Cyware Monthly Threat Intelligence

The Good

Countries across the globe are taking on cybersecurity threats. Among the top initiatives announced last month was a new cybersecurity task force in Singapore to assist organizations in strengthening their own infrastructure against cyber threats. The U.S. Transportation Security Administration (TSA) released a security directive regarding railroad cybersecurity threat mitigation actions and testing. Moreover, Google introduced passkey support to make users’ digital life passwordless and more secure within its ecosystem.

The World Wide Web Consortium (W3C) released the first draft of a new specification that will standardize the password reset URLs to a default format. It will help users change their passwords across multiple services at once.
At the seventh annual Singapore International Cyber Week, officials announced a new task force named Counter Ransomware Task Force to help businesses and educational institutions defend themselves against ransomware attacks. The team includes representatives from the Ministry of Communications and Information, the Ministry of Defense, the Ministry of Home Affairs, the Monetary Authority of Singapore, and the country's armed forces and police force.
The new cybersecurity regulations unveiled by the TSA were put into effect on October 24. The rules, which will last for one year, now mandate railroad companies to deploy network segmentation policies. Additionally, carriers will have to deploy threat detection systems and timely patches for OS, applications, drivers, and firmware.
The CISA issued a new Binding Operation Directive that mandates all federal civilian agencies to scan their networks and discover vulnerable systems that need to be patched. Furthermore, the agencies are required to share their findings with the CISA by April 2023.
Google added support for passkeys in Chrome desktop and Chrome Android, along with the Google Password Manager. The passkeys are the replacement of passwords and other perishable authentication factors and cannot be reused, protecting users from phishing attacks.

The Bad

The Healthcare sector was actively targeted in October. The firms targeted include Advocate Aurora Health, Keystone Health, and CommonSpirit Health. Also, the fallout from the Medibank hacking incident grew as it impacted all of its customer data. Meanwhile, U.K’s largest car dealership firm was blackmailed to cough up a $60 million ransom in Bitcoin.

Australian health insurance firm Medibank confirmed that the cyberattack that disrupted its online services was actually a ransomware attack. The breach compromised the personal and health data of all of its 3.9 million customers, causing a potential financial impact of $25–$35 million.
Lebanon-based hacking group Polonium attacked more than a dozen organizations using at least seven custom backdoors. These attacks were observed in the span of one year, starting from September 2021. The attacks were targeted against organizations in engineering, information technology, law, telecommunications, media, insurance, and social services.
Ticketing services agency See Tickets disclosed a web skimming attack that lasted for over six months. This resulted in the compromise of the payment cards and personal details of users. The agency ascertained that the affected information includes those who purchased event tickets between June 2019 and January 2022.
The U.K’s largest car dealership Pendragon was hacked and heckled by the LockBit ransomware gang who demanded a ransom of $60 million in Bitcoin to prevent the release of sensitive data on the dark web. The firm refused to pay the ransom and took steps to protect its remaining systems.
Pennsylvania healthcare provider Keystone Health disclosed a data breach that impacted the personal information of over 230,000 patients. The incident occurred between July and August after threat actors gained unauthorized access to files within systems. The compromised data includes names, Social Security numbers, and clinical details of patients.
Nearly two million .git folders containing vital project information were exposed to the public. The information included remote repository addresses, commit history logs and other essential metadata. Over 31% of publicly exposed .git folders were located in the U.S, followed by China (8%) and Germany (6.5%.)
CommonSpirit Health disclosed a ransomware incident that impacted several of its healthcare facilities across the U.S. Even after nearly one month, the nation's fourth-largest hospital network continued to struggle to bring back its various IT systems online. The number of impacted facilities was still not disclosed.
Binance temporarily paused its Binance Smart Chain (BSC) blockchain bridge project after $560 million worth of Binance coins were stolen by hackers. However, the firm was quick to respond and block the hackers’ access to roughly 80% of the stolen funds.
A data breach at the Shangri-La hotel group compromised the personal information of its customers. The breach occurred between May and July after hackers gained unauthorized access to its IT network. This impacted its hotels located in Hong Kong, Singapore, Chiang Mai, Taipei, and Tokyo.
KFC and McDonald’s customers across Saudi Arabia, the UAE, and Singapore were targeted in a phishing attack, enabling attackers to steal their payment details. According to researchers at CloudSEK, the attackers impersonated the browser-based application of fast food restaurants to trick users into installing information-stealing payloads on their desktops.
Scammers spoofed Zoom users in a new phishing attack to steal their Microsoft Exchange credentials. The phishing emails contained a malicious link with a call-to-action button. If the recipient clicked the button, it opened a fake landing page that mimicked a legit Microsoft login page.
The lesser-known OldGremlin ransomware attackers reportedly expanded their operations using toolkits that target Linux machines. Among these toolkits is a Go-based variant of TinyCrypt ransomware that also targets Windows systems. In 2022, the gang has so far launched five campaigns with ransom demands going up to $16.9 million.
A threat actor stole nearly $9 million worth of cryptocurrency from DeFi platform Moola Market, only to return 93% of the funds within hours of the attack. The hacker exploited a vulnerability in the platform and stole 1.8 million MOO tokens ($655,000).
Advocate Aurora Health (AAH), a 26-hospital healthcare system in Wisconsin and Illinois, disclosed a data breach that affected the personal information of around 300,000 patients. The incident was caused by the improper use of Meta Pixel on AAH's websites, where patients enter their sensitive personal and medical information.

