Cyware Weekly Threat Intelligence, July 28–August 01, 2025

shutterstock 2146949205

Weekly Threat Briefing August 1, 2025

The Good

Picture this: a tool so fast it dissects malware at lightning speed, giving your team the edge in a digital arms race. Meet Thorium, the CISA’s latest open-source gem. This platform automates cyberattack investigations, processing over 1,700 jobs per second and ingesting 10 million files per hour per permission group. Meanwhile, as AI reshapes the battlefield, OWASP is arming professionals with fresh guidance to secure agentic AI applications driven by LLMs. It’s a playbook for locking down user authentication with OAuth 2.0, encrypting sensitive data, and bolstering supply chain security.

  1. The CISA has released Thorium, an open-source platform designed for malware and forensic analysis, developed with Sandia National Laboratories. Thorium automates cyberattack investigation tasks, handling over 1,700 jobs per second and ingesting 10 million files per hour per permission group. It supports software analysis, digital forensics, and incident response, enhancing cybersecurity teams' efficiency in assessing malware threats. Key features include tool import/export, Docker integration, tag-based filtering, strict access control, and scalability with Kubernetes and ScyllaDB.
  2. The CISA released the Eviction Strategies Tool to help organizations respond to cyber incidents and remove adversaries from compromised systems. Developed with MITRE, the tool enables rapid creation of tailored playbooks using structured frameworks like MITRE ATT&CK or free-text descriptions of threat behavior. The tool integrates two resources: COUN7ER, a database of over 100 post-compromise countermeasures, and Cyber Eviction Strategies Playbook NextGen, a web-based interface for aligning findings with countermeasures. Key features include exporting plans in various formats, integrating knowledge from frameworks like MITRE D3FEND, and open-source access under the MIT License.
  3. OWASP has released comprehensive guidance for securing agentic AI applications powered by LLMs, aimed at developers, engineers, and security professionals. The guidance emphasizes securing agentic architectures with strong user authentication controls and safeguards against manipulation during design and development. Additional measures include enhanced security actions like OAuth 2.0, managed identity services, and encryption of sensitive data to mitigate risks. Operational risks from connecting agentic AI to APIs, databases, and other systems are addressed, along with supply chain security to reduce vulnerabilities from third-party code.
  4. The FBI has seized approximately 20.29 Bitcoins, valued at over $2.4 million, from a member of the Chaos ransomware group known as "Hors." This seizure involved tracing the cryptocurrency to a specific address linked to cyberattacks against Texas companies. Following the seizure, the U.S. DOJ filed a civil complaint on July 24, seeking to permanently forfeit the funds, a process that allows the government to claim assets connected to criminal activities without needing a criminal conviction. The Chaos ransomware operation is believed to be a rebrand of the BlackSuit group, which itself emerged from the notorious Conti ransomware gang.
The Bad

Cybercriminals are donning digital disguises, impersonating trusted enterprises with fake Microsoft OAuth applications to steal credentials and bypass multi-factor authentication. Hackers exploited a critical SAP NetWeaver flaw to deploy the Auto-Color Linux malware. This malware, equipped with a rootkit and adaptive evasion tactics, adjusts its behavior based on user privileges. Operation CargoTalon, tied to threat cluster UNG0901, targeted organizations with EAGLET malware hidden in fake invoice files, quietly siphoning off sensitive data to a C2 server.

