Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Daily Threat Intelligence, March 17, 2025

shutterstock 1317211217

Daily Threat Briefing • Mar 17, 2025

The Black Basta gang has cooked up a relentless new tool. Its automated brute-forcing framework has been relentlessly probing edge networking devices since 2023, zeroing in on widely used edge networking devices.

Something sinister was brewing in the PyPI repository. Multiple fraudulent packages racked up tens of thousands of downloads and hid a nasty secret: code designed to siphon cloud access tokens. However, the packages have been removed.

Coinbase users are getting hit with a scam that’s all polish and bad intentions. Dressed up as an official notice about a court-ordered shift to self-custodial wallets, it nudges recipients to set up a new wallet with a recovery phrase - except it’s a trap, pre-controlled by the attackers.

Top Malware Reported in the Last 24 Hours

Malicious apps target Microsoft 365 accounts

Cybercriminals are using malicious Microsoft OAuth apps that pretend to be Adobe and DocuSign apps to deliver malware and steal Microsoft 365 account credentials. These apps request access to less sensitive permissions to avoid detection. The phishing campaigns, which are highly targeted, were sent from compromised email accounts and targeted multiple U.S. and European industries. The attacks use RFPs and contract lures to trick recipients into opening links.

Black Basta creates automated brute-forcing tool

The Black Basta ransomware group has developed an automated brute-forcing framework, named BRUTED, to breach edge networking devices such as firewalls and VPNs. This framework has allowed Black Basta to streamline initial network access and scale up their ransomware attacks on vulnerable internet-exposed endpoints. The ransomware group has been using BRUTED since 2023 to conduct large-scale credential-stuffing and brute-force attacks on edge network devices. The framework is specifically designed to target popular VPN and remote-access products such as SonicWall NetExtender, Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet SSL VPN, Citrix NetScaler, Microsoft RDWeb, and WatchGuard SSL VPN. 

Bad PyPI packages stole cloud tokens

Cybersecurity researchers discovered a malicious campaign on the PyPI repository, where threat actors have uploaded bogus libraries pretending to be "time" related utilities. These packages, however, contain hidden functionality designed to steal sensitive data such as cloud access tokens. ReversingLabs found 20 such packages, which have been cumulatively downloaded over 14,100 times. These packages have been removed from PyPI. The packages were divided into two sets. The first set was used to upload data to the threat actor's infrastructure, while the second set implements cloud client functionalities for services like Alibaba Cloud, Amazon Web Services, and Tencent Cloud. 

Credit card skimmer on WordPress site

Sucuri found a complex malware attack on a WordPress WooCommerce website, which involved a credit card skimmer, a hidden backdoor file manager, and a malicious script. The attack was designed for financial gain and long-term control of the server. The malware was communicating with two malicious IP addresses and domains, which have now been blocklisted. The impact of the malware could lead to financial loss, reputational damage, potential PCI compliance violations, loss of control, and SEO damage. 

Top Vulnerabilities Reported in the Last 24 Hours

Cisco patches IOS XR bug

Cisco has fixed a high-severity DoS vulnerability (CVE-2025-20115) in its IOS XR software that affects carrier-grade routers such as the ASR 9000, NCS 5500, and 8000 series when BGP confederation is configured. The vulnerability allows unauthenticated attackers to remotely crash the BGP process via a single crafted BGP update message, leading to memory corruption and a process restart. Cisco has released security patches for affected IOS XR versions and advises customers who cannot immediately apply the patches to limit the BGP AS_CONFED_SEQUENCE attribute to 254 or fewer AS numbers. 

Tomcat vulnerability exploited in the wild

A critical RCE vulnerability, identified as CVE-2025-24813, is being actively exploited in Apache Tomcat servers. This exploit allows attackers to take control of vulnerable servers with a single PUT API request. The vulnerability can be exploited under certain conditions, such as having servlet write enabled, using file session persistence with a default storage location, and the presence of a deserialization exploitation library in the application. The bug affects Apache Tomcat versions from 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.3, and 9.0.0.M1 to 9.0.98. Versions Apache Tomcat 11.0.3, 10.1.35, and 9.0.99 or later are not affected.