New Threats

In the past month, Android-based threats were plenty. One that stood out was Clicker. Speaking of Android malware, North Korean hackers were observed experimenting with three new malware variants against South Korean Android phone users. There was also a new threat group spotted with unusual behavior. Dubbed Water Labbu, it was found targeting other scammers to steal cryptocurrency from them.

New Clicker Android malware was found infecting 20 million users by sneaking into Google Play Store as utility apps. The targeted utility apps are flashlight, QR code readers, camera unit converters, and task managers. The malware is designed to generate revenue for attackers by displaying fraudulent ads.
A threat actor is selling a new UEFI bootkit that comes with an anti-virtual machine (anti-VM), anti-debug, and code obfuscation features to block malware analysis attempts. Named BlackLotus, the malware is linked to APT41 threat actors and can be used to load unsigned drivers for launching BYOVD attacks.
Microsoft spotted a new ransomware strain, named Prestige, that was deployed last week in a campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland. The attacks overlap with previous victims of the FoxBlade (HermeticWiper) data-wiping malware.
Palo Alto Networks researchers revealed Ransom Cartel is likely the evolution of the defunct REvil ransomware. They found connections between the TTPs used by the attackers. One of these similarities was the algorithm used to encrypt files.
Trustwave researchers discovered a new Emotet botnet campaign that pushes password-protected attachments in either ZIP or ISO formats to infect users. These attachments are used to deliver Quasar RAT, Coinminer, and more.
The North Korea-based Kimsuky threat group was spotted using three new Android malware—FastFire, FastViewer, and FastSpy—to target users in South Korea. The malware disguised as multiple utility tools on Google Play Store. The Android malware set is capable of compromising almost all phone functions, ranging from hijacking communication channels to take over the camera.
Zimperium researchers observed a campaign associated with a lesser-known Android spyware strain, named RatMilad. The spyware is disguised as a mobile VPN app that is promoted on a Telegram channel and targets Middle Eastern enterprise mobile devices.
A critical authentication bypass vulnerability affecting multiple Fortinet services was exploited in the wild. Tracked as CVE-2022-40684, the vulnerability can be exploited by sending specially crafted HTTP or HTTPS requests.
More than 800 corporate users were infected in a new QBot malware attack campaign since September 28, Kaspersky warned. The most targeted country is the U.S., with 220 targeted users, including 95 corporate users. This is followed by Italy with 151 users, Germany with 93 users, and India with 74 users.
A new threat cluster tracked as WIP19 was seen targeting telecommunications and IT service providers in the Middle East and Asia. Some of the attack tactics and malware employed by the cluster overlap with Operation Shadow Force.
A new attack framework of Chinese origin is being used in the wild. Called Alchimist, it includes a customizable RAT for Windows and Linux machines. The framework can also be used to generate PowerShell-based attack shellcodes or distribute malicious implants on macOS.
A new infostealer named LilithBot was linked to a Russia-based threat actor group called Jester, which has been active since January. The malware is being distributed via a dedicated Telegram group and a Tor link.
A new threat actor named Water Labbu was found abusing malicious decentralized applications, or DApps, to steal cryptocurrency from other scammers. The group leveraged different social engineering tactics used by crypto scammers to trick users to subsequently inject malicious JavaScript code into their sites and stealing their cryptocurrency loot.
Researchers investigated a Cheerscrypt ransomware attack that utilized Night Sky ransomware TTPs. Believed to be the work of the Emperor Dragonfly threat actor, the ransomware is capable of targeting both Windows and Linux ESXi environments.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

Jul 1, 2025