  • North Korean hacking group UNC4899 targeted organizations by using job lures and social engineering techniques via LinkedIn and Telegram, convincing employees to execute malicious Docker containers. The group exploited cloud environments like Google Cloud and AWS by employing stolen credentials and session cookies to manipulate cryptocurrency transactions. Although MFA initially hindered their efforts, they managed to disable it to gain administrative access. Their sophisticated attacks involved uploading malicious JavaScript files to exploit cloud services, ultimately leading to the theft of millions in cryptocurrency. The group’s activities have also included embedding malware into open-source package registries, indicating a strategic pivot in their approach to cybercrime. 
  • Threat actors are impersonating enterprises with fake Microsoft OAuth applications to steal credentials and bypass MFA. Proofpoint identified malicious campaigns using redirects to phishing URLs via OAuth applications impersonating services like RingCentral, DocuSign, and Adobe. Observed email campaigns often use compromised accounts and lure themes such as RFQs or business agreements to target victims. Threat actors use CAPTCHA pages and counterfeit Microsoft authentication pages to intercept MFA tokens and session cookies. Proofpoint identified nearly 3,000 attempted account compromises across 900 Microsoft 365 environments in 2025, with a confirmed success rate exceeding 50%.
  • Russian state hackers, known as Secret Blizzard, have launched a cyberespionage campaign targeting foreign embassies in Moscow using sophisticated adversary-in-the-middle (AiTM) attacks. Central to this operation is a malware tool named ApolloShadow, which manipulates system certificates and masquerades as trusted applications to maintain stealthy persistence. The attack initiates at the ISP level, redirecting users through a fake captive portal that prompts them to download ApolloShadow. Once installed, the malware alters network settings, collects sensitive information, and creates a new administrative user with a hardcoded password for ongoing access. 
  • The North Korean Lazarus Group distributed over 200 malicious open source packages through npm and PyPI, potentially compromising around 36,000 victims. This campaign marks a strategic shift for the group, targeting developers who often install packages without proper verification. Many of the detected packages were designed to mimic legitimate libraries and executed multi-stage attacks to maintain stealth and exfiltrate sensitive data. Among the 234 malicious packages, 120 served as droppers for additional malware, while 90 were specifically aimed at stealing secrets. The targets primarily included DevOps-heavy organizations, where compromised developer machines and build pipelines could lead to significant intellectual property theft and reputational damage.
  • Hackers exploited a critical vulnerability in SAP NetWeaver, tracked as CVE-2025-31324, to deploy the Auto-Color Linux malware against a U.S.-based chemicals company. The attack began on April 25, with the malware delivering a Linux executable file that features advanced evasion tactics and stealthy persistence mechanisms, including a rootkit. Auto-Color adjusts its behavior based on user privilege levels and can suppress its malicious activities if it cannot connect to its C2 server, making it appear benign in sandboxed environments. Auto-Color has been linked to exploitation attempts by various threat actors, including ransomware groups and state-sponsored hackers, following the vulnerability's disclosure.
  • Operation CargoTalon is a targeted cyber-espionage campaign attributed to threat cluster UNG0901, aimed at Russia’s aerospace and defense sectors. The campaign specifically targeted the Voronezh Aircraft Production Association (VASO) using spear-phishing emails to deliver the EAGLET malware. The operation employs advanced malware capabilities and social engineering tactics to infiltrate and exfiltrate sensitive data. The infection begins with spear-phishing emails containing a ZIP file that is actually a disguised DLL file. A similarly named LNK shortcut file is also included. When executed, these files trigger the EAGLET implant. The ZIP file, named in Russian as a TTN (goods and transport invoice), serves as a decoy to lure victims into executing the payload. EAGLET is a PE-based implant that generates a unique GUID to identify victims, collects system information, creates a hidden directory, and communicates with a C2 server via HTTP using disguised requests.
  • Scattered Spider hackers are aggressively targeting VMware ESXi hypervisors in various sectors, including retail and transportation, using sophisticated social engineering tactics. They initiate attacks by impersonating employees to convince IT help desks to reset Active Directory passwords, allowing them to gain initial access. This access enables them to identify and exploit high-value targets, such as domain administrators. The attackers then escalate their privileges by impersonating these users to gain control over the VMware vCenter Server Appliance, enabling SSH connections and executing a "disk-swap" attack to extract sensitive Active Directory data. Ultimately, they deploy ransomware to encrypt virtual machine files, achieving complete control over the virtualized environment in just a few hours.
New Threats

A newly discovered cyberattack technique, dubbed Man in the Prompt, is turning browser extensions into unwitting accomplices in data theft from generative AI tools. DoubleTrouble is targeting users through Discord-hosted APKs, disguising itself as a legitimate app to slip past defenses. A stealthy Android banking trojan, RedHook, is targeting Vietnamese users through phishing sites mimicking trusted agencies. Spread via a malicious APK on an exposed AWS S3 bucket, it exploits accessibility services to steal credentials and banking details, with over 500 infections tied to Chinese-speaking actors.

