Cyware Weekly Threat Intelligence - July 22–26

Cyware Weekly Threat Intelligence - September 02–06 - Featured Image

Weekly Threat Briefing July 26, 2024

The Good

In a decisive strike against cybercrime, Meta has eradicated 63,000 Instagram accounts connected to the Nigerian cybercrime group known as Yahoo Boys. Furthermore, it has purged 1,300 Facebook accounts, 200 Pages, and 5,700 Groups that were disseminating scamming tips and materials. Along the same lines, international agencies collaborated to disrupt DigitalStress, a massive DDoS-for-hire service. The takedown was a part of Operation Power Off.

  • Meta eliminated 63,000 Instagram accounts linked to a Nigerian cybercrime group known as Yahoo Boys. These accounts were involved in sextortion scams, including a network of 2,500 accounts targeting adult men in the U.S. Meta also deleted 1,300 Facebook accounts, 200 Pages, and 5,700 Groups that provided scamming tips and materials. The company has implemented measures to block scammers from creating new accounts.
  • The French police and Europol are pushing out a disinfection solution to remove the PlugX malware from infected devices in France, Malta, Portugal, Croatia, Slovakia, and Austria. The operation is conducted by the Center for the Fight Against Digital Crime (C3N) of the National Gendarmerie with assistance from Sekoia. The ANSSI will individually notify victims in France about the cleanup process and how it affects them.
  • The NCA, in collaboration with the FBI and PSNI, disrupted the DDoS-for-hire service DigitalStress. The authorities seized the service's domain and arrested one of its suspected administrators. The NCA has warned users that their data has been collected and will be analyzed to identify them. This action was part of Operation Power Off, an international effort to disrupt DDoS-for-hire services.

The Bad

In the ever-evolving battleground of cybersecurity, the LummaC2 info-stealer has emerged as a formidable threat, disseminated via SEO poisoning, search engine ads, and platforms like Steam, under the guise of illegal software and legitimate installers. In another front of cyber warfare, the Belarusian state-sponsored hacker group GhostWriter has unleashed PicassoLoader malware against Ukrainian organizations and local government agencies. Meanwhile, the FBI, CISA, NSA, and other agencies have issued a joint advisory warning of imminent cyberattacks on critical U.S. infrastructure by the North Korean Andariel group. This group is primarily focused on defense, aerospace, nuclear, and engineering sectors in the U.S., Japan, South Korea, and India.

  • The LummaC2 info-stealer is actively distributed via SEO poisoning, search engine ads, and various platforms like Steam, posing as illegal programs and legitimate software installers. It has evolved in its execution methods, including using a DLL side-loading technique and abusing legitimate platforms like Steam to acquire C2 domains. The malware targets a wide range of programs for stealing information, including wallets, browsers, FTP clients, VPN programs, and more.
  • A Belarusian state-sponsored hacker group known as GhostWriter targeted Ukrainian organizations and local government agencies with PicassoLoader malware. The group used phishing emails related to USAID's Hoverla project to infect victims and is suspected of being involved in cyber espionage, particularly focusing on Ukraine's financial, economic, and governance indicators. GhostWriter has a history of targeting Ukrainian entities, as well as allies of Kyiv such as Lithuania, Latvia, and Poland.
  • The FBI, the CISA, the NSA, and others published a joint advisory, warning of cyberattacks on critical U.S. infrastructure by the North Korean Andariel group. The group, known as Andariel, Silent Chollima, Onyx Sleet, and Stonefly, is primarily targeting defense, aerospace, nuclear, and engineering organizations in the US, Japan, South Korea, and India. It is using ransomware attacks on U.S. healthcare entities to fund the campaign.The information that Andariel is pursuing includes data on heavy and light tanks, fighter aircraft, missiles, and missile defense systems, and more.
  • The threat actor known as Stargazer Goblin developed a malware Distribution-as-a-Service (DaaS) on GitHub, using over 3,000 fake accounts to push information-stealing malware. This service, called Stargazers Ghost Network, distributes password-protected archives containing malware through GitHub repositories and compromised WordPress sites. The operation targets specific interests like cryptocurrency and gaming, using phishing templates to lure victims. The malware set includes RedLine, Lumma Stealer, Rhadamanthys, RisePro, and Atlantida Stealer.
  • In a recent development, threat actors are targeting the 250 million players of the popular mobile game Hamster Kombat with malware. The game, which is not available on any official channels but Telegram, has become a breeding ground for cybercriminals due to its massive popularity. ESET has found a malicious APK distributed on Telegram that is named 'Hamster.apk', which is actually Ratel Android spyware. The spyware can steal sensitive data from the device, such as contacts, messages, call logs, and location data. The researchers also found fake Hamster Kombat apps on Windows that are distributed through various channels.
  • Threat actors are exploiting the hype around the upcoming Grand Theft Auto VI release by creating malicious Facebook ads promising a GTA VI beta version for download. These ads are designed to lure unsuspecting gamers into downloading malware instead of a legitimate game. The malicious ads lead users to download a fake GTA VI installer, which is actually a form of FakeBat loader malware. FakeBat can, in turn, deploy next-stage malware like info-stealers and RATs.

