Cyware Weekly Threat Intelligence, August 11–15, 2025
The Good
Ransomware gangs are taking heavy hits on multiple fronts. In Operation Checkmate, U.S. authorities seized $1.1 million in ransom-linked cryptocurrency and shut down four servers and nine domains tied to the BlackSuit group. At the same time, researchers dealt a critical blow to DarkBit ransomware, linked to Iran’s MuddyWater APT, by exploiting flaws in its AES-128-CBC key generation to crack the encryption.
U.S. authorities launched a major operation against the BlackSuit ransomware group, seizing approximately $1.1 million in cryptocurrency linked to ransom payments. This initiative, known as Operation Checkmate, involved collaboration among various agencies, resulting in the takedown of four servers and nine domains used by the group. The operation underscores a proactive approach to combat ransomware threats and protect businesses and public entities.
Researchers cracked the encryption of DarkBit ransomware, allowing victims to recover their files without paying the ransom. This ransomware is linked to the Iran-nexus MuddyWater APT group, which has targeted Israeli institutions and demanded 80 Bitcoin while including anti-Israel messages in ransom notes. The researchers exploited vulnerabilities in DarkBit's AES-128-CBC key generation method, significantly reducing the keyspace for brute-forcing. Utilizing a high-performance computing environment, they efficiently recovered decryption keys, although scalability was limited.
The Bad
A crafty malvertising campaign is slipping PS1Bot into systems through deceptive compressed archives. With techniques like environmental polling and dynamic C# DLL compilation, PS1Bot evades detection while siphoning off passwords and cryptocurrency wallet data. GitHub repositories are turning into unexpected traps, with SmartLoader malware lurking behind seemingly legitimate projects like game cheats and software cracks. ScarCruft is pulling out all the stops with a malware campaign disguised as a simple postal code update, blending languages and abusing legitimate services for maximum stealth.
Blue Locker ransomware is targeting critical government institutions and the oil and gas sector in Pakistan, including Pakistan Petroleum Limited (PPL). The ransomware uses PowerShell-based loaders and phishing emails to deliver its payload, encrypt files, and demand ransom payments. NCERT issued high-alert notifications to 39 ministries to mitigate risks, emphasizing robust cybersecurity measures and employee awareness training. Blue Locker is linked to the Shinra malware family, which shares similarities with RaaS models like Conti and Black Basta.
Cisco Talos identified UAT-7237, a Chinese-speaking APT group targeting web infrastructure entities in Taiwan since 2022, using open-source and customized tools for long-term persistence. UAT-7237 employs a customized Shellcode loader called "SoundBill" to decode and load shellcodes, including Cobalt Strike payloads. It is assessed as a subgroup of UAT-5918, sharing victimology and tooling but differing in tactics such as selective web shell deployment and reliance on SoftEther VPN and RDP access. The group exploits known vulnerabilities on unpatched servers to gain initial access and uses tools for reconnaissance, credential extraction, and network scanning.
A malvertising campaign has been observed distributing PS1Bot, a multi-stage malware framework implemented in PowerShell and C#. This malware features a modular design, enabling various malicious activities such as information theft, keylogging, and establishing persistent access on infected systems. PS1Bot minimizes artifacts by executing modules in memory, avoiding disk writes. Victims are initially delivered a compressed archive containing a downloader script, which retrieves additional payloads from attacker-controlled servers. The malware can exfiltrate sensitive information, including passwords and cryptocurrency wallet data, through various modules. It uses techniques like environmental polling and dynamic compilation of C# DLLs to enhance its capabilities and evade detection, showcasing significant overlaps with previous malware families like Skitnet and AHK Bot.
Over 35 Linux images on Docker Hub still contain the XZ-Utils backdoor. This backdoor, embedded in the liblzma.so library of the xz-utils compression tool, enables attackers to bypass SSH authentication and execute commands as root. The malicious code was injected by a contributor and included in official packages for major Linux distributions like Debian and Fedora. Despite its discovery, many of these compromised images remain publicly accessible on Docker Hub.
An active phishing campaign is targeting UK organizations licensed to sponsor foreign workers and students by impersonating the Home Office. This sophisticated scheme aims to compromise the Sponsorship Management System (SMS) credentials of these organizations, facilitating various immigration fraud and extortion attempts. Attackers have been observed charging victims between £15,000 and £20,000 for fake job offers and visa sponsorships. The campaign begins with emails containing urgent alerts that direct users to fraudulent login pages, closely mimicking the official SMS interface. Once the attackers capture the credentials, they engage in monetization schemes, including selling access to compromised accounts and creating fake visa documents.
ASEC discovered widespread distribution of SmartLoader malware via GitHub repositories disguised as legitimate projects, focusing on game cheats, software cracks, and automation tools. These repositories include README files and compressed files containing malware, making them appear credible and difficult to identify as malicious. The malware activates when users execute a malicious batch file (Launcher.cmd), which loads an obfuscated Lua script through a Lua loader executable. SmartLoader primarily delivers infostealers like Rhadamanthys, which exfiltrates sensitive data such as email, FTP, and banking information by injecting into Windows processes.