  • A newly identified cyberattack method, dubbed Man in the Prompt, enables malicious browser extensions to manipulate or exfiltrate data from generative AI tools such as ChatGPT and Google Gemini. This attack exploits the Document Object Model (DOM) access granted to browser extensions, allowing them to act as intermediaries in AI interactions without requiring elevated permissions. The attack poses a significant threat to organizations using browser-based AI tools, especially those processing sensitive or proprietary data. The widespread use of browser extensions and the common practice of allowing users to freely install them significantly increases the risk of exploitation. A single compromised extension can silently extract confidential information, turning AI tools into vectors for data theft. The attack allows extensions to act as a “man in the middle” for AI interactions. In the case of Gemini, the exploit worked even when the Gemini sidebar was closed.
  • A sophisticated Android banking Trojan named DoubleTrouble has expanded its delivery methods and technical features, targeting users across Europe through Discord-hosted APKs. The malware disguises itself as a legitimate app, uses Android’s accessibility services, and employs advanced techniques like session-based installation to evade detection. DoubleTrouble’s capabilities include real-time screen recording, phishing overlays, keylogging, and bypassing multi-factor authentication by mirroring the device screen. Captured data, including credentials from banking apps, password managers, and crypto wallets, is sent to a remote C2 server.
  • Russian state-sponsored group APT28 (Fancy Bear) has developed LameHug, the first AI-powered malware using large language models (LLMs) for automated command generation and execution. LameHug targets organizations by exploiting compromised official email accounts to deliver spearphishing emails containing malicious ZIP archives. The malware uses Hugging Face's Qwen 2.5-Coder-32B-Instruct model to translate natural language prompts into executable system commands, enabling flexible automation of reconnaissance and data exfiltration tasks. The malware introduces risks like prompt injection vulnerabilities and API abuse, blending malicious activity with legitimate processes for stealth.
  • JSCEAL is a sophisticated malware campaign targeting cryptocurrency app users through malicious advertisements that promote fake applications. Leveraging Node.js and compiled JavaScript files, JSCEAL steals sensitive data, including credentials and crypto wallets, while employing advanced anti-analysis techniques to evade detection. The campaign impersonates nearly 50 popular cryptocurrency brands and utilizes a multi-layered infection flow, starting with malicious advertisements leading to fake websites. The infection process involves MSI installers that require simultaneous execution with the malicious site, complicating detection efforts. With an estimated global reach exceeding 10 million users, JSCEAL has demonstrated low detection rates on platforms like VirusTotal, making it a significant threat in the cybersecurity landscape.
  • Cyble researchers discovered RedHook, an Android banking trojan targeting Vietnamese users via phishing sites impersonating trusted agencies. The malware is distributed through a trojanized APK hosted on an exposed AWS S3 bucket, active since November 2024. RedHook abuses Android accessibility services and MediaProjection API to capture keystrokes, contacts, SMS, and screen images, maintaining persistent communication with its C2 server. The trojan collects device information, logs credentials, and prompts victims to upload citizen IDs and banking details, indicating over 500 infections. Chinese-language artifacts suggest the malware originates from Chinese-speaking threat actors, evolving from cosmetic scams to sophisticated banking trojans.
  • Gunra ransomware has introduced a Linux variant that significantly enhances its encryption capabilities, allowing it to run up to 100 encryption threads in parallel and enabling partial file encryption. This development marks a strategic shift towards cross-platform targeting, expanding the group's reach beyond its original focus. Since its emergence in April, Gunra has victimized various sectors, including healthcare, manufacturing, and IT, across multiple countries. Unlike its Windows counterpart, the Linux variant does not drop a ransom note, prioritizing quick and efficient encryption instead. It renames encrypted files with a .ENCRT extension and offers attackers the option to store RSA-encrypted keys separately, showcasing its advanced and flexible approach to ransomware attacks.