Top Scams Reported in the Last 24 Hours

Phishing campaign exploits GitHub

A phishing campaign has targeted approximately 12,000 GitHub repositories with false "Security Alert" issues, deceiving developers into authorizing a malicious OAuth app that gives attackers full control over their accounts and code. The phishing issue warns users of unusual activity from Reykjavik, Iceland, and advises them to update their password, review active sessions, and enable two-factor authentication. However, the links provided lead to a GitHub authorization page for a "gitsecurityapp" OAuth app that requests risky permissions. If a user authorizes the app, an access token is generated and sent back to the app's callback address. 

Large-scale Coinbase phishing campaign

A sophisticated phishing attack targeting Coinbase users is circulating, tricking recipients into setting up a new wallet using a pre-generated recovery phrase controlled by the attackers. The phishing email, which appears to pass email security checks, claims that Coinbase is transitioning to self-custodial wallets due to a court mandate. The email instructs users to import the provided recovery phrase into their new Coinbase Wallet. However, this recovery phrase is already known and controlled by the attackers, allowing them to steal any funds transferred into the new wallet.

Related Threat Briefings

Mar 14, 2025

Cyware Daily Threat Intelligence, March 14, 2025

A new ransomware group is making waves with tactics reminiscent of LockBit. Mora_001 has been exploiting Fortinet vulnerabilities to gain access to networks. Subsequently, it deploys its SuperBlack ransomware, ensuring persistent control before encrypting critical systems. GitLab users should patch now as critical authentication flaws surface. Two newly discovered GitLab vulnerabilities could allow attackers to impersonate users, potentially leading to data breaches and privilege escalation. Security updates have been released to mitigate the risk. Cybercriminals are faking Clop ransomware attacks to scam businesses. Fraudsters are posing as the Clop ransomware gang, fabricating extortion claims to trick victims into paying ransoms for non-existent data breaches.

Mar 13, 2025

Cyware Daily Threat Intelligence, March 13, 2025

A new spyware is lurking in fake apps, and it’s tied to North Korea. KoSpy, a newly discovered Android surveillance tool, is believed to be the work of APT37 and has been targeting Korean and English-speaking users. Distributed via Google Play Store and Firebase Firestore, the spyware could access a plethora of information. Juniper routers are being turned into stealthy backdoors. The Chinese threat group UNC3886 has infiltrated older Juniper MX routers, deploying customized TinyShell backdoors to evade detection. By accessing devices via terminal servers with legitimate credentials, the attackers bypassed Junos OS security protections, allowing persistent access to compromised networks. A widely used font library is now a security risk. Facebook has warned of a critical flaw in FreeType. The bug, caused by an out-of-bounds write, can lead to arbitrary code execution and has been exploited in attacks.

Mar 12, 2025

Cyware Daily Threat Intelligence, March 12, 2025

Copy, paste, and lose everything - MassJacker turns a simple action into a costly mistake. The operation leverages 778,000 fraudulent wallet addresses to siphon digital assets from unsuspecting victims. It has targeted victims by replacing copied cryptocurrency wallet addresses with those controlled by attackers. Exploited in the wild and patched just in time. Microsoft has released security updates fixing 57 vulnerabilities, including six zero-days actively exploited by attackers. The update also addresses 17 Edge browser vulnerabilities, reinforcing the critical need for immediate patching before these flaws can be leveraged for malicious purposes. A botnet is turning home routers into attack platforms, and there’s still no fix in sight. The Ballista botnet is actively exploiting a remote code execution flaw in TP-Link Archer routers, allowing attackers to inject commands without authentication. With thousands of compromised devices and growing, the botnet uses Tor domains for stealth and has been traced back to an Italian-based threat actor.

