Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware x Team Cymru: Accelerated Threat Defense.

•

Learn More

Skip to main content

Cyware Daily Threat Intelligence

Cyware Daily Threat Intelligence - Featured Image

Daily Threat Briefing • Aug 10, 2023

Let’s begin with another contribution from the Black Hat event. Cybersecurity experts have discovered critical zero-day vulnerabilities in popular cryptographic Multi-Party Computation (MPC) protocols, such as GG-18, GG-20, and Lindell 17, enabling potential attackers to rapidly drain funds from millions of retail and institutional customers' wallets. Thankfully, none were exploited in the wild. Speaking of bugs, a compromised access control vulnerability was addressed in Spring Security in the latest update. This may have a severe impact on Spring WebFlux applications utilizing Spring Security for authentication and access control.

In a routine web monitoring, cybersecurity analysts stumbled upon an address that unveiled a series of “hack waves" centered around WordPress. The attack campaign has been attributed to the operators of the Balada Injector malware.

Top Breaches Reported in the Last 24 Hours

Missouri DSS notifies about MOVEit breach

The Missouri Department of Social Services (DSS) urged residents to safeguard their personal information, following a data security breach that originated from the attack on MOVEit Transfer software. The breach potentially exposed the identities of numerous Medicaid participants. While DSS systems remained unaffected, data belonging to the agency was compromised. The accessed files include individual names, department client numbers, dates of birth, benefit eligibility status, coverage, and medical claims information.

Pro-Russian hackers strike websites in Europe

Pro-Russian hacking group NoName057(16) claimed responsibility for recent cyberattacks on government and public services websites in France and the Netherlands. These attacks follow similar actions targeting Spanish, Italian, and Dutch organizations with distributed denial-of-service (DDoS) attacks. While Dutch authorities note the limited impact of these recent DDoS incidents, the group has historically targeted Ukraine and its allies.

**Multi-nation campaign by Chinese hackers **

Hackers tied to China's Ministry of State Security, identified as the RedHotel intrusion set, have been involved in cyberattacks across 17 countries in Asia, Europe, and North America since 2021. The group has targeted various sectors such as academia, aerospace, government, and more. Known by aliases like Aquatic Panda, Bronze University, and Charcoal Typhoon, RedHotel appears to be on an espionage mission to gather intelligence.

Top Malware Reported in the Last 24 Hours

Balada Injector exploits WordPress

In a routine web monitoring operation, the spatialreality[.]com address led security experts to a WordPress-based site distributing Balada Injector malware. The malware infection involves injecting of malicious PHP code that grants remote access and controls malvertising schemes. The injected code is buried within layers of legitimate code, allowing it to execute before the actual site content. The malware's evasion tactics include domain changes and obfuscated attack waves.

Rust-Based injector and SYK Crypter unveiled

FortiGuard Labs has uncovered a new injector coded in Rust, a rapidly emerging programming language, used to introduce the XWorm malware. Rust's adoption in malware creation has grown since 2019, with campaigns like Buer loader and Hive. Injector activity surged in May 2023, employing Base64-encoded shellcode and encryption algorithms (AES, RC4, LZMA) for antivirus evasion. The investigation further exposed the involvement of SYK Crypter in loading Remcos RAT for device control.

Top Vulnerabilities Reported in the Last 24 Hours

Zero-day in cryptographic MPC protocols

Researchers from Fireblocks Cryptography Research Team have identified multiple zero-day flaws in widely used cryptographic Multi-Party Computation (MPC) protocols. The flaws could potentially allow attackers to steal cryptocurrency funds from the wallets of millions of retail and institutional customers. The vulnerabilities, dubbed BitForge, were discovered in protocols such as GG-18, GG-20, and implementations of Lindell 17, affecting popular wallet providers, including Coinbase WaaS, Zengo, and Binance.

High-severity bug in Spring Framework

A security vulnerability, identified as CVE-2023-34034, has been discovered in recent versions of Spring Security, a critical component of the Java-based Spring Framework. Researchers at JFrog conducted an investigation into the flaw, revealing a filter bypass issue within the Spring WebFlux framework, which could grant unauthorized access to sensitive sections of applications. Not all Spring applications are impacted by it.