New Threats

Threat actors have been exploiting unpatched vulnerabilities in ServiceNow, including a critical RCE flaw, to pilfer credentials from government agencies and private firms. These vulnerabilities, patched by ServiceNow on July 10, have been actively exploited for at least a week. Wiz flagged an ongoing campaign dubbed SeleniumGreed, which exploits publicly exposed Selenium Grid services for illicit cryptocurrency mining. Adding to the cyber woes, a new malware loader named Krampus has emerged on the dark web, gaining traction for its versatile capabilities and ease of use. Krampus can handle archive and PowerShell scripts, sideload crypto miners, and more.

  • Threat actors are exploiting unpatched ServiceNow flaws, including a critical RCE vulnerability, to steal credentials from government agencies and private firms. The exploitation of these flaws, which ServiceNow patched on July 10, 2024, has been observed for at least a week, according to Resecurity. The flaws, CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, can be chained together for full database access, and attackers are using readily available exploits and network scanners to target the nearly 300,000 internet-exposed instances of ServiceNow.
  • Wiz warned about an ongoing campaign that exploits internet-exposed Selenium Grid services for illicit cryptocurrency mining. The campaign, called SeleniumGreed, has been active since at least April 2023 and targets older versions of Selenium (3.141.59 and prior). The attack involves the threat actor targeting publicly exposed instances of Selenium Grid and making use of the WebDriver API to run Python code responsible for downloading and running an XMRig miner. Researchers identified more than 30,000 instances exposed to remote command execution, making it imperative that users take steps to close the misconfiguration.
  • A threat actor announced the launch of a new malware loader, named Krampus, on the dark web. Krampus is gaining popularity owing to its versatile capabilities and ease of use. Its ability to handle archive and PowerShell scripts, sideload crypto miners, embed itself within archives, and install legitimate software makes it difficult to detect and mitigate using traditional security measures. One concerning aspect is that the file is unsigned and lacks encryption, making it harder to detect. Cybersecurity experts advise organizations to update their security protocols in order to combat such sophisticated threats.
  • Researchers disclosed a privilege escalation vulnerability, named ConfusedFunction, in Google Cloud Platform's Cloud Functions service. This vulnerability allows an attacker to access other services and sensitive data by exploiting the Default Cloud Build Service Account's excessive permissions. Google has updated the default behavior to prevent misuse, but existing instances remain unaffected. This issue highlights the potential risks of software complexity and inter-service communication in cloud providers' services.
  • A previously unseen malware called FrostyGoop was used in a cyberattack against a district energy company in Ukraine last winter. The attack targeted temperature controllers, disrupting the central heating system and leaving over 600 apartment buildings without heat for two days during sub-zero temperatures. FrostyGoop is able to disrupt industrial processes by altering values on ICS devices. The malware exploited the Modbus protocol to directly tamper with industrial control systems, posing a significant threat to OT environments globally.
  • The espionage outfit Daggerfly updated its malware arsenal, releasing new versions in reaction to previously unknown varieties becoming public. A new iteration of the Macma macOS backdoor and a new malware family built on the MgBot modular malware framework have also been unveiled by the group. Recent iterations of Macma demonstrate continuous development; one has a new core module, while another has small enhancements to the functionality that already exists. More significant changes were also seen in the main module, which now included new logic to gather a file's system listing.
  • ESET researchers discovered a zero-day exploit targeting Telegram for Android, called EvilVideo. This exploit allowed attackers to send malicious Android payloads disguised as video files in unpatched versions of Telegram. The exploit relied on tricking users into installing a malicious app disguised as a multimedia file. Telegram fixed the issue in version 10.14.5, and the exploit no longer works in patched versions. The threat actor also advertised an Android cryptor-as-a-service on the same underground forum. The exploit did not work on Telegram Web or Desktop clients.

