The lines between digital espionage and warfare blur as state-sponsored threat actors employ increasingly advanced methods to compromise their targets. China’s APT41 has launched a cyberespionage campaign targeting organizations in South Asia, utilizing the DeepData Framework. This Windows-based toolkit consists of 12 malicious plugins that are designed to harvest a wide range of sensitive data.

Meanwhile, the Lazarus Group has turned its sights on macOS users with a new malware strain, RustyAttr. Built using the Tauri framework, the malware exploits extended file attributes to execute a malicious shell script that loads a Rust-based backend via a fake webpage.

In another wave of attacks, a critical zero-day vulnerability is being exploited to target Windows systems in Ukraine. This vulnerability allows attackers to take control of systems when users interact with malicious URL files delivered through phishing emails.

Top Malware Reported in the Last 24 Hours

APT41 deploys new toolkit

APT41, a threat group from China, is using a sophisticated Windows-based surveillance toolkit in a cyberespionage campaign targeting organizations in South Asia. The toolkit, called DeepData Framework, consists of 12 separate plugins optimized for malicious functions. These plugins steal communications from various messaging apps, system information, browsing history, cookies, passwords, audio files, and more.

New RustyAttr malware targets macOS

Threat actors are using a new method on macOS to spread a malware called RustyAttr, which is linked to the Lazarus Group from North Korea. The malware is built using the Tauri framework and includes an extended attribute that runs a shell script. When executed, a decoy distraction is displayed. The shell script executes a Rust backend via a malicious JavaScript loaded on a fake webpage. 

WIRTE APT continues cyberespionage operations

The WIRTE APT group, associated with the Hamas-affiliated group Gaza Cybergang, has continued its attacks in the Middle East. It has expanded its focus from espionage to disruptive attacks while targeting entities in the Palestinian Authority, Jordan, Iraq, Egypt, and Saudi Arabia. Researchers uncovered a connection between the malware used by WIRTE and SameCoin, a wiper malware that attacked Israeli targets in 2024. The APT group has also included hack-and-leak operations and is using cyber capabilities to shape narratives.

Top Vulnerabilities Reported in the Last 24 Hours

Windows 0-day exploited in the wild

A critical zero-day vulnerability, CVE-2024-43451, has been actively exploited to target Windows systems, particularly those in Ukraine. The vulnerability allows attackers to gain control of a system through actions such as right-clicking on a malicious file. It affects various versions of Windows and is triggered by interacting with specially crafted URL files. The attackers distribute these files through phishing emails, leading to the download of additional malicious payloads, including the SparkRAT malware. Ukrainian authorities have attributed the attacks to a Russian-linked threat actor, and Microsoft has released a security patch to address the vulnerability.

GitLab patches critical flaws

GitLab released critical security updates for its Community Edition (CE) and Enterprise Edition (EE) to fix vulnerabilities that could lead to unauthorized access to Kubernetes clusters and other exploits. The latest patched versions are 17.5.2, 17.4.4, and 17.3.7, and users are strongly urged to upgrade immediately. The most severe issue is a high-severity vulnerability (CVE-2024-9693) that could allow unauthorized access to Kubernetes cluster agents. Other vulnerabilities include issues related to device OAuth flow, DoS via FogBugz import, stored XSS in Analytics Dashboards, HTML injection leading to XSS, and information disclosure via API.