Cyware Weekly Threat Intelligence, July 14–18, 2025
The Good
A keyboard army just lost its command center. Europol’s Operation Eastwood has crippled the pro-Russian hacktivist group NoName057(16). The international effort, involving law enforcement from 12 nations, led to two arrests and the takedown of over 100 servers linked to the group’s “DDoSia” project. Britain wants bug-hunters on its side. The NCSC has launched the Vulnerability Research Initiative, a new program inviting external researchers to help uncover security flaws in widely used hardware and software.
Europol's Operation Eastwood has successfully disrupted the pro-Russian hacktivist group NoName057(16), known for its DDoS attacks across Europe, Israel, and Ukraine. This operation involved law enforcement from 12 countries and resulted in the disruption of over 100 servers and the arrest of two individuals. NoName057(16) utilizes Telegram and the "DDoSia" project to coordinate attacks on critical infrastructure, targeting NATO sites, government agencies, and banks, particularly in countries supporting Ukraine. The group has executed numerous attacks, especially during significant events like European elections and NATO summits.
An international law enforcement operation, Operation Elicius, dismantled the Romanian Diskstation ransomware gang that had been targeting Synology NAS devices since 2021. This operation, coordinated by Europol and involving police forces from France and Romania, focused on the gang's attacks on internet-exposed NAS devices, which resulted in severe disruptions for various companies, including graphic and film production firms and NGOs. The ransomware encrypted vital data, demanding ransoms that ranged from $10,000 to hundreds of thousands of dollars. Investigations led by the Milan Prosecutor's Office utilized forensic and blockchain analysis, ultimately leading to raids in Bucharest in June 2024 and the arrest of a key suspect believed to be the primary operator behind the attacks.
NCSC-U.K launched the Vulnerability Research Initiative (VRI) to collaborate with external cybersecurity experts for better identification and understanding of software and hardware vulnerabilities. The VRI aims to strengthen the UK's cybersecurity capabilities by partnering with skilled researchers to identify flaws, assess mitigations, and disclose vulnerabilities through a structured process. Researchers involved in the program will share tools and methodologies used during their activities to help establish best practices and frameworks.
The Bad
Cisco Talos uncovered a MaaS campaign targeting Ukraine, where attackers used Amadey malware and GitHub repositories to stage payloads. The setup mimics tactics from a SmokeLoader phishing operation. Over 600 malicious domains are distributing fake Telegram APKs to unsuspecting users. Most are hosted in China and exploit the Janus vulnerability in Android. Users who trusted GravityForms’ official site got more than they expected. A supply chain attack injected backdoors into plugin files distributed via the official site and Composer.
Cisco Talos identified a MaaS operation using Amadey malware and fake GitHub accounts to host payloads and plugins, targeting Ukrainian entities. The operation overlaps with tactics from a SmokeLoader phishing campaign observed earlier in 2025. Phishing emails targeting Ukrainian entities used compressed archives containing obfuscated JavaScript files to download SmokeLoader. Emmenhtal loaders were used to deliver Amadey malware and other payloads, bypassing email delivery in some cases by hosting files on GitHub. GitHub repositories served as open directories for staging malware, leveraging public access to evade web filtering.
Between March and June, several China-aligned threat actors intensified phishing campaigns targeting Taiwan's semiconductor industry, primarily for espionage purposes. These actors, identified as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp, employed spearphishing and credential phishing to infiltrate organizations involved in semiconductor manufacturing, design, and investment analysis. UNK_FistBump posed as job seekers to lure HR personnel, delivering malware like Cobalt Strike and the custom Voldemort backdoor through compromised emails. Meanwhile, UNK_DropPitch focused on financial analysts, using deceptive emails to distribute a simple backdoor known as HealthKick.