Related Threat Briefings

Sep 26, 2025

Cyware Weekly Threat Intelligence, September 22–26, 2025

European authorities have crushed a €100 million crypto fraud ring, nabbing five suspects across multiple countries. Active since 2018, this scam lured victims in 23 nations with fake investment platforms. Operation HAECHI VI has clawed back $439 million from global cybercrime, striking a blow against financial fraud. Spanning 40 countries, this effort blocked 68,000 bank accounts and 400 crypto wallets, recovering $16 million in illicit crypto and $342 million in currencies. China’s UNC5221 is sneaking Brickstorm into network appliances, lurking undetected. This Go-based backdoor, mimicking legit software, hits SaaS and tech firms with custom C2 servers. Cloaked in fake copyright notices, the Lone None group is sneaking Pure Logs and Lone None Stealer into systems. With fake job portals as bait, Iran’s Nimbus Manticore targets Europe’s defense and telecom sectors. Their spear-phishing campaign uses multi-stage DLL sideloading to deploy MiniJunk and MiniBrowse. North Korean hackers are reeling in crypto developers with fake LinkedIn job offers, hiding AkdoorTea malware. This Contagious Interview campaign uses BeaverTail and Tropidoor to pilfer data across platforms. Russia’s COLDRIVER is baiting victims with a fake CAPTCHA in the ClickFix campaign. Using BAITSWITCH to download SIMPLEFIX, a PowerShell backdoor, this multi-stage attack targets Russian civil society and Western groups, gathering system data via stealthy C2 communication. Since 2022, a stealthy campaign has been hijacking DLLs to unleash a PlugX variant on Asia’s telecom and manufacturing sectors. It uses malicious documents and shared cryptographic tools to deploy RainyDay and Turian-like backdoors.

Sep 19, 2025

Cyware Weekly Threat Intelligence, September 15–19, 2025

In a bold takedown, Microsoft and Cloudflare have dismantled the RaccoonO365 phishing empire targeting Microsoft 365 users. This PhaaS racket, raking in $100,000 in crypto, hit sectors like healthcare, prompting a lawsuit with Health-ISAC and the seizure of 330 domains to protect public safety. Brazil is setting a new benchmark for kids' online safety with a landmark law demanding strict age verification. The Digital ECA bans targeted ads for children, requires parental tools, and ditches self-declaration for reliable checks, making Brazil the first in Latin America to shield minors from harmful content. Researchers have uncovered joint activity involving the use of Gamaredon's custom tools to deploy Kazuar, a powerful Turla-developed backdoor known for its stealth and persistence. In a recent FileFix campaign, threat actors are hiding malicious PowerShell scripts and encrypted binaries inside seemingly innocent image files. Unlike earlier proof-of-concept variants, this iteration ups the ante by using multilingual phishing pages and deeply obfuscated JavaScript. AppSuite, OneStart, and ManualFinder are a malware triple threat. Posing as legit tools like PDF editors, they use Electron and PowerShell to track users and install sneaky extensions. Malware deployment is getting more modular and more menacing. CountLoader is a newly developed malware loader tied to Russia-affiliated ransomware groups like LockBit, BlackBasta, and Qilin. Google has shipped an urgent patch to plug a critical flaw in Chrome. Tracked as CVE-2025-10585, the newly patched vulnerability stems from a type confusion bug in the V8 JavaScript engine. Maranhão Stealer is hunting gamers through pirated software. Built with Node.js and Inno Setup, it mimics Microsoft components to hide, using DLL injection for persistence.

