Malware’s relentless evolution continues to shape the cyber landscape, with threat actors pushing boundaries in espionage and infrastructure disruption. Two spyware families, BoneSpy and PlainGnome, linked to the Russian group Gamaredon, have been identified as tools of surveillance. Both spyware families enable extensive data collection, reinforcing Gamaredon’s focus on espionage.

Iranian cyber actors have unleashed IOCONTROL malware to compromise IoT and OT/SCADA systems in critical infrastructure. By exploiting routers and fuel management systems, this malware poses a serious threat to key infrastructure in Israel and the U.S. IOCONTROL is capable of executing commands, sending system information, and even self-deleting to avoid detection, highlighting the increasing risks tied to interconnected devices.

Cleo has urged its customers to immediately patch their file-sharing products after the discovery of a vulnerability affecting widely used systems. Despite an earlier patch, the flaw remains exploitable. With exploitation reports rising, firms must secure their systems to mitigate risks associated with this critical bug.

Top Malware Reported in the Last 24 Hours

DarkGate deployed via Microsoft Teams vishing

Researchers observed an incident where an attacker employed social engineering via a Microsoft Teams call to spoof a user’s client and obtain remote access to their system. The adversary instructed the victim to download AnyDesk, a tool used for remote access. After obtaining access to the device, the adversary dropped many suspicious files, one of which was DarkGate. A series of commands executed by Autoit3.exe led to an attempted C2 connection and the subsequent download of a rogue payload. 

Gamaredon introduces new Android spyware

Two Android spyware families, BoneSpy and PlainGnome, linked to the Russian group Gamaredon, were designed for extensive surveillance, including tracking GPS, collecting data, and capturing audio. Gamaredon employs them for espionage purposes. BoneSpy has been active since 2021, while PlainGnome was identified in 2024. Both target Russian-speaking victims in former Soviet states. BoneSpy mimics legitimate apps, and PlainGnome uses a two-stage deployment to avoid detection.

Android banking trojan infects WhatsApp users

McAfee spotted a new Android banking trojan targeting Indian users, which disguises itself as essential services like utility or banking apps to steal sensitive information. The malware has already infected 419 devices, intercepted 4,918 SMSes, and stolen 623 entries of card or bank-related personal information. It uses messaging platforms like WhatsApp for phishing, and once installed, it asks for financial information under the guise of a bill payment app. The malware exploits Supabase for data exfiltration and has different variants targeting specific banks and services.

Stealthy Pumakit malware hits Linux devices

A new Linux rootkit malware called Pumakit has been found, using advanced techniques to hide on systems. It consists of multiple components, including a dropper and a userland rootkit. Pumakit targets critical infrastructure for espionage and financial theft. It can hide its presence from various system tools and logs. Pumakit also modifies process credentials to gain root privileges and can dynamically hide files and network connections. Further, it communicates with a C2 server, sending information back to its operators. 

IOCONTROL malware targets Israel and U.S.

Iranian threat actors are using a new malware called IOCONTROL to target IoT devices and OT/SCADA systems in Israel and the U.S. This malware targets various devices, including routers and fuel management systems. IOCONTROL can disrupt key infrastructure by controlling devices like pumps and payment terminals. The malware avoids detection through various measures and can execute commands like sending system information, running commands, and deleting itself. It operates via standard protocols used by IoT devices and has been reported to compromise gas stations.

Top Vulnerabilities Reported in the Last 24 Hours

Cleo asks customers to apply patches

Software firm Cleo warned customers to apply a new patch to fix a security bug being exploited by cyber actors. The flaw affects their file-sharing products Cleo Harmony, VLTrader, and LexiCom, widely used by big firms. Although initially tracked as CVE-2024-50623 patched, researchers found systems remained vulnerable. A new patch was released, and a new CVE is being generated. Customers should block specific IP addresses associated with the exploitation. There is concern about a malware family named Malichus linked to the flaw, and the number of compromised firms is rising. 

Dell security update for two severe flaws

Dell released a security update to fix two security bugs, CVE-2024-37143 and CVE-2024-37144, in its enterprise products like PowerFlex, InsightIQ, and Data Lakehouse. CVE-2024-37143 enables RCE, while CVE-2024-37144 causes information disclosure. Customers and entities should upgrade to the latest versions soon and check their support resources for guidance.

Critical PDQ deploy flaw causes credential theft

A critical security flaw in PDQ Deploy can result in credential theft and network compromises. It arises from how administrator credentials are managed during software deployment. These credentials, if compromised, could let hackers obtain admin access to the target device. CERT/CC advises using Local Administrator Password Solution (LAPS), alternate deploy modes, and reviewing configurations for security.