The Good

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting.

• The U.K government announced a new scheme called "Cyber Local" to enhance the nation's cyber resilience. It involves £1.9 million ($2.3 million) in funding for 30 projects across England and Northern Ireland, aiming to address cyber skills shortages and protect the digital economy. The initiatives will focus on bolstering local business resilience, promoting cybersecurity careers for young people, supporting neurodiverse talent, and upskilling small business workers. Additionally, a project in the West Midlands aims to protect women and girls from cyber-related violence. 
• The White House launched the "U.S. Cyber Trust Mark," a voluntary cybersecurity labeling program for internet-connected devices. Administered by the FCC, the program aims to help American consumers make informed decisions about the cybersecurity of products they bring into their homes, such as baby monitors and security systems. The program involves testing products against cybersecurity criteria and awarding a distinct label to those that meet the standards.
• The Indian government released a draft Digital Personal Data Protection Rules, aiming to give citizens greater control over their personal data. The rules require companies to provide clear information on data processing, implement security measures, and comply with various provisions, including breach reporting and data erasure. There are also guidelines for processing data of children and persons with disabilities, as well as requirements for cross-border data transfers. Violations can result in substantial penalties. 
• Iran and Russia signed an agreement that aims to deepen their military, security, and technological ties, including cooperation in cybersecurity and internet regulation. Both countries have a history of restricting internet freedom and are seeking greater control over the global digital space. The deal formalizes their existing close relationship and involves collaboration on cybersecurity, telecommunications, and the exchange of Russian technology to Iran.

The Bad

Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware, using secure-looking download links to exfiltrate data while evading detection.

• Researchers unveiled a surge in attacks leveraging SparkRAT, a cross-platform Remote Access Trojan (RAT) written in GoLang. This open-source tool, initially released on GitHub in 2022, has become a favorite among hackers due to its modular design, and multi-platform feature. This malware is used against macOS users and government bodies. SparkRAT connects to C2 servers via WebSocket and HTTP POST requests. In 2024, links to a North Korean cyber espionage campaign were also found. 
• Over 10,000 WordPress websites have been hijacked to spread malware aimed at macOS and Windows users. Attackers exploited vulnerabilities in outdated WordPress software and plugins to deliver malware through fake browser update pages shown in an iframe. The campaign uses two types of malware: AMOS, which steals private information from macOS users, and SocGholish, which targets Windows users by tricking them into installing it under the guise of a fake update. This is the first known instance of these variants being delivered through a client-side attack. 
• Trend Micro's investigations uncovered a campaign distributing Lumma Stealer through GitHub, with attackers exploiting GitHub's release infrastructure. This campaign involved various malware like SectopRAT, Vidar, and Cobeacon. The attackers used GitHub for initial access, downloading files from secure URLs to exfiltrate data and connect to external C&C servers for executing commands discreetly. Lumma Stealer and other malware variants used techniques like PowerShell scripts and Shell commands for persistence and data exfiltration. The tactics used in the incidents were similar to those of the Stargazer Goblin group, which utilizes compromised websites and GitHub for payload distribution.
• Researchers unearthed a campaign targeting PHP-based web servers to promote gambling platforms in Indonesia. These attacks use Python-based bots and deploy GSocket to maintain communication with compromised servers. These servers, mainly running the Moodle LMS, are used to push PHP files promoting online gambling. The nefarious activities include creating unauthorized administrator accounts, installing rogue plugins, and stealing credentials. It's advised to keep plugins updated, block rogue domains, and remove suspicious admin accounts or plugins. 
• Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia have been targeted by a China-linked threat actor called RedDelta to deliver a modified version of the PlugX backdoor between July 2023 and December 2024. RedDelta reportedly compromised the Mongolian Ministry of Defense in August 2024 and the Communist Party of Vietnam in November 2024. They also targeted victims in Malaysia, Japan, the U.S., Ethiopia, Brazil, Australia, and India from September to December 2024. Known for refining its infection methods, RedDelta has used Windows files as part of spear-phishing attacks to deploy PlugX through various techniques.
• Threat actors have developed a fake PoC exploit targeting a critical Microsoft vulnerability to trick security researchers into downloading information stealing malware. This fake PoC is linked to a vulnerability in Microsoft’s Windows LDAP, which was patched in December 2024. Attackers created a malicious repository hosting the fake PoC, which, when run, drops a PowerShell script that creates a Scheduled Job, collects computer information, and uploads data to an external FTP server.
• CrowdStrike has detected a phishing campaign impersonating the company with fake job offer emails. The emails direct targets to download a fake "employee CRM application" from a malicious website designed to look like CrowdStrike's portal. If the target passes sandbox checks, the application tricks them into installing a Monero cryptocurrency miner. The miner runs in the background to avoid detection, and persistence is achieved through a startup script and registry entry.
• Socket discovered malicious npm packages designed to steal Solana private keys and transfer them via Gmail. The packages masquerade as legitimate tools to avoid detection, but actually function as malware. Two threat actors are involved in this scheme, using overlapping tactics to steal and exfiltrate private keys, while also draining victims' Solana wallets. The attackers use Gmail to send the stolen keys, making it harder to detect the exfiltration attempts. They also published malicious code on GitHub repositories to amplify their malware campaign.
• The CISA added three vulnerabilities affecting Mitel MiCollab and Oracle WebLogic Server to its KEV catalog, noting evidence of active exploitation. The vulnerabilities include CVE-2024-41713 (CVSS score: 9.1), allowing unauthorized access to Mitel MiCollab and CVE-2024-55550 (CVSS score: 4.4), enabling authenticated administrators to read local files. CVE-2020-2883 (CVSS score: 9.8) could be exploited by unauthenticated attackers on Oracle WebLogic Server. Federal agencies must apply necessary updates by January 28.
• Researchers at Socket have found malicious campaigns using Out-of-Band Application Security Testing (OAST) techniques. While OAST is meant for ethical hackers to find vulnerabilities, it is now exploited by threat actors to steal sensitive data and set up C2 channels. OAST tools like Burp Collaborator and interact.sh are being misused for malicious purposes. Socket's report mentions threats involving JavaScript, Python, and Ruby packages that send data to attacker-controlled sites.

