Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence - April 04–08

Cyware Weekly Threat Intelligence - April 04–08 - Featured Image

Weekly Threat Briefing Apr 8, 2022

The Good

Governments are increasingly looking to upgrade their cybersecurity policies to align with the changing security landscape. Taking a step in that direction, the U.S. State Department launched its Bureau of Cyberspace and Digital Policy. The Cyclops Blink botnet was killed before it could even blink a complete blink. The FBI took down the modular botnet by disrupting its infrastructure and closing external management ports.

  • The FBI announced taking down the Cyclops Blink botnet, which used to target firewall appliances and SOHO networking devices. It was under the control of the Russian Sandworm group.

  • German police disrupted the dark web market Hydra and seized bitcoin worth $25 million. The marketplace was a hub for selling narcotics, stolen credit card data, money laundering services, fake identity documents, and protecting Tor users.

  • The Bureau of Cyberspace and Digital Policy was launched officially under the State Department to address the national security challenges, economic opportunities, and implications for the U.S. in the areas of cyberspace, digital technologies, and digital policy.

  • The Australian Department of Home Affairs started work on a new national data security action plan. It comes as a part of the federal government’s digital economy strategy, which will safeguard citizens’ data stored on digital networks and systems.

The Bad

Despite humongous data leaks of its own internal communications, Conti remains in business. The ransomware actor leaked around 5GB of files belonging to Parker Hannifin. Just when you think a particular threat has disappeared and you can breathe a little easy, it comes and hits you hard. The same goes for the recent Magecart attack against a mattress maker, which impacted customers across 12 nations. Cadbury UK took to Twitter to warn against a scam pretending to sell free chocolates. Falling victim to it can turn pretty bitter, warned the company.

  • A Magecart attack at Emma Sleep Company affected the credit or debit card details of its customers. The attackers injected the malicious code into the checkout page to steal personal information and credit card data.

  • A compromised Trezor hardware wallet mailing list was used to send fake data breach notifications to steal cryptocurrency wallets and the assets stored within them. Attackers leveraged one of the newsletters hosted at MailChimp to launch the attack. The notifications prompted recipients to download a fake Trezor Suite software that would steal their recovery seeds.

  • Discord communities of multiple major NFT projects were hacked as part of a phishing scam to trick users into handing over their digital JPEGs. Some of the affected projects were Bored Ape Yacht Club, Nyoki, Doodles, Kaiju Kingz, and Shamanz. The ultimate goal was to trick users into clicking a link to mint a fake NFT by sending ETH and in some instances an NFT to wrap into a token.

  • Cadbury UK has issued a warning to its 315,000 followers on Twitter about a scam that steals their personal information. The scam, which goes with the title ‘Free easter chocolate basket,’ is making the rounds on WhatsApp and social media sites. The recipients are asked to click on a link to claim the free gift. But, before that, the recipients are asked to answer a series of questions appearing on the screen.

  • More than $15 million were stolen after hackers exploited the DeFi platform Inverse Finance. According to the company, the hackers manipulated its money market, Anchor, and increased the price of INV via Sushiswap. This enabled the attackers to borrow $15.6 million in the DOLA, ETH, WBTC, and YFI cryptocurrencies.

  • Wind turbine giant Nordex was forced to shut down its IT systems after discovering a cyberattack. The incident affected multiple systems in the firm. As a part of the precautionary measure, the company took immediate actions to prevent further propagation of the attack.

  • An ongoing malware attack campaign is using ISO disk images to deliver AsyncRAT, LimeRAT, and other commodity malware to victims. The threat actors behind the campaign have been using a new version of the 3LOSH crypter to generate obfuscated code to hide the RAT payloads and facilitate the infection process.

  • Ukraine CERT-UA published a security advisory about spear-phishing attacks conducted by Russia-linked Armageddon APT. The attacks targeted local state organizations with malware. The phishing messages were sent from ‘vadim_melnik88@i[.]ua.’ In another instance, the CERT-UA also revealed a cyberattack that enabled attackers to get session data, a list of contacts, and the history of their Telegram session. The operators leveraged the Telegram website to send malicious links to users.

