Cyware Weekly Threat Intelligence, June 23–27, 2025

The Good

• A Common Good Cyber Fund was launched to support non-profits delivering critical cybersecurity services for public benefit. The fund is backed by the U.K and Canada, with G7 leaders endorsing similar initiatives to aid civil society groups combating transnational repression. The fund will focus on securing core digital infrastructure and providing cybersecurity assistance to high-risk individuals and groups. Managed by the Internet Society, the fund will have an expert advisory board to guide its grant programs, with further details to be announced. The initiative addresses threats to civil society, such as cyber surveillance and targeting, especially for journalists and human rights organizations.

The Bad

A phishing email is all it takes to breach critical infrastructure. The OneClik APT campaign is targeting energy and oil sectors using Microsoft ClickOnce to deliver a .NET loader and Golang backdoor. A handful of outdated routers is all it takes to build a persistent espionage network. The LapDogs campaign is targeting SOHO devices with a custom backdoor called ShortLeash, giving attackers root access and control over compromised systems. A familiar package name could be hiding far more than useful code. North Korean actors behind the Contagious Interview campaign have published 35 malicious npm packages, including keyloggers and multi-stage malware.

• The OneClik APT campaign targets the energy, oil, and gas sectors through phishing attacks utilizing Microsoft ClickOnce. This campaign deploys a .NET-based loader named OneClikNet, which installs a Golang backdoor called RunnerBeacon. The malware leverages cloud infrastructure, specifically AWS services, to evade detection by blending malicious activity with legitimate traffic. Key techniques include AppDomainManager hijacking, multi-layer encryption, and anti-debugging measures. The campaign has evolved through three variants—v1a, BPI-MDM, and v1d—each exhibiting increasing sophistication in evasion tactics and C2 obfuscation.
• IBM X-Force researchers identified targeted cyberattacks by China-aligned group Hive0154 deploying Pubload malware via phishing lures aimed at the Tibetan community. Campaigns coincided with culturally significant events like the Dalai Lama’s 90th birthday and the World Parliamentarians’ Convention on Tibet (WPCT). Hive0154 utilized spear phishing emails with Google Drive links containing weaponized ZIP/RAR archives, exploiting DLL sideloading to activate the Claimloader DLL and Pubload payload. Pubload malware features advanced techniques, including TripleDES decryption, reverse shell access, and dynamic API imports, showcasing Hive0154's technical sophistication.
• An Iranian state-backed hacking group, APT42 (Charming Kitten, Manticore), is targeting Israeli cybersecurity and computer science experts using spear-phishing tactics. The group impersonates relevant personas, such as journalists or researchers, to gain trust and initiate contact, often using WhatsApp to bypass email filters and appear more legitimate. Their phishing campaigns include personalized messages and requests for meetings, leading victims to credential phishing pages mimicking platforms like Google Meet. The primary targets are high-profile cybersecurity experts, academics, and journalists, possibly as a retaliation for alleged Israeli cyber operations against Iran. Over 100 domains and subdomains have been identified in this campaign, suggesting a broader scope with potential targets beyond Israel.
• Researchers have identified a backdoor campaign named LapDogs, which targets Linux-based SOHO devices, particularly in the U.S., Japan, South Korea, Taiwan, and Hong Kong. The campaign employs a custom backdoor called ShortLeash, granting attackers root access and enabling them to set up fake Nginx servers with spoofed TLS certificates. Over 1,000 infected nodes have been traced, primarily focusing on outdated devices such as Ruckus Wireless and Buffalo AirStation routers. The operation exhibits structured campaign planning and consistent targeting patterns, suggesting links to China-Nexus threat actors, as indicated by the use of Mandarin in code comments and tactics reminiscent of previous Chinese espionage efforts.
• North Korean threat actors linked to the Contagious Interview campaign have published 35 malicious npm packages, six of which remain active. These packages have been downloaded over 4,000 times. The attack uses a malware loader called HexEval, which decodes and executes second-stage malware (BeaverTail) and third-stage backdoors (InvisibleFerret). This layered approach evades static analysis and manual reviews. Attackers employ typosquatting techniques, mimicking popular npm package names like react-plaid-sdk and vite-plugin-tools to deceive developers. HexEval Loader obfuscates C2 endpoints with hexadecimal encoding and uses conditional logic to selectively deliver malicious payloads. Some malicious packages, such as jsonsecs, include keyloggers for deeper surveillance across Windows, macOS, and Linux systems.
• APT36, also known as Transparent Tribe, has launched a sophisticated phishing campaign targeting Indian defense personnel. The campaign involves emails containing malicious PDF attachments disguised as official government documents. When opened, these PDFs prompt users to click a deceptive button that leads to a fraudulent URL, triggering the download of a malicious executable. The malware, written in C/C++, employs advanced techniques to evade detection, including anti-debugging and anti-VM measures, while conducting keylogging and browser data theft. This operation aims for long-term access to sensitive defense networks, with the attack infrastructure linked to a domain registered in Brazil.