Sep 12, 2025

Cyware Weekly Threat Intelligence, September 08–12, 2025

CISA’s new playbook is shaking up the CVE program. Its Quality Era pushes for better automation, APIs, and data standards. With a focus on transparency and global partnerships, it aims to keep vulnerability management vendor-neutral and collaborative. California’s latest privacy law is forcing browsers to step up. Every website visit will carry user requests to block third-party data grabs, boosting consumer control. Akira ransomware is busting into networks through SonicWall's CVE-2024-40766 flaw. ACSC warns of fresh exploits since September, with 40 incidents probed. A rogue Chrome extension, Madgicx Plus, is preying on Meta advertisers with a slick AI optimization pitch. This malware, spread through polished domains tied to past scams, hijacks Google and Facebook accounts, siphoning off valuable ad assets with deceptive ease. Masquerading as harmless GitHub files, Kimsuky is sneaking malware into systems with malicious LNK files. Mustang Panda's latest ToneShell variant is digging deep into systems with slick persistence moves. Delivered via DLL sideloading in archives, it dodges analysis, enforces single-instance rules, and sets up scheduled tasks in user directories. Researchers uncovered a RAT storm hitting Chinese users since May. Phishing on GitHub Pages drops ValleyRAT, FatalRAT, and kkRAT, the latter echoing Ghost RAT with beefed-up encryption and commands. Slipping through macOS like a shadow in the fog, ChillyHell malware cloaks itself as a harmless app to wreak havoc.

Sep 5, 2025

Cyware Weekly Threat Intelligence, September 02–05, 2025

Forging a united front, 15 nations have rallied behind a new guide to bolster software supply chain security with SBOMs. This joint effort pushes for transparency in software components, defining roles and urging broad adoption across industries. ISC2 is arming professionals with a new Threat Handling Foundations Certificate to tackle rising cyber incidents. Covering DFIR through four courses, it sharpens skills across four courses, addressing visibility gaps and supply chain risks with practical, tool-focused training. A zero-day flaw in Sitecore deployments is opening doors for hackers to unleash WeepSteel malware. By exploiting a reused ASP.NET key, attackers achieve remote code execution. Iran’s Homeland Justice APT is casting a wide phishing net, targeting over 50 global embassies and organizations. Using 100+ hijacked email accounts and malicious Word docs, they exploit trusted identities to deliver malware. Lazarus Group is playing a dangerous game of impersonation, wielding three new RATs against a DeFi target. Using fake Telegram profiles and sham scheduling sites, they deploy PondRAT for initial access. Slipping through digital cracks, China-aligned GhostRedirector is hijacking Windows servers with a stealthy C++ backdoor called Rungan. Paired with the Gamshen IIS module for SEO fraud, it boosts gambling sites on Google. Lurking in your inbox, Russia’s APT28 is wielding NotDoor to turn Outlook into an espionage tool. This VBA backdoor, triggered by email keywords, uses obfuscation and DLL side-loading to dodge detection. A fake PDF editor peddled through Google ads is dishing out the TamperedChef infostealer to unsuspecting users.

Aug 29, 2025

Cyware Weekly Threat Intelligence, August 25–29, 2025

From cryptocurrency scams to software vulnerabilities, recent global efforts showcase robust responses to sophisticated cyber threats. Cryptocurrency firms, including Chainalysis, Binance, OKX, and Tether, froze $46.9 million in funds stolen through Southeast Asia-based "romance baiting" scams, targeting victims via fake investment schemes. Meanwhile, the CISA introduced the new ‘Software Acquisition Guide: Supplier Response Web Tool’ to empower organizations to integrate cybersecurity into their procurement processes, addressing software supply chain vulnerabilities. Posing as a golden ticket from the Bangladesh Education Board, SikkahBot is preying on students with fake scholarship lures. Active since July 2024, this Android malware grabs high-risk permissions to intercept SMS and steal financial data. A data theft campaign attributed to UNC6395 targeted Salesforce instances via compromised OAuth tokens linked to the Salesloft Drift app, exfiltrating sensitive credentials. Blind Eagle's shadow looms over Colombia, with five activity clusters unleashing RATs and phishing on government sectors from May 2024 to July 2025. Click Studios is sounding the alarm on a dangerous flaw in Passwordstate’s password manager. This authentication bypass lets attackers access the admin section via a crafted URL. Truesec uncovered a cybercrime campaign distributing a trojanized "AppSuite PDF Editor" via Google ads, installing "TamperedChef" malware that steals credentials and web cookies. The Sangoma FreePBX Security Team has warned about an actively exploited zero-day vulnerability in FreePBX servers with the Administrator Control Panel (ACP) exposed to the internet.