  • The Conti ransomware group has leaked more than 5GB of files allegedly stolen from U.S. industrial component giant Parker Hannifin. As the company continues its investigation, it confirmed that some data, including the personal information of employees, was accessed by hackers.

  • The Australian Competition & Consumer Commission has issued a warning about the rise in money recovery scams. It is found that scammers are impersonating a money recovery firm, law office, or a special government task force to trick users into filling out fake paperwork that could help them with the recovery of previously stolen funds. The targeted victims are approached via phone or email. The ultimate goal of scammers is to steal identification details from users. Some of these scams also enabled threat actors to gain remote access to victims’ computers or smartphones.

  • The Texas Department of Insurance (TDI) disclosed a data security incident that affected roughly 1.8 million people. It occurred due to a vulnerability in one of its web applications. The exposed information included names, phone numbers, addresses, dates of birth, and social security numbers of individuals.

  • A data theft tool used by BlackCat (aka ALPHV) ransomware is increasingly being used to target industrial organizations. It is tracked as ExMatter, a modified version of Fendr. Researchers revealed that the BlackCat group had used Fendr to exfiltrate data from oil, gas, mining, and construction firms in South America.

  • AridViper APT group was found targeting high-ranking Israeli officials in a cyberespionage campaign to spy and steal data by compromising their systems and mobile devices.

  • A phishing email pretending to be a payment notification from a trusted bank was found delivering Remcos RAT. The email asked the recipient to open the attached Excel file that is protected by a password. The file lures the victim into clicking the ‘Enable Content’ button to execute the malicious macro code.

  • North Carolina A&T State University became the latest victim of BlackCat ransomware. The incident occurred on March 7, forcing staff and students to operate manually. Systems taken down by the intrusion included wireless connections, Blackboard instruction, single sign-on websites, VPN, Jabber, Banner Document Management, Chrome River, and Qulatrics.

  • WonderHero has disabled its website and services after hackers stole $320,000 worth of Binance Coin. Threat actors took advantage of the cross-chain bridging withdrawal feature on the platform to launch the attack.

  • The critical Spring4Shell vulnerability has lately been exploited by the Mirai botnet. The attack was first observed on April 1. The botnet exploited one of the Spring4Shell vulnerabilities (CVE-2022-22965) to launch attacks.

  • Google removed several apps from its Play Store after they were found stealing sensitive data from users. The apps had over 45 million downloads and collected the data through a third-party SDK that had the ability to capture clipboard content, GPS data, email addresses, phone numbers, and even modem router MAC addresses.

  • Fraudsters made nearly $1.7 million by promising cryptocurrency giveaway scams on YouTube. Over 36 YouTube channels used for the purpose were observed between February 16 and February 18, attracting at least 165,000 viewers. The videos were made using footage of tech entrepreneurs and crypto investors like Elon Musk, Brad Gralinghouse, Michael Saylor, Changpeng Zhao, and Cathie Wood to add legitimacy to scams. Additionally, these videos include links to at least 29 websites with instructions on how to double cryptocurrency investments.

**New Threats **

Borat’s in town; not the movie though. It’s a new RAT that can conduct both ransomware and DDoS attacks, along with possessing several other capabilities. WhatsApp has once again become a favorite target for cybercriminals as a new phishing campaign abuses the platform’s voice messaging feature. The SharkBot banking trojan has resurfaced in a new campaign, biting victims across many countries.

