Cyware Weekly Threat Intelligence, August 18–22, 2025

The Good

As cyber threats evolve, global takedown efforts are stepping up to safeguard digital ecosystems. INTERPOL’s Operation Serengeti arrested 1,209 cybercriminals across 18 African nations, recovering $97.4 million and dismantling over 11,000 malicious infrastructures. In another coordinated operation, U.S. authorities seized the Rapper Bot DDoS botnet, which had been active since 2021 and targeted 18,000 victims across 80 countries. The Python Package Index (PyPI) introduced defenses against domain resurrection attacks to prevent account hijacking and supply chain attacks. 

• U.S. authorities disrupted the Rapper Bot DDoS botnet, one of the most powerful on record, with attacks peaking at over six terabits per second. The botnet, active since 2021, targeted 18,000 victims across 80 countries, infecting between 65,000 to 95,000 IoT devices. The DDoS attacks were most heavily concentrated in China, Japan, the United States, Ireland, and Hong Kong. Ethan Foltz, a 22-year-old from Oregon, was charged for developing and running the botnet.
• The Python Package Index (PyPI) implemented new defenses against domain resurrection attacks, which exploit expired domains to hijack accounts via password resets. PyPI now uses Domainr’s Status API to monitor domain lifecycles, marking expired email domains as unverified to block unauthorized access. Since June 2025, over 1,800 email addresses have been unverified. PyPI recommends adding backup emails and enabling two-factor authentication to enhance account security and prevent supply-chain attacks.
• INTERPOL’s Operation Serengeti, conducted from June to August 2025, led to the arrest of 1,209 cybercriminals across 18 African nations, targeting 88,000 victims. The crackdown recovered $97.4 million and dismantled 11,432 malicious infrastructures, including 25 cryptocurrency mining centers in Angola and a $300 million investment scam operation in Zambia. The operation also disrupted a transnational inheritance scam, highlighting the need for global cooperation to combat cybercrime.
• ISACA launched the Advanced in AI Security Management (AAISM) certification to equip cybersecurity professionals with skills to manage AI-related security risks. Aimed at CISM or CISSP holders, AAISM focuses on AI governance, risk management, and technologies. ISACA’s research highlights a knowledge gap, with only 25% of digital trust professionals highly familiar with AI, and 89% needing AI training soon. The certification, announced on August 19, complements ISACA’s AI-focused courses and credentials like AAIA.

The Bad

Berserk Bear hackers are wielding a seven-year-old Cisco flaw to infiltrate global critical infrastructure. Exploiting CVE-2018-0171, these FSB-linked attackers trigger device reloads and use custom SNMP tools. MuddyWater APT is targeting CFOs with spear-phishing, using Firebase-hosted phishing pages and custom CAPTCHAs. With a diplomat’s charm, malicious emails are smuggling XenoRAT into South Korea’s embassies via GitHub traps. Since March, this spearphishing spree has targeted European missions. 

• CORNFLAKE.V3 is a sophisticated backdoor malware linked to the threat groups UNC5518 and UNC5774, which exploit compromised websites to deliver malicious payloads. Since June 2024, UNC5518 has been using deceptive techniques, such as fake CAPTCHA pages, to lure users into executing downloader scripts that facilitate malware infections. CORNFLAKE.V3, which supports various payload types including executables and DLLs, establishes persistence through registry Run keys and communicates with its command-and-control server via HTTP. The malware conducts extensive reconnaissance, including Active Directory enumeration and credential harvesting through Kerberoasting, thereby enabling lateral movement within networks. 
• Russian hackers linked to the FSB are exploiting a seven-year-old vulnerability (CVE-2018-0171) in Cisco devices, to target critical infrastructure globally. This flaw allows unauthenticated attackers to remotely trigger device reloads, potentially causing DoS conditions or executing arbitrary code. Over the past year, the FBI has observed these hackers collecting configuration files from thousands of networking devices associated with U.S. entities and modifying them for unauthorized access. The group, known as Berserk Bear, has previously targeted various government and aviation networks. The attackers are employing custom SNMP tools and the SYNful Knock firmware implant to maintain long-term access and evade detection, indicating a significant ongoing threat to vulnerable systems.
• MuddyWater APT is executing a sophisticated spear-phishing campaign aimed at CFOs and finance executives worldwide. This campaign employs social engineering tactics, including impersonating a Rothschild & Co recruiter, to lure victims to Firebase-hosted phishing pages featuring custom CAPTCHA challenges. Attackers utilize multi-stage payload delivery methods, incorporating malicious VBS scripts and ZIP archives to install legitimate remote-access tools like NetBird and OpenSSH, ensuring persistent access to compromised systems. The investigation revealed a shift in infrastructure from 192.3.95.152 to 198.46.178.135, with multiple hosting paths observed. 
• Cybercriminals are increasingly exploiting the AI-powered website builder Lovable to create a variety of malicious sites, including phishing pages and malware portals that impersonate well-known brands. Since February, Proofpoint has detected tens of thousands of Lovable URLs used in phishing campaigns, with attackers sending hundreds of thousands of emails targeting organizations. Examples include fake Microsoft login pages designed to harvest user credentials and a UPS impersonation scheme that collected personal and financial information. Additionally, a cryptocurrency theft campaign tricked users into connecting their wallets to fraudulent sites, while malware delivery efforts utilized Lovable-hosted links to distribute remote access trojans. 
• Threat actors are exploiting a critical vulnerability (CVE-2023-46604) in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy the DripDropper malware. This malware, which requires a password to run, communicates with an attacker-controlled Dropbox account, allowing for covert C2. After gaining access, the attackers patch the vulnerability to prevent further exploitation by others and to evade detection. They modify existing SSH configurations to enable root login, facilitating the installation of DripDropper, which alters system files to ensure persistence.
• A state-sponsored espionage campaign is targeting foreign embassies in South Korea with XenoRAT malware, delivered through malicious GitHub repositories. Since March, at least 19 spearphishing attacks have been launched, primarily against European embassies, using sophisticated email lures that include fake meeting invitations and official correspondence. The attackers employed password-protected ZIP files from cloud storage services, containing disguised .LNK files that execute PowerShell code to retrieve the malware. XenoRAT is a powerful trojan capable of logging keystrokes, capturing screenshots, accessing webcams, and facilitating remote operations.
• An active Android phishing campaign is targeting Indian users by impersonating a government electricity subsidy service. Attackers lure victims into downloading a malicious app through YouTube videos and a phishing website that mimics an official government portal. Once installed, the app masquerades as a “security update” and requests aggressive permissions to access contacts and SMS messages. It steals sensitive financial information, including UPI credentials, by directing users to fake payment forms. The malware can also send phishing messages to the victim's contacts and is remotely controlled via Firebase.

