Cyware Monthly Threat Intelligence

The Good

Does the oft-repeated phrase ‘cybercrimes are getting graver’ bum you out? Let’s change that as we scan through the bright side of the cybersecurity space. A research group from the U.K has obtained a patent for a hardware device that sits between a USB and a computer system for malware detection. Meanwhile, another group bets on enhancing the detection process of phishing websites via ML models. Also, for the first time, experts successfully experimented with QKD over a hollow-core fiber cable.

Researchers at the U.K’s Liverpool Hope University developed a new device that acts as a gateway or barrier between a USB drive and a computer to scan for malicious software. The device essentially aims to keep the malicious code busy with a disguised OS.
A paper published by security researchers from the University of Plymouth and the University of Portsmouth found a way to speed up the detection of phishing websites. According to the paper, ML models trained on the visual representation of website codes can enhance the accuracy and speed of the process.
Under the Mutually Agreed Norms for Routing Society (MANRS), the Internet Society aims to launch an Equipment Vendor Program to address the most common threats to the internet routing system.
A six-kilometer-long optical fiber with a hollow core has been found to be effective in conducting Quantum Key Distribution (QKD). The QKD protocol is unhackable and can efficiently protect sensitive data from intruders.
The Brazilian government issued a data protection guide that aims to raise awareness among the public. The guide delineates the rights of data holders and provides recommendations on how they can protect their information.

The Bad

This month, ransomware adversaries targeted an unprecedented number of victims across the region with a majority of firms located in the U.S. Threats mounted for firms in agriculture, healthcare, auto, transportation, and other sectors. Moreover, a blackmailing scam aimed at the LGBTQ community was also spotted.

A ransomware attack at TiteLive disrupted operations at more than 1000 bookstores across France, Belgium, and the Netherlands. The attack has impacted bookstore chains such as Libris, Donner, Aquarius, Malperthuis, Atheneum Boekhandels, and others. The firm had to pull its IT plug to prevent the ransomware spread.
ZeroFox researchers uncovered a new ransomware family called Colossus that claims to have stolen 200GB of data from an automotive group of dealerships based in the U.S. The group has demanded $400,000 in ransom. The group doesn’t own a public ransomware leak site as of yet.
A Japanese multinational electronics giant JVCKenwood disclosed being hit by a $7 million ransomware attack by the Conti actors, who allegedly exfiltrated around 1.7TB of data. The gang further went on to upgrade its tactic by hiring affiliates to demolish backups.
NEW Cooperative was hit by a $5.9 million ransom demand after the BlackMatter group claimed to have stolen a terabyte of data. This incident was soon followed by Crystal Valley Cooperative, one of the largest U.S. agriculture businesses, being hit by a potential ransomware attack.
Internet service provider Yandex experienced one of the biggest DDoS attacks in the history of RuNet. The attack was launched by a new DDoS botnet named Meris that gains its power from more than 250,000 compromised devices.
United Health Centers revealed experiencing a ransomware attack by the Vice Society gang that disrupted IT systems across all of their 21 locations. The breach came to light after criminals leaked stolen sensitive data, such as patient benefits, financial documents, audits, and patient lab results.
Student storybook provider FarFaria blurted out approximately 38GB of data pertaining to 2.9 million users due to a misconfigured and exposed MongoDB database. The exposed details include emails, authentication tokens, encrypted passwords, social media-related data, and others.
Japanese company Fujitsu confirmed that 4GB of customer data was dumped on a cybercrime marketplace called Marketo. However, the site claims it also contains company data, budget data, and other reports.
About 1GB of data from sportswear manufacturer Puma, allegedly containing source code of internal management apps, was dropped for sale on an infamous cybercrime marketplace called Marketo.
Transportation organizations such as Forward Air and Navistar were affected by different security breach incidents that affected the sensitive details of their customers and employees.
Delta Medical Center in Missouri and Barlow Respiratory Hospital in Los Angeles suffered ransomware attacks by Hive and Vice Society ransomware gangs, respectively. The groups stole confidential patient data.
A popular hacker forum was found selling a database allegedly containing 3.8 billion Clubhouse and Facebook user records. While the entire database has a price tag of $100,000, the owner would split it into parts.
Experts uncovered a phishing scam wherein hackers masqueraded as officials from the U.S. Transportation Department to acquire login credentials of targeted firms. The Department of Justice and Constitutional Development of South Africa suffered a ransomware attack that knocked off several of its IT services, including the national bail services.
The U.S. FTC released alerts against fraudsters imitating potential romantic partners on online dating apps to carry out extortion targeting the LGBTQ+ community.
A cybercriminal, allegedly from the Groove ransomware gang, dumped approximately 500,000 Fortinet VPN login credentials on a hacker forum and a telegram channel for free.

New Threats

What more? New malicious campaigns took many by surprise. Nobelium, the actor believed to be behind the SolarWinds attack, was discovered working on two new malware. In another streak, a new malware threatened over two dozen public and private sector banks in India. Experts also took the wraps off Tanglebot, FamousSparrow, and more threats.

Nobelium APT has been linked with two new backdoors, dubbed Tomiris and FoggyWeb, that are capable of deploying additional payloads. The Tomiris malware was part of a cyberespionage campaign targeting organizations in Eastern Europe.
New variants of Mirai botnet and FormBook infostealer, were spotted in different campaigns that exploited zero-day vulnerabilities in RUIJIE routers and Office 365 respectively. DoppelDridex, a variant of Dridex, was also found using Slack and Discord CDNs as channels for propagation. An upgraded version of FinSpy was also found using UEFI bootkit to infect its victims.
CERT-In cautioned against the new Drinik Android malware that imitated an Income Tax department app to harvest banking credentials and personal data of users. So far, the campaign has targeted customers of 27 public and private sector banks in India.
Sarwent, a brand new malware, was associated with a campaign that impersonated the Amnesty International website to lure users with a fake promise of safeguarding them from the Pegasus spyware. The malware contains the usual abilities of a RAT.
SentinelLabs reported a new campaign delivering the ZLoader banking trojan via fake Google advertisements for various software, including Discord, Zoom, TeamViewer, and Java plugins.
A new TangleBot smishing campaign was discovered targeting Android users in the U.S. and Canada with lures related to COVID-19 regulations and vaccine information.
FamousSparrow, a new entrant to the cyberespionage space, was reportedly spying on users across multiple sectors, including government, engineering, legal, and hospitality.
The recently disclosed flaw in the Atlassian Confluence service was exploited in an attack to install a cryptocurrency miner. The flaw is tracked as CVE-2021-26084 and is related to an OGNL injection issue.
Ragnar Locker operators have adopted a new tactic to extort their victims. They have announced that they will leak the stolen data if the victims contact law enforcement agencies, negotiators, and data recovery experts.
The FBI, CISA, and CGCYBER issued a joint advisory warning against the exploitation of a critical bug in the Zoho ManageEngine ADSelfService Plus software by the nation-state actors.
ESET researchers stumbled across a mobile espionage campaign—active since March 2020—aimed at the Kurdish ethnic group. The campaign was conducted by the BlackHawk attackers who use Facebook and fake Android apps to trick users.
Microsoft laid bare a massive Phishing-as-a-Service operation called BulletProofLink that offers built-in hosting and email-sending services, and more, at a relatively low cost.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

New Threats

Related Threat Briefings

May 1, 2025