New Threats

A fake Windows update might just be the start of something worse. The EvilConwi campaign is abusing ConnectWise ScreenConnect to deliver signed malware through tampered installers. Encrypted messaging apps aren’t immune to state-backed malware delivery. APT28 is targeting Ukrainian government entities via Signal, sharing macro-laced documents that deploy a backdoor named Covenant. Some WordPress plugins are doing a lot more than extending site functionality. Researchers uncovered a long-running malware campaign that uses rogue plugins to skim credit card data, steal credentials, and manage backend systems on infected sites.

• Socket discovered a malicious Python package named "psslib," which typosquats the legitimate "passlib" library. This package, published by the threat actor umaraq, forces Windows systems to shut down immediately upon incorrect password input, exploiting developer trust in security libraries. The malicious code uses the `os` module to execute shutdown commands, resulting in data loss and disruption. While effective on Windows, the shutdown command fails harmlessly on Linux and macOS systems, indicating a targeted attack on Windows development environments.
• Unit 42 researchers have reported a series of cyberattacks targeting financial institutions in Africa, identified as cluster CL-CRI-1014. Attackers leverage open-source tools such as PoshC2, Chisel, and Classroom Spy to gain initial access to networks, which they then sell on the dark web. These threat actors disguise their tools as legitimate applications to evade detection and employ techniques like remote services and PsExec for lateral movement. The attackers use PowerShell scripts to deploy Classroom Spy, allowing them to monitor and control compromised systems. Additionally, they utilize methods like creating services and scheduled tasks to maintain persistence within the targeted environments.
• Zscaler ThreatLabz researchers have identified a malware campaign using Black Hat SEO to manipulate search engine rankings for AI-related keywords, leading users to malicious websites designed to distribute malware like Vidar Stealer, Lumma Stealer, and Legion Loader. These sites exploit the popularity of AI tools, employing JavaScript to collect browser data and redirect victims through multiple layers to evade detection. The malware is often packaged in large installer files or password-protected ZIP archives to bypass security systems. Techniques such as browser fingerprinting and XOR encryption are utilized to obfuscate malicious activities, with the campaign linked to numerous deceptive domains and significant traffic since early 2025.
• Russian state-sponsored hacking group APT28 is targeting Ukrainian government entities using Signal chats to deploy two new malware families: BeardShell and SlimAgent. These attacks involve sending malicious documents via Signal that leverage macros to load a backdoor named Covenant. BeardShell, a C++ malware, is designed to download and execute PowerShell scripts, with results exfiltrated to a C2 server via the Icedrive API. SlimAgent acts as a screenshot grabber, capturing and encrypting images for future exfiltration.
• Wordfence identified a modular malware family capable of credit card skimming, WordPress credential theft, and hosting live backend systems on infected websites. The malware disguises itself as a rogue WordPress plugin, with evidence of prolonged activity dating back to September 2023. Over 20 malware samples were analyzed, revealing shared obfuscation techniques, anti-analysis measures, and ongoing development efforts. Malware variants specifically target checkout pages and avoid WordPress admin panels to evade detection. Some malware variants use cookies to identify administrators or previously compromised users and avoid targeting them. Non-skimming variants manipulate Google Ads, steal WordPress login credentials, and distribute malware payloads. A rogue WordPress plugin acts as both a frontend skimmer and a backend tool for attackers, leveraging WooCommerce hooks and backend infrastructure.
• A new malware campaign tracked as EvilConwi is actively abusing ConnectWise’s ScreenConnect software to distribute signed malware. This follows earlier exploitation of CVE-2024-1708 and CVE-2024-1709 in February 2024. Threat actors leverage poor signing practices and Authenticode stuffing to embed malicious configurations into legitimate ConnectWise installers. Since March 2025, there has been a surge in infections involving maliciously signed ConnectWise samples. Victims often report symptoms such as fake Windows update screens and erratic mouse movement. Infection vectors typically begin with phishing emails linking to Canva pages or Facebook ads, which lead to the download of trojanized ConnectWise installers.
• The Confucius APT group has introduced a new modular backdoor named Anondoor, aimed at enhancing its cyber-espionage capabilities. This sophisticated framework allows for the delivery of customized payloads while effectively evading traditional sandbox detection methods. Anondoor operates through a malicious .lnk file that downloads multiple payloads, including a C# DLL for the backdoor and a legitimate executable for execution. It collects detailed system information, such as OS version and IP addresses, and communicates with its C2 server using dynamic parameters to retrieve additional instructions.