Cyware Weekly Threat Intelligence, November 03–07, 2025
The Good
International law enforcement is demonstrating its reach, dismantling vast criminal networks through both massive fraud investigations and covert digital stings. Authorities across nine countries concluded Operation Chargeback, taking down a credit card fraud ring that affected 4.3 million users by using shell companies to process fraudulent subscriptions. This takedown comes as Australian police arrested 55 individuals based on evidence from AN0M, a backdoored messaging app secretly run by authorities to infiltrate and monitor the criminal underworld.
Authorities across nine countries conducted a major operation, Operation Chargeback, dismantling a large-scale credit card fraud network that affected over 4.3 million users globally. The criminal network exploited payment infrastructure, creating fraudulent subscriptions on deceptive websites between 2016 and 2021. They processed unauthorized transactions through legitimate systems, using shell companies and falsified documentation to avoid detection. The investigation, initiated in 2020, involved 18 arrest warrants, over 60 house searches, and secured assets worth EUR 35 million. International agencies, including Europol and Eurojust, coordinated efforts to combat this sophisticated cybercrime.
Australian police recently arrested 55 individuals using evidence from AN0M, a backdoored messaging app created by authorities to infiltrate the criminal community. Launched in 2018 by the FBI and Australian Federal Police after the shutdown of Phantom Secure, AN0M allowed criminals to communicate without knowing their messages were monitored. The latest raids in South Australia, part of Operation Ironside, resulted in significant asset seizures totaling AUD$25.8 million.
China's revised Cybersecurity Law, effective January 1, 2026, introduces significant changes aimed at enhancing AI safety, strengthening enforcement, and clarifying incident reporting obligations. The amendments explicitly support AI development while establishing ethical standards and oversight mechanisms. Stricter enforcement measures include higher penalties for violations, with fines reaching up to RMB 10 million for organizations. The law expands its jurisdiction to include foreign actions that threaten China's network security, regardless of their impact on critical information infrastructure. Additionally, it clarifies personal data processing requirements, ensuring compliance with the Civil Code and Personal Information Protection Law.
The Bad
Cyber attacks are targeting every link in the chain, from the code developers write to the hotels where people stay. A malicious Visual Studio Code extension named susvsex was discovered with ransomware capabilities. On the nation-state front, the Russian-backed Sandworm group is deploying data-wiping malware like ZeroLot and Sting to sabotage Ukraine's critical grain industry. This comes as a sophisticated phishing campaign targets Booking[.]com hotels and customers, using infostealers and the ClickFix infection chain to compromise accounts and steal sensitive data.
A malicious Visual Studio Code extension named "susvsex" was discovered, featuring basic ransomware capabilities and uploaded by a user identified as "suspublisher18." This extension, designed to automatically encrypt and exfiltrate files from specified directories upon launch, was promptly removed from the VS Code Extension Marketplace by Microsoft. It utilizes GitHub as a command-and-control channel, polling a private repository for commands and writing execution results back to it. Additionally, Datadog Security Labs identified 17 npm packages masquerading as legitimate SDKs that deploy Vidar Stealer malware. These packages, which were downloaded over 2,240 times before being taken down, execute malicious payloads through post-install scripts.
Russian state-backed hacker group Sandworm has intensified its attacks on Ukraine, deploying various data-wiping malware to disrupt critical sectors, particularly targeting the grain industry, government, and educational institutions. These operations occurred in June and September, reflecting a strategic shift towards undermining Ukraine's economic stability during the ongoing conflict. The malware, including variants like ZeroLot and Sting, aims to destroy digital information irretrievably, contrasting with ransomware that typically seeks financial gain through data theft. Initial access for these attacks was often facilitated by another group, UAC-0099, indicating a coordinated effort in cyber sabotage against Ukraine's vital economic resources.
A sophisticated phishing campaign has emerged, targeting Booking[.]com hotels and customers by exploiting compromised accounts and customer data. Threat actors deploy infostealing malware to gather credentials from hotel systems, which are then sold on cybercrime forums or used for fraudulent activities. The ClickFix infection chain is employed, utilizing spearphishing emails that mimic Booking[.]com to redirect victims to malicious websites. This chain involves redirection tactics and PowerShell commands to deliver PureRAT that enables remote control and data exfiltration.
Google has released an emergency update for Chrome to address five vulnerabilities, including critical and medium-severity flaws. The most severe issue is CVE-2025-12725, an out-of-bounds write vulnerability in the WebGPU implementation, which poses a significant risk of remote code execution. Other critical vulnerabilities include CVE-2025-12726 and CVE-2025-12727, both related to inappropriate implementations in the Views component and the V8 JavaScript engine, respectively. Additionally, two medium-severity vulnerabilities, CVE-2025-12728 and CVE-2025-12729, were identified in the Omnibox search and navigation bar. The update is being rolled out across all platforms, including Windows, Mac, Linux, Android, and iOS.
Curly COMrades, a threat group, has been observed leveraging Hyper-V virtualization features on compromised Windows 10 systems to establish covert access. By deploying lightweight Alpine Linux-based virtual machines (VMs), they host custom malware, specifically CurlyShell and CurlCat, which facilitate persistent reverse shell and proxy operations. This innovative approach enables the attackers to evade traditional EDR solutions, as the minimal footprint of the VMs reduces detection risks. Their tactics include using PowerShell scripts for Kerberos ticket manipulation and local account persistence, allowing for lateral movement within the network.
Cybercriminals are increasingly targeting trucking and logistics companies to steal cargo through sophisticated attack chains. By exploiting vulnerabilities in the digital transformation of the supply chain, these attackers use RMM tools to gain unauthorized access. They compromise load board accounts to post fake shipments, allowing them to bid on real loads and ultimately hijack valuable cargo. This trend has led to significant financial losses, with cargo theft costing the industry approximately $34 billion annually.