Related Threat Briefings

Jul 4, 2025

Cyware Weekly Threat Intelligence, June 30–July 04, 2025

It looked like a crypto investment until €460 million vanished. Operation BORRELLI dismantled a global fraud ring that scammed over 5,000 victims, with arrests in Madrid and the Canary Islands. A fake workforce was quietly funding a real regime. The DoJ disrupted a North Korean scheme where remote IT workers used stolen identities to get jobs at over 100 U.S. companies. The operation funneled $5 million to the DPRK, exposed military tech, and led to raids across 16 states. Sometimes, the app that looks harmless is just the decoy. Recent investigations uncovered massive Android fraud schemes, including IconAds and Kaleidoscope, which used icon hiding, fake apps, and third-party distribution to flood ad networks with billions of fake requests. Two different names - same tactics, same tools, same playbook. Researchers have found striking overlaps between TA829 and the lesser-known UNK_GreenSec, both of which use phishing lures and REM Proxy services through compromised MikroTik routers. It starts with what looks like an official message from the Colombian government. Behind it is a phishing campaign delivering DCRAT, a modular remote access tool designed for theft and system control. Botnet operators are now turning broken routers into system wreckers. RondoDox is a new Linux-based botnet exploiting CVE-2024-3721 and CVE-2024-12856 to gain remote access to TBK DVRs and Four-Faith routers. That Zoom update request on Telegram? It could be a trap. North Korean actors are deploying NimDoor malware to infiltrate Web3 and crypto platforms using social engineering via Telegram. Google has patched CVE-2025-6554, a critical zero-day in Chrome’s V8 engine that was exploited in the wild to execute arbitrary code.

Jun 27, 2025

Cyware Weekly Threat Intelligence, June 23–27, 2025

A Common Good Cyber Fund was launched to support non-profits delivering critical cybersecurity services for public benefit. The fund is backed by the U.K and Canada, with G7 leaders endorsing similar initiatives. A phishing email is all it takes to breach critical infrastructure. The OneClik APT campaign is targeting energy and oil sectors using Microsoft ClickOnce to deliver a .NET loader and Golang backdoor. A handful of outdated routers is all it takes to build a persistent espionage network. The LapDogs campaign is targeting SOHO devices with a custom backdoor called ShortLeash, giving attackers root access and control over compromised systems. A familiar package name could be hiding far more than useful code. North Korean actors behind the Contagious Interview campaign have published 35 malicious npm packages, including keyloggers and multi-stage malware. A fake Windows update might just be the start of something worse. The EvilConwi campaign is abusing ConnectWise ScreenConnect to deliver signed malware through tampered installers. Encrypted messaging apps aren’t immune to state-backed malware delivery. APT28 is targeting Ukrainian government entities via Signal, sharing macro-laced documents that deploy a backdoor named Covenant. Some WordPress plugins are doing a lot more than extending site functionality. Researchers uncovered a long-running malware campaign that uses rogue plugins to skim credit card data, steal credentials, and manage backend systems on infected sites.

