Cyware Weekly Threat Intelligence, March 10–14, 2025

The Good

A Russian hosting provider is feeling the heat from global sanctions. Australia, the U.K., and the U.S. have sanctioned Zservers, a bulletproof hosting provider linked to ransomware and fraud, freezing its assets and restricting operations. Switzerland is tightening its grip on cyber incident reporting. Starting April 1, critical infrastructure operatorsmust report cyberattacks to the NCSC within 24 hours, reinforcing national cybersecurity defenses.

• Australia, the U.K, and the U.S. jointly imposed sanctions on Zservers, a Russian bulletproof hosting provider, for facilitating connectivity for numerous ransomware affiliates and fraudsters, marking an international effort to target cybercrime infrastructure. The sanctions freeze Zservers' assets, prohibit transactions with the group, and ban associated individuals from traveling to Australia, impacting its operations but not completely halting them.
• Starting from April 1, operators of critical infrastructure in Switzerland will be legally obligated to report cyber-attacks to the NCSC within 24 hours of discovery. This mandate is part of an amendment to the Information Security Act and applies to incidents that threaten the functioning of critical infrastructure, result in information manipulation or leakage, or involve blackmail, threats, or coercion. Affected entities include energy and drinking water suppliers, transport companies, and cantonal and communal administrations. 

The Bad

Cybercriminals are upgrading their toolkit for long-term access. Ragnar Loader is being leveraged by ransomware groups like FIN7, FIN8, and Ragnar Locker, evolving into a stealthier and more modular malware for persistent system compromise. Chinese hackers are slipping past defenses in Juniper routers. The UNC3886 threat group is backdooring older Juniper MX routers, bypassing security protections and embedding custom TinyShell malware to maintain access. North Korean hackers are adding ransomware to their arsenal. Moonstone Sleet (Storm-1789) is deploying Qilin ransomware, using fake companies and trojanized tools to infiltrate targets through LinkedIn and freelance platforms.

• Several cybercrime and ransomware groups, including Ragnar Locker (aka Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis have been using the Ragnar Loader malware toolkit. Ragnar Loader helps attackers maintain access to compromised systems for long periods. Ragnar Loader is crucial for maintaining access to compromised systems and enabling long-term operations. Its developers are constantly adding new features, making it more modular and harder to detect. The malware is offered to affiliates as an archive file containing multiple components for reverse shell, local privilege escalation, and remote desktop access.
• A Chinese threat group known as UNC3886 has infected various organizations' Juniper Networks routers with custom backdoors. Their attacks mainly targeted older Juniper MX routers that do not support security monitoring tools. UNC3886 initially accessed the routers through terminal servers with legitimate credentials and then infiltrated the routers' operating systems. Once inside, the attackers deployed customized versions of the TinyShell backdoor. The attackers were able to bypass security measures, specifically a feature in Junos OS designed to protect against unauthorized code. 
• Microsoft reported that a North Korea-linked APT group called Moonstone Sleet has been using Qilin ransomware in limited attacks since February, marking a shift from its previous use of custom ransomware. Moonstone Sleet, also known as Storm-1789, employs various tactics, including fake companies, trojanized tools, and malicious games for financial gain and espionage. They target victims via LinkedIn and freelance sites, using software developer personas to engage organizations. 
• Cisco Talos disclosed a Miniaudio and three Adobe vulnerabilities, all of which have been patched by their respective vendors. The Miniaudio vulnerability (CVE-2024-41147) is an out-of-bounds write issue. It can cause a buffer overflow leading to memory corruption when a specially crafted FLAC file is played. The three Adobe vulnerabilities are in Adobe Acrobat's font functionality. Two are out-of-bounds read vulnerabilities (CVE-2025-27163 and CVE-2025-27164) that can lead to the disclosure of sensitive information, and one is a memory corruption vulnerability (CVE-2025-27158) that could potentially allow arbitrary code execution. These Adobe vulnerabilities can be triggered by a specially crafted font file embedded in a PDF. 
• Fraudsters are impersonating the Clop ransomware gang to extort businesses. These scammers claim to have exfiltrated sensitive data to extort payments from targets. They often reference media coverage about actual Clop ransomware attacks to appear legitimate. However, these emails lack elements associated with genuine Clop extortion demands, such as a 48-hour payment deadline, links to a secure chat channel for ransom payment negotiations, and partial names of companies whose data was breached.
• Facebook has warned about a vulnerability in the FreeType open-source font rendering library, which is used in millions of systems and services, including Linux, Android, and online platforms. The flaw, tracked as CVE-2025-27363, can lead to arbitrary code execution and has been reportedly exploited in attacks. It exists in all versions of FreeType up to 2.13 and was fixed in version 2.13.0. The vulnerability is due to an out-of-bounds write when parsing font subglyph structures related to TrueType GX and variable font files. 
• North Korea's Lazarus Group has been found to have infiltrated the npm ecosystem with six new malicious packages. These packages, designed to compromise developer environments, steal credentials, extract cryptocurrency data, and deploy a backdoor, closely mimic the names of widely trusted libraries and employ typosquatting tactics. The packages contain BeaverTail malware and have been downloaded over 330 times. The Lazarus Group has also created and maintained GitHub repositories for these packages to lend an appearance of open-source legitimacy. 