New Threats

Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

• A new wave of cyberattacks using the Coyote banking trojan is focused on financial firms in Brazil. This advanced malware uses harmful Windows LNK (shortcut) files to run PowerShell scripts, allowing data theft and system compromise. The attack starts with an LNK file that executes a PowerShell command to connect to a remote server to download further malware. Coyote establishes secure communication with C2 servers, performs keylogging, and takes screenshots. To defend against these threats, avoid opening unknown LNK files, keep antivirus programs updated, monitor registry changes, and use endpoint detection tools.
• A recent phishing campaign targeted users of Microsoft's advertising platform using malicious Google Search ads to rob their login details. Although Microsoft does buy ad space on Google, these ads bear harmful links from impostors. The phishing effort persisted for two years, bypassing Google’s security checks. Genuine users are shown a verification challenge via Cloudflare before reaching the phishing page, which imitates Microsoft’s site.
• A new Mirai-based botnet, named Gayfemboy, has become more advanced, using zero-day exploits for security flaws in industrial routers and smart home devices. One notable vulnerability is CVE-2024-12856, found in Four-Faith industrial routers, with exploitation efforts spotted around December 20. It has about 15,000 active bot nodes daily, primarily in countries like China, the U.S., Russia, Turkey, and Iran. The botnet's main aim is to carry out distributed DDoS attacks for profit, with activity spiking in October and November 2024. The botnet leverages a mix of public and private exploits for over 20 vulnerabilities and is capable of high-intensity DDoS attacks exceeding 100 Gbps.
• Cybersecurity researcher MrAle_98 uploaded a proof-of-concept (PoC) exploit on GitHub for a high-risk zero-day flaw, CVE-2024-49138, in the Windows Common Log File System (CLFS) Driver. This flaw lets hackers obtain SYSTEM privileges on impacted devices. Microsoft confirmed it was exploited in the wild before the patch. The flaw impacts various Windows systems, particularly tested on Windows 11 23H2. This publicly available flaw increases risks for unpatched systems, urging quick action for updates. Microsoft addressed this zero-day in its December 2024 Patch Tuesday release.
• ESET researchers have found a supply chain attack on a South Korean VPN provider by a new China-linked APT group called PlushDaemon. The attackers replaced the legitimate installer with a malicious one that installed their custom backdoor, SlowStepper. This backdoor has a complex toolkit with over 30 components and has been used for espionage since at least 2019 against targets in several countries. PlushDaemon also gains access by hijacking legitimate updates of Chinese apps and exploiting vulnerabilities in web servers. 
• Sophos spotted two campaigns involving two groups of threat actors using Microsoft’s Office 365 platform to access organizations, likely aiming to steal data and install ransomware. The threats are identified as STAC5143 and STAC5777. STAC5777 has connections with the threat group Storm-1811, while STAC5143 is a new threat cluster mimicking Storm-1811, possibly linked to a group known as FIN7, Sangria Tempest, or Carbon Spider. Common tactics include email-bombing, where high volumes of spam overwhelm inboxes, and fake tech support messages sent via Teams. 
• A sophisticated social engineering scheme is targeting customers in the Middle East, where fraudsters impersonate government officials to gain trust and use remote access software to steal credit card details. The victims are typically individuals who have lodged complaints with the government about unsatisfactory purchases. The fraudsters exploit this by posing as government representatives offering assistance with the complaints and then tricking victims into installing remote access software. Once the software is installed, the fraudsters steal credit card information and intercept OTPs to make fraudulent transactions. The scheme involves the use of RedLine Stealer malware to acquire victims' personal data.
• Cybercriminals have been found using a new WordPress plugin called PhishWP to create fake payment pages resembling trusted services like Stripe. The plugin tricks users into entering their payment details, including one-time passwords, and then sends the stolen information to attackers, often in real time. PhishWP also sends fake confirmation emails to victims to delay detection. It offers a range of advanced features, such as customizable checkout pages, 3DS code harvesting, real-time data transfer, browser profiling, fake confirmation emails, multi-language support, and obfuscation options.
• BARWM is a new backdoor attack method for deep learning models used in mobile devices. It utilizes DNN-based steganography to create imperceptible and unique triggers for each input, enhancing the stealthiness of the attack. The approach outperforms existing methods in terms of attack success rate and stealthiness, while maintaining normal model performance.
• A new online scam is targeting people through direct messages on Discord, asking if they would like to beta test a new videogame. The message often pretends to come from the game's developer. If someone shows interest, they receive a download link and a password for an installer. Various types of installers, like NSIS and MSI, are used to spread different malware, including the Nova Stealer, Ageo Stealer, and Hexon Stealer.
• The Fancy Product Designer plugin for WordPress is vulnerable to two critical security flaws. CVE-2024-51919 allows unauthenticated users to upload harmful files due to insecure file upload functions. CVE-2024-51818 is an SQL injection issue from improper user input handling that can compromise databases. Despite being notified about the issues, Radykal has not responded or released a security update, leaving over 20,000 users at risk.
• The Illumina iSeq 100 DNA sequencing instrument has been found to have firmware security vulnerabilities, allowing potential attackers to brick the device or plant persistent malware. The outdated BIOS firmware lacks standard protections such as Secure Boot, making it susceptible to malicious firmware modifications. Illumina has released a fix after responsible disclosure.