Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Aug 1, 2023

The Good

Significant advancements in cybersecurity measures have been made recently by the U.S. General Services Administration (GSA). It has taken two important steps: enhancing identity verification with a new program and allocating significant funds to fortify the cybersecurity posture of the Department of Labor and Environmental Protection Agency. In a notable move towards enhancing vulnerability assessment, the Forum of Incident Response and Security Teams (FIRST) has publicly launched CVSS 4.0.

  • The GSA released a new program roadmap to improve the identity and verification capabilities of Login[.]gov and comply with security standards. Meanwhile, the GSA’s Technology Modernization Fund set aside five new investments to improve the cybersecurity postures for the Department of Labor and Environmental Protection Agency. While the Labor Department will use $15.2 million for zero-trust architecture, the EPA will invest its $2.5 million into the security of its analytical radiation data system.

  • A new version of the Common Vulnerability Scoring System (CVSS 4.0), which solves the loopholes discovered in CVSS version 3.1, has been unveiled by the Forum of Incident Response and Security Teams (FIRST). Some of the improvements include the addition of new base metrics, a focus on OT/ICS/safety systems, and enhanced disclosure of impact metrics.

  • New regulations were proposed by the U.S. Federal Communications Commission to safeguard customer accounts from SIM switching and port-out scams. Under the proposed rules, wireless operators would have to deploy secure methods of user authentication before moving a SIM card to a new device or a phone number to a different network.

The Bad

In a series of alarming cyber incidents, multiple high-profile organizations have fallen victim to data breaches and cyberattacks, raising concerns over data security. The Egyptian Ministry of Health and Population experienced a massive data breach. Pepsi Bottling Ventures also suffered a significant breach, exposing the sensitive personal, financial, and health data of employees. The North Korean Lazarus hacking group orchestrated a daring $60 million cryptocurrency heist at Alphapo, leaving its mark on the digital world.

  • The Egyptian Ministry of Health and Population suffered a data breach wherein threat actors stole approximately two million records and offered them for sale on the Popürler hacking forum. The attackers provided a sample dataset of 1,000 people, containing their names, IDs, phone numbers, addresses, diagnosis details, and treatment information.

  • In a public announcement, Pepsi Bottling Ventures revealed that the personal, financial, and health information of over 28,000 employees was impacted in a data breach that occurred between December 23, 2022, and January 19, 2023. The incident was the result of attackers gaining unauthorized access to certain systems. The compromised data includes names, email addresses, ID numbers, Social Security numbers, medical history details, and health insurance information.

  • The North Korean Lazarus hacking group was found behind the $60 million cryptocurrency heist at Alphapo. The theft includes over 6 million USDT, 108k USDC, 100.2 million FTN, 430k TFL, 2.5k ETH, 1,700 DAI, and $37M of TRON and BTC, all of which were stolen from hot wallets, possibly using leaked private keys. The attack was carried out on July 23.

  • An analysis of nearly 20 million information-stealing malware logs revealed that approximately 400,000 corporate credentials are being sold on hacker forums and Telegram channels. Some of these belong to business applications such as Salesforce, Hubspot, Quickbooks, AWS, GCP, Okta, and DocuSign.

  • Yamaha’s Canadian music division confirmed dealing with a cyberattack after BlackByte and Akira ransomware groups claimed to have targeted the company. While BlackByte added the company’s name to its list of victims on June 14, Akira listed the company’s name on July 21. According to the official statement, the attack led to unauthorized access to systems and the theft of sensitive data.

  • Tampa General Hospital, Florida, revealed sensitive data of more than 1.2 million patients was stolen during an attempted ransomware attack in May. This sensitive information includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance information, and medical record numbers of patients. The electronic medical record system was not accessed by hackers, reported the hospital.

  • U.S. cosmetics conglomerate Estée Lauder suffered a cyberattack, with BlackCat and Cl0p claiming responsibility by adding the organization to their respective victims’ lists. The BlackCat group claimed that it stole more than 130GB of the company’s data but did not encrypt the network. The Cl0p group even added 62 clients of EY to its leak site, including 3TB of critical information such as client folders, passport scans, visa scans, risk and asset management documents, contracts, and agreements.

  • Nickelodeon suffered a data breach that allegedly caused the leak of 500GB of confidential data, including unreleased television shows, scripts, and other material. The leak is said to have originated from the ‘consumer products and experience’ portal and was initially detected in January on Discord.

  • Suncor Energy confirmed that an unauthorized party breached its IT network on or around June 21 to access the basic information of Petro-Points members. The company did not disclose how many members were affected but plans to notify customers if it finds out additional data was accessed.