Aug 22, 2025

Cyware Weekly Threat Intelligence, August 18–22, 2025

As cyber threats evolve, global takedown efforts are stepping up to safeguard digital ecosystems. INTERPOL’s Operation Serengeti arrested 1,209 cybercriminals across 18 African nations, recovering $97.4 million and dismantling over 11,000 malicious infrastructures. In another coordinated operation, U.S. authorities seized the Rapper Bot DDoS botnet, which had been active since 2021 and targeted 18,000 victims across 80 countries. The Python Package Index (PyPI) introduced defenses against domain resurrection attacks to prevent account hijacking and supply chain attacks. Berserk Bear hackers are wielding a seven-year-old Cisco flaw to infiltrate global critical infrastructure. Exploiting CVE-2018-0171, these FSB-linked attackers trigger device reloads and use custom SNMP tools. MuddyWater APT is targeting CFOs with spear-phishing, using Firebase-hosted phishing pages and custom CAPTCHAs. With a diplomat’s charm, malicious emails are smuggling XenoRAT into South Korea’s embassies via GitHub traps. Since March, this spearphishing spree has targeted European missions. Masquerading as an Australian electronics store, Cookie Spider’s malvertising campaign unleashed the AMOS malware on over 300 targets. Fraudsters posing as celebrity podcast reps are reeling in business owners with a bait. This podcast imposter scam lures victims into tech-check calls that grant remote access. A zero-day flaw has Apple racing to patch millions of devices with emergency iOS and iPadOS updates.

Aug 8, 2025

Cyware Weekly Threat Intelligence, August 04–08, 2025

In the wake of recent cyberattacks, the US federal judiciary is locking down sensitive court documents with a fortified approach to cybersecurity. Courts nationwide are enforcing stricter access controls, monitored handling procedures, and a mandatory IT security “scorecard” for annual self-assessments to pinpoint vulnerabilities. DARPA is raising the stakes at DEF CON, pitting seven AI-powered cyber reasoning systems against each other to secure the open-source software underpinning critical infrastructure. These autonomous tools, designed to detect and patch vulnerabilities in code vital to water systems and financial institutions, analyzed 7.8 million lines in preliminary rounds, catching 59% of synthetic flaws and uncovering real ones. Akira ransomware is striking with surgical precision, exploiting a suspected zero-day flaw in SonicWall SSL VPN devices, even those fully patched. Since mid-July 2025, attackers have used Virtual Private Server logins to bypass MFA, hitting multiple targets in rapid succession. A stealthy Python-based PXA Stealer is sweeping across 62 countries, pilfering sensitive data from unsuspecting victims. This infostealer campaign has exfiltrated hundreds of thousands of passwords and more. Phishing emails disguised as court summons are delivering a malicious payload to Ukrainian government and defense sectors, courtesy of UAC-0099. A cunning Android RAT, PlayPraetor, is sweeping through six countries, already compromising over 11,000 devices with its deceptive tactics. It masquerades as legitimate apps via fake Google Play Store pages and Meta Ads. ClickTok is luring TikTok Shop users into a trap with a crafty blend of phishing and malware. This global campaign deploys over 10,000 fake TikTok websites and 5,000 malicious apps, impersonating TikTok’s e-commerce platforms to steal cryptocurrency wallet credentials. Ghost Calls, a new evasion tactic, is turning Zoom and Microsoft Teams into covert channels for malicious activity, slipping past traditional defenses with ease.