Jun 20, 2025

Cyware Weekly Threat Intelligence, June 16–20, 2025

As cybercriminals weave intricate webs in the digital underworld, global defenders are cutting through the chaos. Six nations toppled Archetyp Market, a darknet drug bazaar with €250 million ($288 million) in Monero deals, nabbing its admin and vendors while seizing €7.8 million ($9 million) in assets. The U.K unveiled a Cyber Growth Action Plan, injecting £16m ($21.2m) to fortify its £13.2bn ($17.5bn) cybersecurity industry after attacks bled retailers like M&S. Stateside, the U.S. reclaimed $225 million in crypto from investment scams, marking the Secret Service’s biggest digital heist bust yet. Cloud services are being quietly turned into covert attack channels. The Serpentine#Cloud campaign is abusing Cloudflare Tunnels and Python to deploy fileless malware via invoice-themed phishing lures. A popular WordPress plugin is exposing sites to full takeover. It affects the AI Engine plugin, impacting over 100,000 websites and opening the door to site-wide compromise. An official-looking email from the tax department may be anything but. Silver Fox APT is targeting Taiwanese users with phishing emails posing as the National Taxation Bureau, delivering malware like Winos 4.0, HoldingHands RAT, and Gh0stCringe. A new Android trojan is turning devices into data-harvesting tools under attackers’ full control. Attributed to the LARVA-398 group, AntiDot has infected thousands of devices through phishing and malicious ads. A fake job offer could now come bundled with custom-built spyware. PylangGhost is targeting crypto professionals in India. Delivered through spoofed job sites, the malware includes registry tampering, remote control, and data exfiltration modules aimed at compromising Windows systems. One compromised travel site is now a launchpad for infostealer infections. A new ClickFix variant, LightPerlGirl, is using fake Cloudflare CAPTCHA prompts and clipboard hijacking to deliver the Lumma infostealer.

Jun 6, 2025

Cyware Weekly Threat Intelligence, June 02–06, 2025

Authorities have taken down a major hub for stolen financial data. The DOJ seized approximately 145 domains associated with the BidenCash marketplace, which had evolved from a small credit card shop in 2022 into a massive hub for stolen payment data. In a move to reinforce Europe’s cyber defenses, Microsoft is stepping in with strategic support. The newly launched European Security Program offers EU governments free access to AI-driven threat intelligence, vulnerability alerts, and guidance to counter attacks from state-sponsored actors. Not all GitHub projects are built with good intentions. Researchers uncovered a widespread campaign involving more than 130 repositories booby-trapped with malware disguised as game cheats, hacking tools, and utilities. A free software download could end up costing your entire crypto wallet. ViperSoftX is back in circulation, targeting crypto users with malicious PowerShell scripts bundled into cracked apps, keygens, and torrent packages. Some attackers mine crypto, JINX-0132 mines misconfigurations. This threat actor is running a stealthy cryptojacking campaign against DevOps platforms, exploiting exposed defaults and overlooked RCE flaws. Destruction masquerading as maintenance tools is hitting Ukraine’s infrastructure. Researchers attributed a new wiper malware called PathWiper to a Russia-linked APT group, targeting critical systems by leveraging legitimate administrative frameworks. A few swapped letters could be all it takes to get owned. A new supply chain attack targets Python and npm developers through typo-squatting and name confusion. A new Android banking trojan, named Crocodilus, has emerged in the threat landscape. It masquerades as legitimate apps like Google Chrome and uses overlay attacks to steal credentials from financial apps.

