Cyware Weekly Threat Intelligence, February 03–07, 2025

The Good

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning.

• PyPI launched Project Archival, a system for project publishers to indicate that no further updates will be made. Archived projects will remain available for download, but users will see a warning about their maintenance status to help them choose their dependencies wisely. This feature aims to boost supply-chain security by reducing the risk of attackers hijacking developer accounts and pushing harmful updates to abandoned projects. It also helps decrease user support requests by clearly stating the project's lifecycle status. 
• U.S. and Dutch authorities seized 39 domains and servers belonging to the HeartSender cybercrime group, based in Pakistan. This operation targeted a group known for selling hacking and fraud tools since 2020, causing losses of over $3 million in the U.S. HeartSender, also called Saim Raza and Manipulators Team, ran multiple marketplaces that sold key items like malware, phishing kits, and email extractors, along with providing training for using these tools.
• Five Eyes cybersecurity agencies from the U.K, Australia, Canada, New Zealand, and the U.S. have published a guidance, recommending that manufacturers of network edge devices improve forensic visibility to help detect attacks and investigate breaches. They urged manufacturers to include robust logging and forensic features. Additionally, they recommended that organizations review minimum forensic visibility requirements before selecting network devices. 
• The U.K has launched a new Cyber Monitoring Centre (CMC) to better measure cyber incidents with improved clarity and precision. This center uses methods similar to those used for natural disasters, like the Richter scale for earthquakes. The CMC has developed a specific methodology for evaluating cyber events, which includes gathering diverse data and categorizing incidents based on the affected population and financial impacts. Overall, the CMC strives to provide a comprehensive assessment of cyber incidents to improve understanding and responses in the cybersecurity landscape.

The Bad

Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. 

• The North Korea-linked Kimsuky hacking group is conducting spear-phishing attacks to deliver the forceCopy malware. These attacks start with phishing emails containing a deceptive Windows shortcut file that looks like a Microsoft Office or PDF document. Opening the file launches PowerShell or mshta.exe, which then downloads and runs further malware, including the trojan PEBBLEDASH and RDP Wrapper. The forceCopy malware targets web browser directories to steal configuration files and credentials.
• Sucuri identified a cybersecurity incident involving credit card data theft from a Magento-based eCommerce website, and traced the malware to a Google Tag Manager (GTM) script. The malware was found in the website's database and included obfuscated code that appeared legitimate but was actually designed to steal sensitive information during checkout. A backdoor was discovered in the website's media folder and At least six websites were infected with the same GTM ID.
• The CISA has added several vulnerabilities to its KEV catalog, including issues in Microsoft Outlook and Sophos XG Firewall. Notable flaws include CVE-2024-21413 in Outlook, which has a CVSS score of 9.8 and allows remote code execution, and CVE-2020-15069 in Sophos XG Firewall, also with a CVSS score of 9.8. Federal agencies must address these by February 27, and private organizations are advised to review and fix these vulnerabilities as well.
• GreenSpot APT group is running a phishing campaign targeting users of 163[.]com, a popular email service in China. Since at least 2007, this group has focused on Chinese government and military targets. In this latest effort, they created fake domains like mail[.]ll63[.]net and mail[.]eco163[.]com to steal login information. These domains mimic the real 163.com service, making it easy for unsuspecting users to fall for the scam. 
• Threat actors are exploiting the popularity of DeepSeek to promote two malicious infostealer packages on PyPI, named deepseeek and deepseekai. These packages were designed to look like developer tools for an AI platform and were uploaded by a newly created account with no prior activity. These packages, when run, stole sensitive data from developers, including user information and environment variables like API keys.

New Threats

Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site. 

• Attackers are now using video attachments in MMS to promote Bitcoin scams, moving away from static images. A recent case involved a small 14KB .3gp video file that lures victims into clicking links and engaging with scammers. Recipients are directed to WhatsApp groups where scammers exert pressure to get money or personal information. A .3gp file is designed for 3G networks, optimized for small sizes, making it suitable for mobile devices with limited storage and slower networks. 
• XE Group is targeting companies in manufacturing and distribution by exploiting zero-day vulnerabilities in VeraCore software, specifically CVE-2025-25181 and CVE-2024-57968. In a recent incident, the group compromised an IIS server hosting VeraCore software in November 2024, which led to the discovery of unique techniques used to exfiltrate files and run malicious commands. The group evolved from credit card skimming to exploiting vulnerabilities, showing their adaptability. The upload vulnerability was patched in November 2024, but no patch for the other vulnerability is available.
• Morphisec has found a new version of the ValleyRAT malware, which uses advanced evasion tactics and targets computer systems. This malware is distributed through phishing emails, messaging apps, and hacked websites, focusing on high-profile individuals in finance, accounting, and sales to steal sensitive information. The new variant spreads through a fake download of a Chrome browser from a fraudulent Chinese telecom website. It uses a .NET executable to check for admin rights and download more malware components. The malware injects itself into legitimate processes to operate secretly, using names that seem normal to avoid attracting attention. 
• A help desk phishing campaign has been targeting Microsoft Active Directory Federation Services (ADFS) to steal credentials and bypass MFA. The campaign focuses on education, healthcare, and government organizations, hitting at least 150 targets. Attackers send phishing emails pretending to be from the organization's IT team, urging victims to log in for security updates. These emails lead to fake ADFS login pages that mimic legitimate ones, where victims enter their usernames, passwords, and MFA codes. 
• SentinelOne found new variants of a macOS malware family, named FlexibleFerret, used by North Korean threat actors in schemes centered around fake job interviews. This malware is part of the Contagious Interview campaign. Typically, targets are directed to click a link which gives an error message and prompts them to install software like VCam or CameraAccess for virtual meetings. FlexibleFerret is particularly deceptive, as it was signed with a valid Apple Developer signature, although this signature has since been revoked. The ongoing campaign targets employers and developers on job search platforms. 
• A new malware called ELF/Sshdinjector.A!tr has been linked to the DaggerFly espionage group, targeting Linux-based network devices for data theft. The dropper checks for existing infections and deploys malicious files if none are found. It replaces essential binaries with infected versions to maintain access. Key features include overwriting system binaries, remote control through an altered SSH library, extracting sensitive information, executing commands from attackers, and encrypted communication. 
• Forcepoint’s X-Labs research team discovered a new malware campaign using AsyncRAT with Python scripting and TryCloudflare tunnels to stealthily deliver harmful payloads. The campaign starts with a phishing email that contains a Dropbox link, leading to a ZIP file. This file has a shortcut that redirects to a TryCloudflare link. The attack involves several steps: the shortcut leads to an LNK file, which triggers PowerShell scripts to get an obfuscated JavaScript file. This links to a ZIP file with a Python script that runs malicious code.