Millions of users at risk

Cybersecurity firm Claroty unveiled critical vulnerabilities in Western Digital (WD) and Synology network-attached storage (NAS) products, leaving millions of users' files exposed. Demonstrated at Pwn2Own Toronto, the vulnerabilities allowed attackers to remotely access files, execute code, and gain full control over cloud-connected devices. WD's flaw involved impersonating devices and leveraging cloud tunnels, while Synology's weakness redirected users to attacker-controlled devices via QuickConnect.

Intel addresses 80 vulnerabilities

Intel has issued 46 new security advisories detailing 80 vulnerabilities affecting its firmware and software. Among the most severe are 18 high-severity flaws allowing privilege escalation or denial-of-service attacks. These vulnerabilities impact a range of products, including processors, chipset firmware, software suites, and more. Medium-severity issues have also been addressed, covering various components like RealSense SDKs, Ethernet controllers, and system firmware.

Google releases Android security updates

Google issues its August 2023 security updates for Android, fixing over 40 vulnerabilities. The most severe is CVE-2023-21273, a critical remote code execution flaw in the System component affecting Android 11, 12, 12L, and 13. Other critical vulnerabilities include remote code execution in the Media Framework (CVE-2023-21282), kernel privilege escalation (CVE-2023-21264), and memory corruption in Qualcomm closed-source components (CVE-2022-40510). Dozens of high-severity vulnerabilities were also patched.

Top Scams Reported in the Last 24 Hours

EvilProxy campaign targets Microsoft 365 users

The EvilProxy campaign has targeted over 100 organizations worldwide, with a focus on high-ranking executives, sending 120,000 phishing emails to steal Microsoft 365 accounts. This advanced threat utilizes a reverse proxy architecture to bypass multi-factor authentication (MFA) and compromise victims' sessions. Researchers observed a rising trend in successful cloud account compromises despite MFA adoption.

Related Threat Briefings

Feb 4, 2025

Cyware Daily Threat Intelligence, February 04, 2025

Cybercriminals are finding new ways to weaponize everyday tools, and this time, they’re using TryCloudflare to hide their tracks. Researchers uncovered a phishing campaign that stealthily delivers AsyncRAT via Python scripting and cloud tunnels. The attack starts with a Dropbox link leading to a maze of scripts that ultimately drop a harmful payload. Even AI developers aren’t safe from deception. Threat actors have infiltrated PyPI with two malicious packages disguised as legitimate tools for DeepSeek. These fraudulent packages steal sensitive data, from user credentials to API keys, proving once again that trust in open-source repositories can be a double-edged sword. One small vulnerability, one massive risk. Russian cybercriminals exploited a zero-day in 7-Zip to deliver SmokeLoader in attacks on Ukrainian entities. By bypassing Windows Mark-of-the-Web protections, the attackers tricked victims into executing malware-laden files.

Feb 3, 2025

Cyware Daily Threat Intelligence, February 03, 2025

Cybercriminals are exploiting trust and social engineering at scale, preying on unsuspecting victims across industries. The Russian-speaking cybercrime gang Crazy Evil has been linked to over 10 social media scams, tricking users into installing malware like StealC and AMOS. Operating primarily through Telegram, the group specializes in identity fraud, cryptocurrency theft, and info-stealers. A wedding invitation should bring good news, not malware. Hackers in Malaysia and Brunei are targeting users with fake wedding invites spread via WhatsApp and Telegram, tricking them into installing a new Android malware called Tria. The campaign resembles UdangaSteal but focuses on new social engineering tactics. Even the tightest security can come undone with a race condition. Apple patched a critical vulnerability in macOS Sonoma, Sequoia, and iPadOS, which allowed hackers to escalate privileges and run code at the kernel level. Apple fixed the issue by improving memory management, but this serves as another reminder that even the most secure systems need constant vigilance.