Over 607 malicious domains were identified distributing fake Telegram APK files, linked to phishing and malware campaigns, primarily hosted in Chinese and registered via the Gname registrar. These domains use QR codes to redirect users to a phishing site (zifeiji[.]asia) that mimics Telegram’s appearance to distribute malicious APKs. The fake APKs exploit the Janus vulnerability in Android 5.0–8.0, allowing attackers to craft undetectable malicious applications. The APKs bypass secure protocols, request broad permissions, and execute remote commands, enabling data theft, surveillance, and device control. Typosquatted domains (e.g., “teleqram”, “telegramapp”) and malicious JavaScript files are used for tracking and promoting the fake apps, collecting user data for cybercriminal purposes.
Hackers are using Microsoft Teams to distribute Matanbuchus 3.0 malware, a sophisticated MaaS loader. Delivery methods for the malware include phishing emails, compromised websites, and malvertising, often involving social engineering tactics like impersonating IT help desks via Microsoft Teams. The loader uses a renamed Notepad++ updater (GUP) and malicious DLL for sideloading attacks. Matanbuchus impersonates Skype Desktop traffic for sending encrypted data to its C2 server. The loader supports multiple next-stage capabilities, including MSI installation, process hollowing, CMD/PowerShell execution, and WQL queries.
An ongoing campaign by the financially motivated threat actor UNC6148 targets SonicWall Secure Mobile Access (SMA) 100 series appliances. It exploits stolen credentials and deploying a persistent backdoor known as OVERSTEP. This malware modifies the boot process to ensure continuous access and conceal its presence while stealing sensitive data. Evidence suggests that UNC6148 may have exploited known vulnerabilities or a zero-day vulnerability to gain initial access. The campaign has been linked to data exfiltration and potential ransomware deployment, with overlaps observed in previous incidents involving Abyss-branded ransomware. OVERSTEP employs LD_PRELOAD hijacking to inject malicious code into system processes, allowing it to operate undetected and execute commands through web requests, further complicating detection efforts.
A supply chain attack targeted the GravityForms plugin for WordPress, injecting backdoor malware into files downloaded from its official website. The malware harvested WordPress environment data and sent it to a malicious domain, gravityapi[.]org, registered days earlier. The malware included a disguised backdoor capable of executing arbitrary code, managing content, and manipulating media through the WP_Content_Manager class.A second backdoor was embedded in class-settings.php, enabling unauthenticated remote commands like creating admin accounts, uploading files, and executing code via a hardcoded token. Only users who manually downloaded or installed via Composer appear to be affected, indicating the breach was targeted and short-lived.
New Threats
The H2Miner botnet has resurfaced with updated scripts that mine Monero, kill rival malware, and deploy multiple malware. Bundled with it is Lcrypt0rx, a likely AI-generated ransomware that exhibits sloppy logic, malformed syntax, and weak encryption using XOR. A new Konfety variant uses the same package name as a legitimate app but hides the real payload in a lookalike version distributed through third-party stores. One sandbox escape makes five. Google patched a high-severity Chrome flaw that lets attackers break out of the browser’s sandbox using crafted HTML and unvalidated GPU commands.
H2Miner botnet has been active since 2019 and resurfaces with updated configurations to mine Monero cryptocurrency. Lcrypt0rx ransomware appears AI-generated, exhibiting flawed encryption logic, malformed syntax, and ineffective defense evasion techniques. H2Miner scripts deploy malware such as Kinsing and terminate security software, database processes, and competing miners. Lcrypt0rx ransomware disrupts system usability, encrypts files using XOR logic, and deploys scare tactics rather than effective ransomware measures. Tools used include commercial hacking utilities like Cobalt Strike, Lumma Stealer, and DCRat, targeting multiple operating systems. Lcrypt0rx introduces destructive actions like overwriting the Master Boot Record and deploying redundant embedded scripts.
A new variant of the Android malware Konfety uses an "evil twin" technique, where a benign app on the Google Play Store shares the same package name as a malicious version distributed via third-party sources. The malware employs sophisticated obfuscation tactics, including tampering with APK ZIP structures, dynamic code loading, and encryption flags to evade detection and complicate reverse engineering. It uses deceptive manifest declarations, such as falsely claiming BZIP compression, causing analysis tools to crash. This approach was previously observed in other malware like SoumniBot. Konfety leverages the CaramelAds SDK to fetch ads, deliver payloads, and maintain communication with attacker-controlled servers. It can redirect users to malicious websites, trigger app installs, and send spam notifications.