Jul 25, 2025

Cyware Weekly Threat Intelligence, July 21–25, 2025

The BlackSuit ransomware crew just lost its home turf. As part of Operation Checkmate, international law enforcement has seized the group’s dark web extortion and negotiation sites. New York is taking aim at cyber threats to its water systems. A newly proposed set of regulations outlines mandatory IT and OT cybersecurity measures for water and wastewater infrastructure, aligning with federal guidelines and introducing funding to support modernization across the state. Not every scam needs sophistication, sometimes all it takes is a lonely heart and a convincing profile picture. SarangTrap, a massive mobile spyware campaign, is luring victims on Android and iOS through fake dating apps. Storm-2603 is slipping through SharePoint’s cracks and locking the doors behind it. The suspected China-based threat group is exploiting two SharePoint vulnerabilities to deploy Warlock ransomware. A trusted source turned treacherous. Hackers launched a supply chain attack on Arch Linux by slipping malware into three AUR packages. These packages silently deployed a RAT that gave attackers persistent control over infected machines. A browser tweak here, a fake mod there, and suddenly your crypto wallet spills its secrets. In a new campaign, the Scavenger trojan exploits DLL Search Order Hijacking to infiltrate password managers and wallets. A new RaaS group called Chaos is conducting high-impact ransomware campaigns through a number of tactics, using remote management tools for long-term access. Mimo is getting stealthier and greedier. The financially motivated group has moved from targeting Craft CMS to Magento, exploiting PHP-FPM vulnerabilities to deploy malware via fileless techniques.

Jul 18, 2025

Cyware Weekly Threat Intelligence, July 14–18, 2025

A keyboard army just lost its command center. Europol’s Operation Eastwood has crippled the pro-Russian hacktivist group NoName057(16). The international effort, involving law enforcement from 12 nations, led to two arrests and the takedown of over 100 servers linked to the group’s “DDoSia” project. Britain wants bug-hunters on its side. The NCSC has launched the Vulnerability Research Initiative, a new program inviting external researchers to help uncover security flaws in widely used hardware and software. Cisco Talos uncovered a MaaS campaign targeting Ukraine, where attackers used Amadey malware and GitHub repositories to stage payloads. The setup mimics tactics from a SmokeLoader phishing operation. Over 600 malicious domains are distributing fake Telegram APKs to unsuspecting users. Most are hosted in China and exploit the Janus vulnerability in Android. Users who trusted GravityForms’ official site got more than they expected. A supply chain attack injected backdoors into plugin files distributed via the official site and Composer. The H2Miner botnet has resurfaced with updated scripts that mine Monero, kill rival malware, and deploy multiple malware. Bundled with it is Lcrypt0rx, a likely AI-generated ransomware that exhibits sloppy logic, malformed syntax, and weak encryption using XOR. A new Konfety variant uses the same package name as a legitimate app but hides the real payload in a lookalike version distributed through third-party stores. One sandbox escape makes five. Google patched a high-severity Chrome flaw that lets attackers break out of the browser’s sandbox using crafted HTML and unvalidated GPU commands.

Jul 4, 2025

Cyware Weekly Threat Intelligence, June 30–July 04, 2025

It looked like a crypto investment until €460 million vanished. Operation BORRELLI dismantled a global fraud ring that scammed over 5,000 victims, with arrests in Madrid and the Canary Islands. A fake workforce was quietly funding a real regime. The DoJ disrupted a North Korean scheme where remote IT workers used stolen identities to get jobs at over 100 U.S. companies. The operation funneled $5 million to the DPRK, exposed military tech, and led to raids across 16 states. Sometimes, the app that looks harmless is just the decoy. Recent investigations uncovered massive Android fraud schemes, including IconAds and Kaleidoscope, which used icon hiding, fake apps, and third-party distribution to flood ad networks with billions of fake requests. Two different names - same tactics, same tools, same playbook. Researchers have found striking overlaps between TA829 and the lesser-known UNK_GreenSec, both of which use phishing lures and REM Proxy services through compromised MikroTik routers. It starts with what looks like an official message from the Colombian government. Behind it is a phishing campaign delivering DCRAT, a modular remote access tool designed for theft and system control. Botnet operators are now turning broken routers into system wreckers. RondoDox is a new Linux-based botnet exploiting CVE-2024-3721 and CVE-2024-12856 to gain remote access to TBK DVRs and Four-Faith routers. That Zoom update request on Telegram? It could be a trap. North Korean actors are deploying NimDoor malware to infiltrate Web3 and crypto platforms using social engineering via Telegram. Google has patched CVE-2025-6554, a critical zero-day in Chrome’s V8 engine that was exploited in the wild to execute arbitrary code.