North Korean APT group ScarCruft (APT37) has launched a sophisticated malware campaign, disguising it as a postal code update notice and employing cross-language malware development, legitimate service abuse, and victim-specific ransomware targeting. The campaign utilizes the PubNub real-time messaging API for C2 communication, complicating detection and mitigation. Likely entry point is phishing emails with malicious LNK files in RAR archives. Nine distinct malware components were deployed, including NubSpy (AutoIt/PowerShell backdoor), TxPyLoader (Python-based loader), LightPeek (PowerShell infostealer), FadeStealer (keylogger/audio recorder), and CHILLYCHINO (Rust-based backdoor). VCD ransomware encrypts files using RSA and AES-256-CBC, drops bilingual ransom notes, self-deletes after execution, and renames files with the .VCD extension.
New Threats
Crypto24 is striking high-profile organizations with surgical precision, blending legitimate IT tools like PSExec and AnyDesk with custom malware to devastating effect. A formidable new ransomware, Charon, is borrowing pages from APT playbooks to deliver tailored strikes against organizations. A fresh twist on the DarkCloud malware is catching victims off guard through phishing emails packed with obfuscated JavaScript in RAR archives. Written in Visual Basic 6, this variant dodges sandboxes by monitoring user activity.
PhantomCard, a new Android NFC-based malware, has been targeting Brazilian banking customers, relaying NFC data from victims' cards to fraudsters' devices. The malware is distributed via fake Google Play pages, disguised as "Card Protection" apps with fake positive reviews to lure victims. PhantomCard operates by requesting victims to tap their cards on the infected device, transmitting NFC data to a server controlled by cybercriminals for fraudulent transactions. The malware relies on the ISO-DEP standard of EMV cards and uses the "scuba_smartcards" library to parse and relay card data. The actor behind PhantomCard, "Go1ano developer," is a reseller who customized the malware purchased from Chinese-originated "NFU Pay" Malware-as-a-Service.
CrossC2 is an unofficial tool developed to enhance Cobalt Strike Beacon's capabilities for Linux and macOS platforms, facilitating cross-platform attacks. It operates by employing anti-analysis techniques, such as string encoding and junk code insertion, while utilizing AES128-CBC for configuration data decryption. The execution process involves ReadNimeLoader, which sideloads DLLs to decrypt and run malware payloads in memory. This loader incorporates various anti-debugging measures and uses AES256-ECB for payload decryption. The campaign has been linked to the BlackBasta group, evidenced by shared domains and tools. Attackers also utilized PsExec, Plink, and SystemBC for lateral movement and privilege escalation.
Crypto24 is a sophisticated ransomware group that skillfully combines legitimate IT tools with custom malware to execute stealthy multi-stage attacks on high-profile organizations across Asia, Europe, and the U.S. By targeting sectors such as financial services, manufacturing, entertainment, and technology, they maintain persistence through privileged account creation and scheduled tasks that integrate malicious activities with normal operations. Their arsenal includes tools like PSExec and AnyDesk for lateral movement, alongside advanced evasion techniques to bypass security measures. Data theft is facilitated through keyloggers and Google Drive for exfiltration, demonstrating the group’s ability to blend in with regular IT operations while executing precision attacks.
A new ransomware family named Charon has emerged, employing advanced techniques reminiscent of APT strategies to target organizations with tailored ransom demands. This sophisticated malware utilizes DLL sideloading and process injection, leveraging legitimate binaries like Edge.exe to deploy its payload through a malicious DLL. Charon’s attack chain involves complex encryption methods, combining Curve25519 elliptic curve cryptography with the ChaCha20 stream cipher, while specifically avoiding the encryption of certain file types. Upon infection, it appends the ".Charon" extension to files and includes a unique infection marker. Notably, Charon demonstrates the ability to propagate across networks by encrypting accessible shares.
Researchers have identified significant vulnerabilities in the Terrestrial Trunked Radio (TETRA) communications protocol, particularly affecting its end-to-end encryption mechanism. These vulnerabilities include issues that allow replay and brute-force attacks, potentially enabling attackers to decrypt encrypted traffic. Notable vulnerabilities include the risk of replay attacks on voice streams and the use of a weakened AES-128 implementation, which reduces key entropy, making it susceptible to brute-force methods. Additionally, TETRA networks can be exploited through message injection due to a lack of authentication.
Researchers identified a new variant of the DarkCloud malware campaign, which begins with a phishing email containing a malicious RAR archive. This archive includes an obfuscated JavaScript file that, when executed, runs PowerShell code to load an encrypted .NET DLL disguised as a legitimate Task Scheduler module. The malware establishes persistence by copying itself and modifying the system registry, while downloading a fileless payload from a remote URL. The DarkCloud payload, written in Visual Basic 6, employs anti-analysis techniques to avoid detection, such as monitoring user activity to evade sandboxes. It collects sensitive information, including login credentials and payment data from various applications, and exfiltrates this data via SMTP, sending it to the attacker as text files.