The Silent Lynx APT group has been actively targeting Central Asian nations, Russia, and China for espionage. This group employs spear-phishing campaigns and malicious implants to infiltrate governmental and critical infrastructure sectors. Two significant campaigns are analyzed: one focused on Russia-Azerbaijan relations during a summit in Dushanbe and the other on China-Central Asia relations during a summit in Astana. The research reveals the use of malicious RAR archives containing LNK files that execute PowerShell scripts from GitHub. Silent Lynx uses tools like Silent Loader, LAPLAS implant (TCP & TLS), and SilentSweeper (.NET-based implant) for deploying reverse shells and maintaining persistence.
The China-linked Bronze Butler (Tick) threat group exploited a zero-day vulnerability (CVE-2025-61932) in Motex LANSCOPE Endpoint Manager to gain unauthorized access and steal confidential information. This vulnerability enabled attackers to execute arbitrary commands with SYSTEM privileges. The group utilized Gokcpdoor malware, which established a command and control connection, and the Havoc C2 framework for remote access. Additionally, they employed legitimate tools like goddi, remote desktop applications, and 7-Zip for lateral movement and data exfiltration, leveraging cloud storage services for their operations.
Australia is facing ongoing cyberattacks targeting unpatched Cisco IOS XE devices, with the BadCandy webshell being used to compromise routers. Exploiting the CVE-2023-20198 vulnerability, attackers can create local admin users through the web interface, allowing them to take control of the devices. Despite Cisco addressing this flaw in October 2023, many devices remain unpatched, leading to over 400 reported infections by July 2025, with around 150 still compromised as of late October 2025. The BadCandy webshell enables remote attackers to execute commands with root privileges, and its presence can be reintroduced after device reboots if the vulnerability remains unaddressed. The Australian Signals Directorate has noted signs of re-exploitation, indicating a persistent threat from attackers, some of whom are believed to be state-sponsored actors.
New Threats
The lines between digital espionage, AI-driven malware, and platform vulnerabilities are blurring, creating a complex new threat landscape. A targeted campaign is using the EndClient RAT to hunt North Korean Human Rights Defenders, leveraging stolen code-signing certificates to evade detection. At the same time, a new malware named PROMPTFLUX is using Google's Gemini AI to autonomously rewrite its own code hourly to bypass antivirus scanners. This weaponization of AI platforms is mirrored by flaws found in ChatGPT itself, where researchers uncovered critical vulnerabilities that could allow attackers to steal private user data.
The new EndClient RAT is actively targeting North Korean Human Rights Defenders (HRDs) by leveraging stolen code-signing certificates to evade antivirus detection. Delivered through a malicious Microsoft Installer package disguised as “StressClear.msi,” the malware exploits social engineering tactics, with attackers impersonating trusted contacts to distribute the infection. The campaign began when threat actors compromised a prominent activist’s Google account, subsequently hijacking their KakaoTalk account to spread the RAT to additional targets. This malware employs AutoIT scripting for persistence and anti-analysis features, demonstrating alarmingly low detection rates among antivirus engines. The EndClient RAT's C2 communication utilizes a custom JSON-based protocol, allowing it to execute remote commands and transfer files.
Google has identified a new malware named PROMPTFLUX, which utilizes its Gemini AI model to autonomously rewrite its VB Script source code on an hourly basis, enhancing its obfuscation and evasion capabilities. This malware interacts with Gemini's API to request specific code modifications aimed at evading antivirus detection. Although currently in the development phase, PROMPTFLUX establishes persistence by saving its obfuscated versions in the Windows Startup folder and attempts to spread via removable drives. Additionally, other AI-driven malware variants, including FRUITSHELL and PROMPTLOCK, have emerged, demonstrating the growing trend of threat actors leveraging AI for malicious purposes.
Tenable uncovered critical vulnerabilities in OpenAI's ChatGPT models, including GPT-4 and GPT-5, which could enable attackers to steal private user data and launch zero-click attacks. These vulnerabilities exploit weaknesses in ChatGPT’s processing of external data and its memory feature, allowing malicious actors to inject harmful prompts through trusted websites and URL parameters. One alarming technique, known as “Conversation Injection,” can manipulate ChatGPT’s responses, while another vulnerability bypasses safety mechanisms, exfiltrating user data via tracking links. Attackers can achieve persistence by altering ChatGPT’s memory, leading to ongoing data leaks across multiple sessions. Additionally, a markdown rendering bug allows hidden malicious content to be processed undetected.
Microsoft has revealed a sophisticated backdoor named SesameOp, which exploits OpenAI's API for stealthy C2 communications. This malware is designed to maintain persistence and covertly manage compromised devices, facilitating long-term espionage efforts. The infection chain includes a loader component and a .NET-based backdoor that uses the OpenAI API to fetch and execute encrypted commands. The DLL is heavily obfuscated to evade detection, and it communicates results back to the attackers.
Nation-state hackers are distributing a new malware called Airstalk, linked to a suspected supply chain attack and tracked under the threat cluster name CL-STA-1009. This malware exploits the AirWatch API for mobile device management, enabling covert C2 communication. Airstalk exists in both PowerShell and .NET variants, with the .NET version offering enhanced capabilities, including targeting enterprise browsers like Microsoft Edge and Island. It can capture sensitive data such as browser cookies, history, and bookmarks, while employing evasion techniques to remain undetected. The malware is believed to leverage stolen certificates for signing and poses significant risks to organizations, particularly in the business process outsourcing sector, where it can exploit MDM-related APIs to access sensitive enterprise environments.