Mar 11, 2025

Cyware Daily Threat Intelligence, March 11, 2025

A new ransomware strain isn’t just locking up files, it’s locking out hope of recovery. Researchers uncovered EByte Ransomware, a Golang-based malware that’s actively targeting Windows systems with advanced cryptographic techniques, making decryption nearly impossible without the attackers' key. A simple-looking PDF is all it takes for attackers to hijack your system. A new malware strain, Phantom Goblin, is being spread through RAR attachments in phishing campaigns, tricking users into opening a malicious LNK file disguised as a document. It also abuses VSCode tunnels for remote access. Attackers don’t need new tricks when unpatched systems do the job for them. The CISA has flagged five new vulnerabilities under active exploitation, affecting Advantive VeraCore and Ivanti Endpoint Manager. The VeraCore flaw exploitation is linked to a likely Vietnamese threat group, while the Ivanti EPM vulnerabilities allow attackers to coerce credentials for further access.

Mar 10, 2025

Cyware Daily Threat Intelligence, March 10, 2025

When cybercriminals upgrade their arsenal, staying hidden becomes easier than ever. Several ransomware and cybercrime groups are leveraging the Ragnar Loader malware toolkit to maintain long-term access to compromised systems. Constantly evolving with new features, Ragnar Loader has become more modular and harder to detect. A single flaw in a widely used API almost handed attackers full control over vulnerable applications. The Volt API for Livewire recently patched a critical remote code execution vulnerability. The issue has been fixed in version 1.7.0, and users are strongly urged to update to prevent exploitation. A billion devices, a hidden backdoor, and tens of undocumented commands that could change everything. Security researchers have uncovered a major issue in ESP32 revealing 29 undocumented commands that attackers could exploit for spoofing devices, unauthorized data access, and long-term persistence. This vulnerability raises concerns over supply chain security, as OEMs could unknowingly ship compromised devices.

Mar 7, 2025

Cyware Daily Threat Intelligence, March 07, 2025

Step right up to the slickest show in the digital shadows, where EncryptHub is running the ring. This rising cybercrime crew is dazzling victims across platforms like QQ Talk, WeChat, and Google Meet with trojanized apps and clever multi-stage attack chains. They’re even teasing a new act called EncryptRAT to keep their audience on edge. Something wicked is crashing the WordPress party, and it’s not on the guest list. Over 1,000 sites have been slipped a nasty surprise, planting backdoors that swing wide open for hackers. These uninvited intruders are ready to sneak back in and turn the festivities into a free-for-all. These dusty old cameras are stealing the spotlight, but it’s a scene straight out of a cyber horror flick. A critical flaw in Edimax IC-7100 IP cameras has botnets buzzing with excitement, exploiting shaky default passwords. They’re staging a takeover, dropping Mirai malware to keep the chaos rolling.

Mar 6, 2025

Cyware Daily Threat Intelligence, March 06, 2025

Social media’s open doors are proving a playground for malware with a Middle Eastern twist. Desert Dexter, a sly campaign, has been hitting the Middle East and North Africa with a tweaked AsyncRAT. It’s hunting cryptocurrency wallets and chatting with a Telegram bot, spreading through legit file-sharing accounts and Telegram channels. A WordPress plugin’s chatty nature just turned into a hacker’s dream. A critical flaw in the Chaty Pro plugin, used by tens of thousands of websites, lets attackers upload malicious files thanks to lax security checks. Left unpatched, it’s a fast track to site takeovers. LinkedIn’s polished veneer is getting a malware makeover, and it’s a convincing act. Cofense spotted a campaign mimicking LinkedIn InMail, complete with branding and a sales director’s pitch for a quote - though the person’s real, the company’s fake. Those “Read More” and “Reply To” buttons? They’re a one-way ticket to the ConnectWise RAT, sidestepping the usual phishing playbook for something nastier.

