenary group that was discovered earlier this year. The group has launched attacks across different countries in the Americas, Europe, Australia, Asia, and Africa with victims located across South Asia, especially Singapore, India, and Bangladesh.
Researchers observed an uptick in attacks from Pay2Key and WannaScream ransomware strains against Israeli companies. Hackers breached corporate networks, stole company data, encrypted files, and asked for huge payouts in exchange for decryption keys.
Researchers reported a new Magecart threat group responsible for a series of attacks against e-commerce websites. Links to the unique skimmer, dubbed Ant and Cockroach, have been identified with Magecart group 12 via Svyaz, a Russian hosting provider that has hosted domains connected to the skimmer.
A newly discovered worm and botnet called Gitpaste-12 was spotted exploiting GitHub for propagation and Pastebin for hosting malicious code. The malware comes equipped with reverse shell and cryptomining capabilities and exploits over 12 known vulnerabilities.
A researcher demonstrated a new attack technique that enabled the remote access to any TCP/UDP port. Known as NAT Slipstreaming, the method involved sending a malicious link to targets that bypassed their firewall protection.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Related Threat Briefings

Jun 1, 2025