  • An unprotected database was found exposing around 725.8GB of data, containing over 8 million records of users and employees. The database belonged to Poorvika, one of India’s largest tech retailers. The records contained personal information such as dates of birth, marital status, family dependencies, tax invoices, and more.

New Threats

Recent cybersecurity incidents exposed significant vulnerabilities across various software systems, raising concerns among organizations and users alike. Ivanti's Endpoint Manager Mobile (EPMM) was targeted by threat actors exploiting highly-critical bugs. Meanwhile, NoEscape, a rebranded version of Avaddon ransomware, wreaked havoc on enterprises through double extortion attacks, encrypting files on Windows, Linux, and VMWare ESXi servers. The emergence of new malware variants like Abyss Locker and CherryBlos/FakeTrade further added to the complexity of the cybersecurity landscape.

  • Software firm Ivanti disclosed a couple of security vulnerabilities affecting its Endpoint Manager Mobile (EPMM), which was exploited by threat actors in the wild. The vulnerabilities—CVE-2023-35081 and CVE-2023-35078—pose various threats such as allowing remote attackers to obtain PII, add an administrative account, change the configuration via authentication bypass, and even conduct arbitrary file writes to the EPMM server.
  • A rebranded version of Avaddon dubbed NoEscape surfaced in July that reportedly crippled multiple enterprises in double extortion attacks. Since its inception, the ransomware group has listed 10 different companies on its data leak site, from different verticals. It steals data and encrypts files on Windows, Linux, and VMWare ESXi servers.
  • MalwareHunterTeam reported a new variant of the Abyss Locker ransomware designed to target Linux-based VMware ESXi servers. It employs SSH brute-force attacks to gain unauthorized access to servers. The ransomware claimed data theft ranging from 35GB to 700GB from different organizations. Also, researchers suspect a connection with HelloKitty ransomware due to similar code elements.
  • Two related Android families, dubbed CherryBlos and FakeTrade, were found involved in cryptocurrency-mining and financially motivated scam campaigns targeting Android users. While CherryBlos was distributed via fraudulent services on popular social media platforms, FakeTrade leveraged fake money-earning apps for propagation.
  • A new and insidious cybersecurity threat named P2PInfect was seen exploiting vulnerabilities within Redis servers to move laterally through networks. It exhibits cross-platform capabilities, targeting both Linux and Windows systems. The Windows variant of P2PInfect includes a Monitor component for self-updating and launching the new version.
  • Dark.IoT, a Mirai variant, and Katana botnets targeted a command injection vulnerability (CVE-2023-28771) in Zyxel firewalls to launch DDoS attacks. The attackers utilized tools such as curl or wget to download scripts for further actions. These scripts were tailored for the MIPS architecture and downloaded from several distinct IP addresses.
  • A new malware, dubbed Realst, was spotted targeting macOS systems. It was being distributed via websites hosting fake blockchain games such as Brawl Earth, WildWorld, Dawnland, Destruction, Evolion, Pearl, and SaintLegend. It is capable of emptying crypto wallets and stealing stored passwords and browser data. So far, there are 16 distinct variants of Realst that are fairly similar to each other, however, utilize different API call sets.
  • Over 900,000 devices were found vulnerable to an arbitrary code execution flaw in MikroTik RouterOS. The bug, tracked as CVE-2023-30799, impacts RouterOS versions before 6.49.7 and RouterOS long-term versions through 6.48.6. An attacker can abuse the flaw to escalate privileges from admin to super-admin on the Winbox or HTTP interface. The flaw was addressed with the release of the stable version of 6.49.7.
  • Sysdig researchers reported a sophisticated hacking operation, dubbed Scarleteel 2.0, targeting AWS Fargate environments. Threat actors exploited a minor mistake in AWS policy to gain control over a Fargate account. Some Jupyter Notebook containers deployed in a Kubernetes cluster have also been abused, allowing actors to proceed with different types of attacks to steal AWS credentials.
  • Cyble’s threat analysts revealed that over 130,000 photovoltaic (PV) monitoring and diagnostic systems are exposed online, making them potential targets for cyberattacks. These products are from various vendors such as Solar-Log, Danfoss, Contec, SMA Solar Technology, and Saj Electric. While PoC exploit codes for vulnerabilities impacting several of these solar products are available online, a few of these products are inadequately secured.
  • Researchers at Wiz detected a new fileless malware dubbed PyLoose that targets cloud workloads. Evidence showed that the malware was spotted in 200 different instances of cryptojacking attacks. It includes a compressed and encoded precompiled XMRig miner that is dropped directly into memory using a known Linux fileless technique.

Related Threat Briefings

Mar 4, 2025

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.