Jan 31, 2025

Cyware Daily Threat Intelligence, January 31, 2025

Cybercriminals are sharpening their tactics, and Brazilian financial firms are the latest target. The Coyote banking trojan is on the prowl, using malicious Windows LNK files to execute PowerShell scripts that steal data and compromise systems. Meanwhile, a new browser-based threat is emerging—syncjacking. This attack exploits malicious extensions to hijack browsers, disable security settings, and access stored credentials. In its final stage, attackers gain full control of devices, including cameras and audio, without detection. Speaking of hidden threats, users of Microsoft Ads are being tricked by fraudulent Google ads leading to phishing pages designed to steal their login credentials. This campaign has persisted for two years, slipping past security filters and mimicking Microsoft’s login process with deceptive precision. For detailed Cyber Threat Intel, click ‘Read More’.

Jan 29, 2025

Cyware Daily Threat Intelligence, January 29, 2025

Cybercriminals are refining their tactics, blending deception with persistence to breach defenses. A financially motivated threat actor has been running a phishing email campaign since last year, targeting users in Poland and Germany. The attacks use payloads like Agent Tesla, Snake Keylogger, and a new backdoor named TorNet. Zyxel CPE Series devices are under siege as researchers uncover an actively exploited zero-day vulnerability. This flaw allows attackers to execute remote commands, potentially leading to system takeovers, data loss, and network intrusions. The attacks, originating primarily from Taiwan, have compromised over 1,500 devices, sparking urgent calls for users to apply security updates. Phishing scams continue to evolve, with a new campaign exploiting PDF documents to steal Amazon Prime credentials. Victims receive emails warning of an expired membership, leading them to a fake Amazon login page where they unknowingly hand over personal and credit card information.

Jan 28, 2025

Cyware Daily Threat Intelligence, January 28, 2025

Even the sleekest systems have their cracks. Apple has patched a critical CoreMedia vulnerability that hackers have already exploited to target devices. The flaw, which impacts how audio and video are processed, had been actively used against earlier versions of iOS prior to iOS 17.2. Apple’s fix is now available for iPhones XS and later, select iPads, and the company’s latest hardware. Security shouldn’t feel like Swiss cheese. Yet, SonicWall’s SMA1000 appliances are under siege, with attackers exploiting a critical vulnerability to install malware without requiring credentials. Despite a patch being available, over 5,000 devices remain exposed, allowing hackers to hijack SSL VPN sessions remotely. Think twice before clicking on that delivery notification. Phishers posing as USPS are sending fraudulent SMS messages claiming a package couldn’t be delivered due to “incomplete address information.” With over 630 phishing pages spanning 50 countries, the campaign targets unsuspecting individuals at an alarming scale. In today’s digital landscape, not all deliveries are worth opening - especially the fraudulent ones.

Jan 27, 2025

Cyware Daily Threat Intelligence, January 27, 2025

Once again proving there’s no honor among thieves, hackers were found preying on script kiddies via a trojanized XWorm RAT builder, compromising over 18,000 devices globally. The fake builder allowed operators to steal data and issue commands through a Telegram-based C2. LTE and 5G networks face a critical challenge as researchers uncover 119 vulnerabilities that could disrupt services or breach core networks. These flaws, linked to buffer overflows and memory corruption, leave mobile users exposed to potential monitoring and targeted attacks. A deceptive malware campaign leverages fake CAPTCHA pages and clipboard hijacking to spread Lumma Stealer across industries in multiple regions. The malware uses advanced evasion tactics to outmaneuver security defenses while stealing sensitive data.

Jan 24, 2025

Cyware Daily Threat Intelligence, January 24, 2025

Hackers are crafting convincing traps by mimicking trusted platforms. Nearly 1,000 fake web pages imitating Reddit and WeTransfer are being used to distribute Lumma Stealer. Fraudsters fake Reddit discussions and provide malicious WeTransfer links, creating an illusion of authenticity. Juniper edge devices are under attack by J-magic, a stealthy malware that activates only when it detects a specific magic packet. Targeting multiple industries J-magic’s reverse shell remains dormant until triggered, enabling covert communications. A flaw in Cloudflare's CDN exposes users’ locations via images sent through apps like Signal and Discord. By exploiting this vulnerability, attackers can pinpoint a target’s location within a 250-mile radius, leveraging Cloudflare's caching system to silently gather data.