Mar 5, 2025

Cyware Daily Threat Intelligence, March 05, 2025

The internet’s weakest links are turning into a cyber army with an Iranian twist. The new Eleven11bot botnet, loosely tied to Iran, has hijacked tens of thousands of IoT devices to unleash massive DDoS attacks on telecoms and gaming servers across the world. Booking a trip shouldn’t come with a side of malware, but here we are. A slick new campaign is sneaking LummaStealer onto devices worldwide through fake CAPTCHAs on booking websites, leveraging malvertising to snag victims in places like the Philippines and Germany with this info-stealing menace. Snail mail just got a sinister upgrade in the scam department. Fraudsters posing as the BianLian ransomware gang are mailing tailored ransom notes, demanding Bitcoin payments to keep “stolen” data under wraps. However, it’s a bluff and not a breach.

Mar 4, 2025

Cyware Daily Threat Intelligence, March 04, 2025

In a digital masquerade, attackers are wielding trust as a weapon to breach elite targets. A highly targeted phishing campaign has struck a few UAE entities in aviation and satellite communications, deploying a new backdoor called Sosano. Using a hijacked email account from an Indian firm, the attackers sent polyglot PDFs, designed to exploit multiple formats. Your smartphone might be a gateway to more than just selfies in this lawless digital frontier. Google’s latest Android Security Bulletin confronts 44 vulnerabilities, with two actively exploited flaws in Cisco and Windows systems that could hand attackers the keys to your device. Patches are rolling out fast to help lock things down. Sometimes a simple click can unravel a digital Pandora’s box. A new ClickFix campaign is luring victims into running malicious PowerShell commands. It installs the Havoc post-exploitation framework, granting attackers remote access to the compromised device.

Mar 3, 2025

Cyware Daily Threat Intelligence, March 03, 2025

In a digital game of cat and mouse, cybercriminals are upping their ante with a new trick up their sleeve. The Black Basta and Cactus ransomware groups have armed themselves with BackConnect malware to maintain persistent control over compromised machines and exfiltrate sensitive data. Once inside, BackConnect—linked to the infamous QakBot loader—takes the reins, ensuring the attackers keep their grip even after initial access. Phishing emails are casting a wider net, and this time, they’re impersonating the taxman. FortiGuard Labs has uncovered a new wave of cyberattacks targeting Taiwanese companies with the sophisticated Winos 4.0 malware. Spread through phishing emails, the malware arrives via a malicious attachment posing as a tax inspection list. Winos 4.0 is a modular menace, boasting of multiple functionalities. Even the smallest chip can have a big impact when it comes to security. MediaTek revealed 10 newly discovered vulnerabilities in its chipsets, which power smartphones, tablets, AIoT devices, and smart TVs. Affected chipsets include the MT67xx, MT68xx, and MT69xx series. MediaTek has issued patches to manufacturers.

Feb 28, 2025

Cyware Daily Threat Intelligence, February 28, 2025

Stay ahead of emerging cyber threats with the latest intelligence on the Vo1d botnet infecting Android TV devices, Redox Stealer spreading via GitHub, and a critical Better Auth vulnerability. Plus, insights on Mustang Panda and Lotus Blossom espionage campaigns, Nakivo backup software flaws, and scams hijacking Google Chrome extensions and PayPal checkout. Get the latest cybersecurity updates now!

Feb 26, 2025

Cyware Daily Threat Intelligence, February 26, 2025

It took just one cleverly disguised Batch script to outmaneuver security tools for over 48 hours, slipping past defenses with ease. A new malware delivery framework is making waves with its advanced obfuscation techniques, allowing it to remain undetected for an extended period. The malware, deploying either XWorm or AsyncRAT, operates almost entirely in memory, minimizing its footprint. The irony couldn’t be greater - an advanced security training platform now carries a critical vulnerability that lets attackers turn the tables. A severe RCE flaw has been discovered in MITRE’s Caldera, an open-source tool designed for simulating cyber threats. The vulnerability affects all versions except 5.1.0+ and the latest master branch, enabling attackers to take over systems remotely. A viral video you’ll regret clicking - scammers have found a new way to bait their victims. Researchers uncovered a surge in phishing campaigns that use fake viral video links to lure users into downloading malware. The attack starts with a deceptive PDF file claiming to contain a must-watch clip, but clicking the link sends victims down a rabbit hole of fake pages, intrusive ads, and misleading download buttons.