Cyware Monthly Threat Intelligence

The Good

Revolutionizing cybersecurity with innovative and adaptive measures, the Pentagon unveiled the first-ever strategy to protect the defense industrial base from cyber threats, emphasizing resilience and cooperation to defend critical infrastructure. Meanwhile, GitHub activated default push protection for public repositories to prevent accidental secret leaks online. Also, learn about the new 911 Cybersecurity Resource Hub by the CISA, SAFECOM, and NCSWIC, for Emergency Communications Centers (ECCs) across the country.

The Pentagon released its first cybersecurity strategy aimed at protecting the defense industrial base from cyberattacks. The strategy outlines goals and objectives to enhance cybersecurity and resilience within the supply chain, which consists of numerous entities contracting directly with the Pentagon. This initiative includes the Cybersecurity Maturity Model Certification program to raise standards among contractors.
The CISA, in collaboration with SAFECOM and NCSWIC, launched the 911 Cybersecurity Resource Hub. This initiative aims to provide ECCs across the nation with comprehensive cybersecurity resources to address their multifaceted cybersecurity needs. The hub serves as a centralized repository, streamlining access to essential resources and expertise sourced from federal agencies, industry partners, academia, and the private sector.
GitHub is implementing push protection as the default for all public repositories to prevent accidental leakage of secrets like API keys and tokens. The feature scans code commits for secrets and alerts developers if any are found. It has detected over one million leaked secrets this year alone. The feature supports over 200 token types and patterns from 180 service providers.

The Bad

The emergence of new cyber threats continued with SentinelOne discovering AcidPour, a Linux x86 variant of AcidRain. Meet a new PhaaS program dubbed Darcula that exploited over 20,000 domains for credential theft. Additionally, ESET unveiled a cyberespionage campaign by Evasive Panda targeting Tibetans. Amidst evolving spyware tactics, Insikt Group found Predator spyware infrastructure spanning 11 countries.

SentinelOne researchers identified a new variant of the data-wiping malware AcidRain, named AcidPour, specifically tailored to target Linux x86 devices. This ELF binary, distinct from previous iterations, is designed to erase content from RAID arrays and Unsorted Block Image (UBI) file systems. While the exact targets remain unclear, SentinelOne alerted Ukrainian agencies, highlighting the ongoing threat of wiper malware.
A new PhaaS named Darcula was found using nearly 20,000 domains to spoof brands and steal credentials from Android and iPhone users in more than 100 countries. Touted to offer over 200 templates, the kit has been used against various organizations, including financial, government, telecommunications, and airlines. These templates impersonate landing pages of multiple brands and use the correct local language, logos, and content to trick users.
Enterprises in the U.S. and Europe witnessed the emergence of the DoNex ransomware strain. The group behind it employed double-extortion tactics, encrypting files and exfiltrating sensitive data to further pressurize the victims into coughing up a ransom. While the attackers’ exact infiltration methods remain undisclosed, cybersecurity experts revealed that the group had already stolen data from at least five companies.
A cyberespionage campaign targeted Tibetans through a strategic web compromise and trojanized software, utilizing the Monlam Festival as a focal point for attacks, revealed ESET. The Evasive Panda APT group, with Chinese alignment, was identified as the likely perpetrator based on the use of MgBot and the newly discovered Nightdoor backdoor.
A new malware dubbed WogRAT was found using the online notepad platform, aNotepad, as a covert channel to target Windows and Linux systems. The Linux version of the malware, which comes in ELF form, shares similarities with the Windows variant. However, it distinguishes itself by utilizing Tiny Shell for routing operations and additional encryption in its communication with the C2 server. The malware has been targeting users in Japan, Singapore, China, Hong Kong, and other Asian countries.
Small business owners and self-employed individuals were being targeted by a tax scam, prompting them to apply for an IRS Employer Identification Number (EIN) through a fraudulent email. Scammers likely obtained email addresses from data brokers, seeking extensive personal information, including SSNs. There are telltale signs of the scam, such as errors in website setup.
Insikt Group unearthed a new infrastructure used by the operators of the Predator spyware in 11 countries. By analyzing the domains facilitating the spyware's delivery, potential Predator customers were identified in countries like Saudi Arabia, Egypt, and Kazakhstan. Predator grants access to sensitive data and leave minimal traces. The sophisticated spyware is distributed through spoofed websites and an anonymization network, making attribution challenging.
Researchers uncovered a new ransomware, named HelloFire, that disguises as legitimate penetration testing activities to trick users. Once executed, the ransomware appends the encrypted files with the ‘.afire’ extension and launches a ransom note in a ‘Restore.txt’ file. The encryptor is built as a Windows PE 32bit executable using Visual C++ and has a file size of 49.5KB.
Attackers exploited YouTube and Discord to infect Roblox users with a new info-stealer named Tweak. Based on PowerShell, the malware masquerades as a tool to enhance frames per second for Roblox users. Once executed, it would exfiltrate sensitive data like user information, location, Wi-Fi profiles, passwords, Roblox IDs, and in-game currency details. The stolen data is then sent via a Discord webhook to an attacker-controlled server.
Researchers warned about a new banking trojan, named CHAVECLOAK, that uses Smishing, phishing emails, and compromised websites to infect Brazilian banking users. The malware targets Windows devices and accesses online banking platforms to steal credentials and other financial information. In one such campaign, the attackers used phishing emails disguised as legitimate bank communications to trick users into downloading the malware.

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors. A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

The Good

The Bad

Related Threat Briefings

Jul 1, 2025