May 30, 2025

Cyware Weekly Threat Intelligence, May 26–30, 2025

Under the hood of vulnerability management, NIST just added a sharper diagnostic tool. The new Likely Exploited Vulnerabilities metric offers deeper insight into which CVEs are likely being used in the wild, complementing EPSS with more contextual signals. Digital warfare is no longer a future threat, it's a current investment. The U.K. Ministry of Defence has unveiled a £1 billion Cyber and Electromagnetic Command to protect military networks and support offensive cyber missions. With AI-driven systems like the Digital Targeting Web in development, the goal is seamless coordination across weapons platforms. A quiet but relentless campaign has been unfolding across multiple industries. The Chinese group Earth Lamia is targeting finance, government, logistics, and more by exploiting known web app vulnerabilities. APT41 hides malware commands where no one’s looking: your calendar. In a creative twist on C2 infrastructure, China-backed APT41 embedded encrypted instructions inside Google Calendar events. AyySSHush doesn’t make noise, it builds armies. More than 9,000 ASUS routers have been compromised by this botnet, which quietly slips in through a CVE-2023-39780 exploit. Fake CAPTCHA prompts are now doing more than testing if you're human—they're installing malware. EDDIESTEALER, a new Rust-based infostealer, spreads through deceptive CAPTCHA pages that trigger malicious PowerShell scripts. Threat actors are wrapping their tools in layers of obfuscation, and DOUBLELOADER is no exception. This new backdoor uses the ALCATRAZ obfuscator—once seen in the game-hacking scene—to disguise its presence. A new Go-based botnet called PumaBot is clawing its way through Linux IoT devices. It brute-forces SSH credentials, impersonates Redis files for stealth, and deploys rootkits to mine crypto and steal credentials.

May 23, 2025

Cyware Weekly Threat Intelligence, May 19–23, 2025

Operation Endgame just dealt a major blow to the ransomware supply chain. Europol led the charge in dismantling malware infrastructure tied to multiple malware families, seizing 300 servers and more. Japan has officially gone on the cyber offense. The new Active Cyberdefense Law allows preemptive strikes against foreign cyber threats. It enables traffic analysis and takedowns of hostile servers. Think twice before clicking on that Ledger update. A new macOS malware campaign is deploying fake versions of the Ledger Live app to steal cryptocurrency seed phrases. A Turkish phishing lure leads straight to SnakeKeylogger. Fake AI tools are the new phishing lures and they’re convincing. Cybercriminals cloned Kling AI’s brand through Facebook ads and spoofed websites to trick users into downloading malware. The DBatLoader (aka ModiLoader) malware is making the rounds again - this time disguised as a Turkish bank email. The copyright threat in your inbox might be bait. A phishing campaign sweeping across central and eastern Europe is using fake legal complaints to deliver the Rhadamanthys Stealer. Two years of silence, 6,200 downloads later - the malware is finally found. A malicious campaign targeting JavaScript developers slipped past detection by disguising harmful npm packages as plugins for frameworks like React, Vue.js, Vite, and Quill Editor. Researchers uncovered a stealthy new backdoor paired with a Monero coinminer, using the PyBitmessage library for encrypted peer-to-peer communications.

May 9, 2025

Cyware Weekly Threat Intelligence, May 05–09, 2025

Another blow to DDoS-for-hire networks. Europol has shut down six services used to launch global cyberattacks, arresting suspects in Poland and seizing domains in the U.S. The UN has launched a new framework to help policymakers make sense of cyber intrusions. Called UNIDIR Intrusion Path, it complements models like MITRE ATT&CK but simplifies the technical details. It breaks down attacker activity into three layers, making it easier to evaluate threats in a policy context. Old routers are becoming cybercrime goldmines. The FBI has warned that end-of-life routers are being hijacked with malware like TheMoon and sold on proxy networks such as 5Socks and Anyproxy. These compromised devices are used for crypto theft, cybercrime-as-a-service, and even espionage. Crypto users on Discord are the latest targets of a phishing campaign tied to Inferno Drainer. Attackers were found impersonating the Collab.Land bot to trick users into signing malicious transactions. The Play ransomware group has joined the list of actors exploiting CVE-2025-29824. This Windows zero-day in the CLFS driver enables privilege escalation via a race condition during file operations. Linked to the Balloonfly group, the attacks targeted a U.S. organization and included deployment of the Grixba infostealer. COLDRIVER’s latest malware, LOSTKEYS, is now in play. The Russian state-backed group is deploying this tool to steal files and system data from advisors, journalists, NGOs, and individuals linked to Ukraine. Agenda’s playbook just got upgraded. The ransomware group has added two new tools: SmokeLoader and a stealthy .NET-based loader called NETXLOADER. The latter leverages techniques like JIT hooking and AES decryption to deploy ransomware. Corporate HR teams are the latest target in a spear-phishing spree by Venom Spider. Disguised as job applications, these emails deliver More_eggs backdoor, now upgraded with advanced features.