Jan 23, 2025

Cyware Daily Threat Intelligence, January 23, 2025

Cybercriminals are finding new ways to exploit the cloud. The financially driven TRIPLESTRENGTH group has been targeting platforms like Google Cloud and AWS for cryptojacking and ransomware, often leveraging stolen credentials from malware infections. The QakBot loader has a new ally: BackConnect (BC) malware. Researchers uncovered its use in tandem with tools like DarkVNC and KeyHole, bolstering system data theft and remote access capabilities. This innovation is linked to Storm-1811 and the deployment of Black Basta ransomware. AIRASHI, an AISURU botnet variant, has been exploiting zero-day vulnerabilities in Cambium Networks cnPilot routers to deliver DDoS attacks reaching up to 3 Tbps. Its operators flaunt their capabilities on Telegram, with compromised devices found across the globe.

Jan 22, 2025

Cyware Daily Threat Intelligence, January 22, 2025

A covert supply chain attack compromised a South Korean VPN provider, with the China-linked APT group PlushDaemon embedding its SlowStepper backdoor into a malicious installer. Active since 2019, this espionage campaign leverages a sophisticated toolkit, hijacked app updates, and server vulnerabilities to target victims across multiple nations. The Murdoc botnet has emerged as a formidable threat, exploiting vulnerabilities in AVTECH IP cameras and Huawei routers to infect over 1,370 systems in Southeast Asia and Latin America. With its roots in Mirai, this botnet uses shell scripts tailored to IoT architectures, aiming to power massive DDoS campaigns. Oracle’s latest Critical Patch Update addresses 318 vulnerabilities, including a severe flaw in its Agile Framework. With critical risks spanning products like JD Edwards and Communications Routers, organizations are urged to update immediately to mitigate the danger of exploitation.

Jan 21, 2025

Cyware Daily Threat Intelligence, January 21, 2025

From malware campaigns targeting critical infrastructure to vulnerabilities in core networking protocols, threat actors are exploiting trust and technical gaps to infiltrate systems. The MintsLoader campaign targets sectors like energy and law with the StealC malware and the BOINC client, masking malicious actions as legitimate. Meanwhile, the DoNot APT group is using the new Tanzeem Android malware to spy on South Asian government and military entities. Flaws in tunneling protocols put millions of systems at risk of DoS attacks and unauthorized network access, underscoring the need for stronger configurations. Meanwhile, attackers are impersonating CERT-UA using AnyDesk to infiltrate Ukrainian systems under the pretense of a “security audit.” For detailed Cyber Threat Intel, click ‘Read More’.

Jan 20, 2025

Cyware Daily Threat Intelligence, January 20, 2025

In today’s evolving cyber landscape, even natural disasters are becoming fertile ground for exploitation by bad actors. Southern California’s raging wildfires have ignited a parallel wave of phishing scams targeting affected individuals and businesses. Fraudsters are leveraging themes of relief and recovery to propagate bogus donation requests, fake insurance claims, and cryptocurrency fraud schemes. Elsewhere, PHP-based web servers in Indonesia are being hijacked to promote online gambling platforms. Targeting servers running Moodle LMS, attackers are installing rogue plugins, stealing credentials, and deploying Python-based bots to propagate the attack. Meanwhile, a critical flaw in Moxa’s EDS-508A Series Ethernet switches has been patched, addressing vulnerabilities that could grant unauthorized access and disrupt operations. Admins are urged to apply the security patch immediately. For detailed Cyber Threat Intel, click ‘Read More’.

Jan 16, 2025

Cyware Daily Threat Intelligence, January 16, 2025

Threat actors continue to exploit misconfigurations and vulnerabilities to spread malware and disrupt systems. A newly discovered MikroTik botnet of 13,000 devices abuses SPF DNS flaws to spoof 20,000 domains, bypassing email security and delivering malware via fake DHL-themed emails. At the same time, adversaries are embedding rogue code in image files to spread VIP Keylogger and 0bj3ctivity Stealer, leveraging phishing emails and Base64-encoded payloads to compromise systems. The CERT/CC warned of newly discovered vulnerabilities affecting over 660,000 Rsync servers. Among the six identified flaws, two—CVE-2024-12084 and CVE-2024-12085—allow remote code execution when combined. Cybercriminals are also weaponizing Google Search ads to steal Google Ads credentials. By directing users to phishing pages hosted on Google Sites, attackers can disguise their schemes under the guise of legitimate Google Ads pages.