New Threats

A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide. Copy, paste, and lose your crypto. MassJacker hijacks clipboard transactions, swapping wallet addresses with attacker-controlled ones, stealing funds from victims who unknowingly send money to the wrong destination. A fake CAPTCHA is all it takes to get root access. The OBSCURE#BAT campaign is using social engineering tactics to install the r77 rootkit, bypassing defenses and targeting English-speaking users with stealthy, persistent malware.

• The Ballista botnet is exploiting an unpatched vulnerability (CVE-2023-1389) in TP-Link Archer routers. This remote code execution flaw allows unauthenticated command injection due to lack of input sanitization in the locale API of the routers' web management interface. The Ballista botnet has been targeting over 6,000 Archer routers since early 2025, spreading automatically through this vulnerability. The botnet uses Tor domains for stealth and has been linked to an Italian-based threat actor. It installs a dropper that downloads and executes malware binaries on compromised devices, employing persistence, system exploration, and anti-detection techniques. The malware can execute remote shell commands, launch DoS/DDoS attacks, and has affected various sectors in the U.S., Australia, China, and Mexico. 
• A clipboard hijacking operation called MassJacker uses over 778,000 cryptocurrency wallet addresses to steal digital assets from compromised computers. The operation was discovered by CyberArk, who found that around 423 wallets linked to the operation had $95,300 at the time of analysis, with a single Solana wallet amassing over $300,000 in transactions. The malware is distributed via pesktop[.]com, a site that hosts pirated software and malware. The operation uses clipboard hijacking malware to replace copied cryptocurrency wallet addresses with ones controlled by the attackers, causing victims to unknowingly send money to the attackers. 
• A new malware campaign named OBSCURE#BAT has been discovered, which uses social engineering tactics to deliver an open-source rootkit called r77. This campaign primarily targets English-speaking individuals in the U.S., Canada, Germany, and the U.K. The attack begins with an obfuscated Windows batch script that executes PowerShell commands, leading to the deployment of the rootkit. The malware is distributed through two main methods: a fake Cloudflare CAPTCHA verification page and advertising the malware as legitimate software. The malware is designed to evade detection and establish persistence on compromised systems. It modifies system registry keys, sets up scheduled tasks, and employs a variety of obfuscation techniques. The malware also monitors clipboard activity and command history for potential data exfiltration.
• A new ransomware group, Mora_001, has been discovered with potential ties to LockBit. The group has been exploiting two Fortinet vulnerabilities (CVE-2024-55591 and CVE-2025-24472) since January to gain access to victim environments and deploy a new ransomware called SuperBlack. After gaining initial access, attackers escalate their privileges to super-admin, create additional admin accounts, and secure persistent access. They use various methods to gain persistence and laterally move within the network, primarily using SSH to access high-value systems. The ransomware payload used is based on LockBit 3.0 or LockBit Black, with minor modifications. 
• Netskope has discovered a new ransomware variant, Elysium, which is linked to the Ghost ransomware family. This group has been active since 2021 and targets critical infrastructure, healthcare, and government sectors by exploiting vulnerabilities in outdated applications. Elysium uses a multi-stage attack chain, employing tools like Cobalt Strike, BadPotato, GodPotato, Mimikatz, SharpShares, and WMI. Once the attackers gain access, they deploy the Elysium payload, which disrupts recovery efforts, terminates specific services, and attempts to stop Hyper-V virtual machines. 
• A new Android surveillance tool called KoSpy has been discovered, which is believed to be the work of the North Korean APT group ScarCruft (aka APT37). The spyware has been found to target Korean and English-speaking users, using fake utility apps to infect devices. KoSpy was distributed through the Google Play Store and Firebase Firestore, with all associated apps and projects now removed or deactivated. The spyware has extensive data collection capabilities, including accessing SMS messages, call logs, device location, and more. It communicates with C2 servers, some of which are still online but do not respond to requests.