New Threats

Masquerading as an Australian electronics store, Cookie Spider’s malvertising campaign unleashed the AMOS malware on over 300 targets. Fraudsters posing as celebrity podcast reps are reeling in business owners with a bait. This podcast imposter scam lures victims into tech-check calls that grant remote access. A zero-day flaw has Apple racing to patch millions of devices with emergency iOS and iPadOS updates.

• Between June and August, over 300 entities were targeted in a malvertising campaign utilizing the Atomic macOS Stealer (AMOS) by the cybercrime group Cookie Spider. Victims were lured into executing malicious commands that fetched a Bash script, enabling the installation of a variant called SHAMOS. This malware conducted reconnaissance and data theft, searching for sensitive information such as passwords, Keychain data, and cryptocurrency wallet details, which it exfiltrated to remote servers in ZIP archives. The campaign, which spanned multiple countries but excluded Russia, cleverly impersonated a legitimate Australian electronics store to bypass security measures. 
• QuirkyLoader is a newly identified malware loader that has been actively delivering various infostealers and remote access tools since November 2024. This multi-stage infection process begins with malicious emails containing an archive file that includes a legitimate executable, an encrypted payload, and a malicious DLL. By employing DLL side-loading, QuirkyLoader executes the DLL, which decrypts and injects the final payload into target processes using techniques like process hollowing. Notably, the loader's DLL module is consistently written in C# .NET and utilizes Ahead-of-Time (AOT) compilation to disguise its true nature. QuirkyLoader has been observed in campaigns targeting specific organizations, such as Nusoft in Taiwan, and employs unique encryption methods, including the Speck-128 cipher, to evade detection and execute its malicious activities effectively.
• Apple issued emergency updates for iOS 18.6.2 and iPadOS 18.6.2 to fix a critical zero-day vulnerability actively exploited in attacks. The vulnerability (CVE-2025-43300) is an out-of-bounds write issue in the ImageIO framework, triggered by malicious image files. Exploitation can lead to memory corruption and unauthorized device access, affecting millions of users globally. Devices impacted include iPhone XS and later models, and various iPad generations such as iPad Pro, iPad Air, and iPad mini. The attacks are described as "extremely sophisticated," potentially linked to nation-state actors or advanced threat groups.
• Chinese-speaking threat actors are leveraging Ghost-tapping techniques, a new way to commit retail fraud via NFC relay fraud, utilizing stolen payment card details linked to mobile wallets like Apple Pay and Google Pay. Cybercriminals sell burner phones loaded with stolen payment card credentials and proprietary software capable of relaying payment card data for ghost-tapping campaigns. Chinese syndicates recruit mules to purchase physical goods using ghost-tapping techniques, resell them for cash, and launder funds through platforms like Huione Guarantee, Xinbi Guarantee, and Tudou Guarantee.
• A new scam known as the podcast imposter scheme is targeting business owners and influencers, where fraudsters pose as representatives of fictional celebrity podcasts. Victims receive enticing emails inviting them to share their experiences for a $2000 compensation. Once they express interest, the scammers arrange a call to check their technology, which serves as a pretext to gain remote access to the victim's computer. This allows the criminals to hijack social media accounts and potentially compromise other accounts with the same passwords. The Better Business Bureau warns that this tactic is increasingly aimed at executives and specialists, making them vulnerable entry points into corporate systems for cybercriminals.