May 2, 2025

Cyware Weekly Threat Intelligence, April 28–May 02, 2025

The FBI just dropped a massive breadcrumb trail. Details of 42,000 phishing domains tied to the LabHost platform have been released to help defenders investigate potential breaches. The service enabled the theft of 500,000 credit cards and over a million credentials. The takedown of JokerOTP has exposed just how far phishing has evolved. The tool was used in more than 28,000 attacks across 13 countries, tricking victims into handing over 2FA codes by mimicking trusted brands. The operation cost victims £7.5 million and has now led to serious criminal charges, thanks to a joint effort involving Europol and Dutch authorities. Malware’s now hitching a ride on Go modules. Socket has uncovered three malicious packages hiding disk-wiping payloads, designed to cause irreversible data loss, especially on Linux systems. These modules take advantage of Go’s decentralized ecosystem. In the shadows of the cybersecurity landscape, MintsLoader emerges as a formidable adversary, orchestrating a multi-faceted infection strategy that deploys the notorious GhostWeaver RAT. Some PyPI packages are doing more than importing functions. Researchers uncovered seven malicious Python packages under the “Coffin” naming scheme, using Gmail’s SMTP service as a stealthy C2 channel. Ransomware groups aren’t always the ones breaking the door open. Researchers have uncovered ToyMaker, an initial access broker selling network entry to ransomware groups. Using a custom malware strain called LAGTOY, ToyMaker establishes reverse shells and executes commands on compromised systems. New vulnerabilities in Apple’s AirPlay protocol, collectively dubbed AirBorne, expose billions of devices to remote code execution without user interaction. Sharp and TX stealers are back, donning a new cloak - named Hannibal Stealer. It is going after credentials from browsers, crypto wallets, FTP clients, and VPN apps. It even captures Discord tokens and Steam sessions.

Apr 25, 2025

Cyware Weekly Threat Intelligence, April 21–25, 2025

AI security finally has a global playbook. ETSI has released TS 104 223, a first-of-its-kind technical specification outlining how to secure AI systems across their entire lifecycle - from design to decommissioning. MITRE’s latest update is catching up with the cloud. ATT&CK v17 expands the framework to include ESXi and adds more than 140 defensive analytics. Platform-specific data collection advice, improved mitigation mapping, and deeper coverage of mobile threats like SIM swaps round out the upgrade. An APT group with deep roots in Southeast Asia is quietly siphoning data through everyday cloud platforms. Earth Kurma has been active since late 2020, targeting government and telecom entities across the Philippines, Vietnam, Thailand, and Malaysia. Signal and WhatsApp are the new frontline for cloud compromise. Russian actors are running OAuth phishing campaigns against Microsoft 365 users tied to Ukraine and human rights work. A forged email that passes every security check - that’s the new phishing trick. Attackers are using DKIM replay tactics to forward legitimate Google security alerts to unsuspecting victims. It starts with a fake sales order and ends with FormBook silently stealing your data. A recent phishing campaign has been abusing a long-patched Microsoft flaw to deliver a fileless variant of the malware. Docker containers aren’t always what they seem. A new threat named TenoBot is targeting systems running outdated Teneo Web3 node software, deploying malicious containers to hijack environments. A stealthy new RAT is slipping through Ivanti Connect Secure devices in Japan. Dubbed DslogdRAT, the malware exploits a zero-day flaw to execute commands via web shell and quietly exfiltrate data using encoded C2 traffic.