VMware fixed four zero-day vulnerabilities in ESXi, Workstation, Fusion, and Tools that were exploited during the Pwn2Own Berlin 2025 hacking contest. Three vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238) have a severity rating of 9.3 and enable programs in guest virtual machines to execute commands on the host. The fourth flaw, CVE-2025-41239, rated at 7.1, is an information disclosure vulnerability impacting VMware Tools for Windows.
The LameHug malware uses a LLM to dynamically generate commands for data theft on compromised Windows systems, marking a novel approach in cyberattacks. LameHug was discovered by CERT-UA and attributed to Russian state-backed APT28, with malicious emails impersonating Ukrainian ministry officials to distribute the malware. The malware leverages the Hugging Face API to interact with the Qwen 2.5-Coder-32B-Instruct LLM, which converts natural language into executable code or commands. LameHug is delivered via ZIP email attachments containing loaders with names such as ‘Attachment.pif,’ ‘AI_generator_uncensored_Canvas_PRO_v0.9.exe,’ and ‘image.py.’
Threat actors are leveraging a novel technique to hide malware within DNS records, exploiting a blind spot in many security systems. This method enables early-stage malware to retrieve its payload without relying on traditional delivery vectors, such as suspicious downloads or email attachments, which are more likely to be intercepted by antivirus tools. Researchers recently identified this technique being used to distribute a nuisance malware strain known as Joke Screenmate. The malware interferes with normal computer operations and is delivered through DNS records, making it difficult to detect using conventional security tools. The malware is embedded in DNS records by converting its binary payload into hexadecimal format. This encoded data is then stored in DNS entries, allowing the malware to be fetched during DNS resolution processes.
Google released a Chrome security update to fix six vulnerabilities, including CVE-2025-6558, a high-severity sandbox escape flaw actively exploited by attackers. CVE-2025-6558 affects Chrome versions before 138.0.7204.157 and involves insufficient validation of untrusted input in ANGLE and GPU, allowing remote code execution through specially crafted HTML pages. ANGLE, a graphics abstraction layer in Chrome, is vulnerable due to processing GPU commands from untrusted sources, posing critical security risks. The update also fixes five other vulnerabilities, including CVE-2025-7656 (V8 engine flaw) and CVE-2025-7657 (WebRTC issue), though none are actively exploited. CVE-2025-6558 marks the fifth actively exploited Chrome flaw fixed in 2025, following other zero-day vulnerabilities patched earlier this year.
A new cyber espionage campaign, identified as HazyBeacon, targets governmental organizations in Southeast Asia, aiming to collect sensitive information related to tariffs and trade disputes. This previously undocumented Windows backdoor utilizes DLL side-loading techniques, deploying a malicious DLL alongside a legitimate executable to establish communication with attacker-controlled URLs. Notably, HazyBeacon exploits AWS Lambda URLs for command-and-control purposes, allowing threat actors to blend in with legitimate cloud activities. The malware includes a file collector module that targets specific file types, particularly those related to recent U.S. tariff measures.
McAfee Labs has identified an active Android malware campaign targeting Bengali-speaking users, particularly Bangladeshi expatriates. The malware impersonates trusted financial apps like TapTap Send and AlimaPay, distributed via phishing websites and fake Facebook pages. It collects sensitive personal and financial data, including photo IDs, and stores it on unsecured servers, posing significant privacy risks. The campaign targets Bangladeshi expatriates in countries like Saudi Arabia, the UAE, and Malaysia, leveraging their reliance on remittance apps.
A new PHP-based variant of the Interlock RAT has been discovered, linked to the KongTuke web-inject cluster. The malware uses compromised websites with hidden scripts, prompting users to execute PowerShell commands that lead to infection. Automated system reconnaissance gathers detailed information about the compromised system, including processes, services, and network data. The malware establishes a robust C2 channel via Cloudflare Tunnel services, with fallback IPs for resilience.