  • Researchers discovered a new RAT named Borat that is capable of conducting DDoS and ransomware attacks. Other capabilities include recording keystrokes, capturing videos from the webcam, stealing credentials from Chromium-based web browsers, and pilfering Discord tokens from infected systems.
  • A new campaign that delivers SocGholish in the initial stage, with BLISTER as a second-stage loader, has been uncovered by researchers. It is believed that both the loaders are being used to evade detection to execute final payloads, specifically LockBit in this case.
  • A new WhatsApp phishing campaign impersonating WhatsApp’s voice message feature is being used to spread information-stealing malware. So far, the campaign has affected around 28,000 email addresses. As a part of the campaign, the recipients are led to a series of steps that ultimately cause the installation of the malware that is capable of pilfering credentials.
  • The FIN7 APT group has evolved its malware and attack tactics. These include a new POWERPLANT backdoor and two new versions of BIRDWATCH downloader—tracked as CROWVIEW and FOWLGAZE. Researchers claim that these malware are being used by threat actors to gain initial access and deliver more payloads.
  • Researchers uncovered a new cyberespionage campaign targeting Malaysian users. Active since 2021, the campaign primarily targets the customers of eight Malaysian banks - Maybank, Affin Bank, Public Bank Berhad, CIMB Bank, BSN, RHB, Bank Islam Malaysia, and Hong Leong Bank. The attack leverages multiple apps and websites for cleaning services such as Maid4u, Grabmaid, Maria’s Cleaning, YourMiad, Maideasy, and MaidACall to trick users. The goal of the malware operators is to obtain banking credentials from the victims.
  • A new .NET-based info-stealer called Lightning Stealer is capable of stealing sensitive details by targeting over 30 browsers, Telegram, Discord, Steam, and crypto wallets. The malware stores the exfiltrated data in JSON format.
  • A newly discovered Colibri loader campaign is being used to deliver the Vidar info-stealer as the final payload. The attack starts with a malicious Word document deploying the loader. Colibri leverages PowerShell to maintain persistence after a reboot.
  • Researchers found a new campaign distributing SharkBot malware. At least six apps with over 15,000 downloads were leveraged to spread the malware. Most of the victims were from Italy and the U.K, with some users from China, India, Romania, Russia, Ukraine, and Belarus.
  • A new campaign dubbed Operation Bearded Barbie has been associated with APT-C-23, a subgroup of the Hamas-linked cyber warfare operation. The campaign used a fake messaging app known as VolatileVenom to deliver two new malware - Barbie downloader and BarbWire backdoor. The campaign targeted high-profile officials working in defense, law enforcement, emergency services, and other government services.
  • A new information stealer named FFDroider capable of stealing credentials and cookies stored in browsers has been uncovered by security researchers. The stolen credentials can be used further to hijack victims’ social media accounts. The malware is distributed via cracked software, free software for games, and other files downloaded from torrent sites.
  • Cado security stumbled across a new malware variant, dubbed Denonia, that targets AWS Lambda, a scalable service used by SMBs and enterprise players worldwide.
  • Threat actors have repurposed the code of an old Android malware called ExobotCompact to build a new malware dubbed Octo. It is distributed via a variety of fake apps disguised as Pocket Screencaster, Fast Cleaner 2021, Postbank Security, BAWAG PSK Security, and Play Store update. Once executed, the Octo could allow threat actors to conduct fraudulent transactions, records keystrokes, and harvest contact information.
  • A new Traffic Direction System (TDS) called Parrot has emerged in recent months to redirect victims to 16,500 malicious websites for universities, local governments, adult content platforms, and personal blogs. The newly discovered TDS shares similarities to the Prometheus TDS that appeared in 2021.

Related Threat Briefings

Mar 14, 2025

Cyware Weekly Threat Intelligence, March 10–14, 2025

A Russian hosting provider is feeling the heat from global sanctions. Australia, the U.K., and the U.S. have sanctioned Zservers, a bulletproof hosting provider linked to ransomware and fraud, freezing its assets and restricting operations. Switzerland is tightening its grip on cyber incident reporting. Starting April 1, critical infrastructure operatorsmust report cyberattacks to the NCSC within 24 hours, reinforcing national cybersecurity defenses. Cybercriminals are upgrading their toolkit for long-term access. Ragnar Loader is being leveraged by ransomware groups like FIN7, FIN8, and Ragnar Locker, evolving into a stealthier and more modular malware for persistent system compromise. Chinese hackers are slipping past defenses in Juniper routers. The UNC3886 threat group is backdooring older Juniper MX routers, bypassing security protections and embedding custom TinyShell malware to maintain access. North Korean hackers are adding ransomware to their arsenal. Moonstone Sleet (Storm-1789) is deploying Qilin ransomware, using fake companies and trojanized tools to infiltrate targets through LinkedIn and freelance platforms. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide. Copy, paste, and lose your crypto. MassJacker hijacks clipboard transactions, swapping wallet addresses with attacker-controlled ones, stealing funds from victims who unknowingly send money to the wrong destination. A fake CAPTCHA is all it takes to get root access. The OBSCURE#BAT campaign is using social engineering tactics to install the r77 rootkit, bypassing defenses and targeting English-speaking users with stealthy, persistent malware.

Mar 7, 2025

Cyware Weekly Threat Intelligence, March 03–07, 2025

The code caves of GitHub just got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. Cheap Android gadgets are getting a breather from a relentless digital pest. The BadBox 2.0 botnet, a souped-up sequel backed by multiple threat crews, saw 24 shady apps booted from Google Play and half a million infected devices cut off from their puppet masters, thanks to some crafty sinkholing and Google’s cleanup sweep. A sneaky gatecrasher has turned WordPress into a redirect rollercoaster. A malicious JavaScript injection lurking in a theme file has snagged at least 31 sites, pulling visitors through a two-step detour to shady third-party domains. Japan’s digital defenses are under siege from a shadowy crew with a taste for chaos. Since January, unknown threat actors have been prying open organizations in tech, telecom, entertainment, and more, exploiting CVE-2024-4577 in PHP-CGI on Windows. Crooks posing as the Electronic Frontier Foundation are targeting Albion Online players with phishing emails and fake PDFs, claiming account trouble. It’s a ruse to drop Stealc malware and Pyramid C2. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. The Eleven11bot botnet, loosely tied to Iran, has taken over 86,000 IoT devices to slam telecoms and gaming servers with relentless DDoS barrages. Social media’s sunny side has a dark shadow creeping across the Middle East and North Africa. Since September 2024, Desert Dexter has been slinging a tweaked AsyncRAT via legit file-sharing sites and Telegram. For detailed Cyber Threat Intel, click ‘Read More’.

Feb 21, 2025

Cyware Weekly Threat Intelligence, February 17–21, 2025

Google is stepping up its defenses against the quantum threat. The company is rolling out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Supply chain attacks just got harder to pull off. Apiiro has released two open-source tools to detect malicious code in software projects. With high detection rates across PyPI and npm packages, these tools add a crucial layer of security for developers. China’s Salt Typhoon is making itself at home in global telecom networks. The group has been caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. ShadowPad malware is once again causing havoc in Europe. Trend Micro flagged 21 targeted companies across 15 countries, with manufacturing firms bearing the brunt. A RAT is hiding in plain sight. SectopRAT has been spotted disguised as a fake Google Docs Chrome extension. It steals browser data, targets VPNs and cryptocurrency wallets, and injects malicious scripts into web pages. Darcula Suite is taking PhaaS to the next level. The upcoming update, currently in beta, will let users generate their own phishing kits by cloning real websites and customizing attack elements. A new payment card skimming campaign is turning Stripe’s old API into a weapon. Hackers are injecting malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. LummaC2 is spreading through cracked software downloads again. ASEC found it disguised as a pirated Total Commander installer, hiding behind Google Collab Drive and Reddit links.

Feb 14, 2025

Cyware Weekly Threat Intelligence, February 10–14, 2025

Cyber defenders are sharpening their tools, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. India is taking digital banking security up a notch. The RBI is launching a dedicated domain to curb financial fraud and enhance trust in online banking. Starting April 2025, financial institutions will register under this domain. China’s RedMike hackers are dialing into telecom networks - literally. Between December 2024 and January 2025, they targeted over 1,000 unpatched Cisco devices. Their primary focus? Global telecoms and university networks in Argentina, Bangladesh, and the U.S. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. Love is in the air, but so are phishing scams. In late January, cybercriminals launched a Valentine’s-themed phishing campaign, offering fake gift baskets in exchange for stolen credentials. Cybercriminals are upping their game with Astaroth, a phishing kit that doesn’t just steal credentials but also hijacks entire sessions. By using a reverse proxy, Astaroth intercepts logins and 2FA tokens in real time, allowing attackers to bypass security measures undetected. South America’s foreign ministry was caught in the crosshairs of an advanced cyber-espionage campaign. In November 2024, attackers linked to REF7707 deployed the PATHLOADER and FINALDRAFT malware to infiltrate diplomatic networks. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script.

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.