Threat Research | Weekly Recap [09 Nov 2025]

Cybersecurity Threat Research ‘Weekly’ Recap. Adversaries persist with phishing, credential theft, supply-chain compromises, and AI-enabled threats, targeting individuals, organizations, and critical infrastructure across multiple sectors. The report highlights notable campaigns, new backdoors, ransomware evolutions, vulnerabilities, and the increasing use of AI for malware development, detection evasion, and incident response improvements.
#Tycoon 2FA #Fake DMCA #RaccoonO365 #Booking.com “I Paid Twice” #AdE crypto-tax phishing #Bank of Italy phishing #Remcos #SleepyDuck #Gootloader #LANDFALL #Fantasy Hub #Cephalus #Midnight ransomware #DragonForce #MuddyWater #SesameOp #OpenAI C2 #Balancer #Great Firewall

Adversaries used AiTM proxies, reverse proxies, and forged legal notices to steal session tokens and bypass MFA across Microsoft/Gmail and other services. Tycoon 2FA kit.
Phishing-as-a-Service operations and fake takedowns harvested credentials and distributed malicious downloads via rotating domains and certificates. Fake DMCA domains.
Cloudflare/Microsoft takedown exposed a PaaS phishing operation that stole >5,000 credentials and crypto, revealing hundreds of related domains and IPs. RaccoonO365 takedown.
Targeted hotel campaign used compromised Booking.com accounts and ClickFix lures to deploy PureRAT and harvest guest/banking details for follow-on fraud. Booking.com “I Paid Twice”.
Multiple campaigns impersonated Italian institutions (Revenue Agency, Bank of Italy) to collect personal and wallet data and trick victims into connecting wallets. AdE crypto-tax phishing · Bank of Italy phishing.
Analysis of non-English phishing found cloud-file hosts widely abused and strong language/regionality in malware delivery (Remcos, Loda, KrBanker, Portuguese-specific families). International phishing URLs.

Nine NuGet packages delivered time‑delayed destructive payloads targeting PLCs and industrial writes (Sharp7Extend notable for PLC sabotage). Malicious NuGet packages.
Multiple npm incidents: a MUT‑4831 campaign trojanized SDK‑style packages to deliver Vidar, plus typosquatted packages and other postinstall infostealers using obfuscation and PyInstaller binaries. MUT‑4831 Vidar (npm) · npm typosquats credential harvester.
Supply‑chain runtime detection analysis showed Shai‑Hulud-style postinstall infostealers abusing CI/CD tokens; eBPF/runtime sensors recommended to catch install‑time abuse. Runtime detection for supply chain.

A Brazilian Loader‑as‑a‑Service (Caminho) uses LSB steganography to hide .NET loaders in images and deliver REMCOS, XWorm, Katz Stealer via multi‑stage phishing. Caminho loader (LSB stego).
Malicious VSX/VS Code extension used an Ethereum smart contract to update its C2 address, enabling resilient RAT behavior and sandbox evasion at scale. SleepyDuck VSX.
Gootloader resurfaced with WOFF2 glyph obfuscation and XOR ZIPs via compromised WordPress comments, enabling rapid post‑intrusion lateral movement and ransomware handoffs. Gootloader resurgence.
New Android threats: LANDFALL exploited a Samsung image‑processing zero‑day to deliver commercial spyware; Fantasy Hub and other banking Trojans abuse SMS/Accessibility and native droppers for espionage and fraud. LANDFALL Android spyware · Fantasy Hub RAT · Android banking Trojans.

MuddyWater used compromised mailboxes and macro loaders to deploy FakeUpdate → Phoenix backdoor plus credential stealers and RMM tools against MENA governments. MuddyWater — Phoenix.
Multiple nation‑linked clusters targeted policy/influence organizations and academics using DLL sideloading, legitimate binaries, COM hijacking, GitHub/statcounter C2, and custom loaders. China‑linked intrusions · UNK_SmudgedSerpent (Iranian‑linked) · APT‑C‑60 update.
COLDRIVER replaced older tooling with new backdoors (NOROBOT/YESROBOT/MAYBEROBOT) and refined delivery (ClickFix CAPTCHA lure + rundll32) to target high‑value individuals. COLDPRIVER toolset expansion.
Silent Lynx spear‑phishing deployed multiple implants (PowerShell shells, Laplas, SilentSweeper) targeting diplomatic and infrastructure entities across Central Asia and beyond. Operation Peek‑a‑Baku (Silent Lynx).
Microsoft DART uncovered a novel backdoor abusing the OpenAI Assistants API as a covert C2 channel using .NET AppDomainManager injection and layered obfuscation. SesameOp (OpenAI C2).

Cephalus (Go‑based) performs identity‑driven intrusions via exposed RDP, exfiltration, backup deletion, and targeted encryption with anti‑analysis artifacts. Cephalus ransomware.
A Babuk offshoot “Midnight” had cryptographic flaws enabling creation of a working decryptor; incident highlights importance of cryptographic review for ransomware samples. Midnight ransomware (recoverable).
Conti‑derived DragonForce operates as a cartel/RaaS with BYOVD driver abuse to disable security, wide affiliate model, and hundreds of victims. DragonForce cartel.
Recorded Future recommends shifting to intelligence‑driven, ML/behavioral detections and automation to combat accelerating RaaS/AI/identity threats. Ransomware detection guidance.

Three runc vulnerabilities enable container escape via maskedPaths, /dev/console mount races, and procfs write redirection; update runc and prefer rootless/user namespaces. runc container‑escape CVEs.
Check Point found Windows GDI EMF+ flaws leading to RCE and memory disclosure; Microsoft released patches across 2025 updates. Windows GDI vulnerabilities.
An attacker exploited a rounding/precision bug in Balancer V2 to drain $128.64M across chains using micro‑swaps and vault balance manipulation. Balancer $128M rounding exploit.

GTIG reports increased adversary use of LLMs to generate dynamic, polymorphic malware (e.g., PROMPTFLUX, PROMPTSTEAL) and documents mitigations Google used. GTIG AI threat tracker.
SentinelLABS and others found thousands of LLM‑enabled malware samples; hunting for hardcoded provider keys/prompt artifacts is an effective detection path. LABScon25 — LLM‑enabled malware.
Researchers used generative AI to accelerate reverse engineering of heavily obfuscated XLoader, cutting triage/deobfuscation time from days to hours while retaining human validation. AI‑accelerated reverse engineering.

Leaked 500GB Great Firewall dataset reveals a modular DPI/orchestration ecosystem (TSG, MAAT, JA3/SNI fingerprinting, sinkholing/BGP hijacks) used to detect and disrupt circumvention tools and integrate telemetry into broader surveillance systems. Great Firewall leak — technical infra.

Cybercriminals targeted trucking/logistics by compromising load‑board accounts and deploying RMM tools to reroute or steal cargo, abusing ScreenConnect, SimpleHelp, PDQ Connect and others. Trucking & logistics RMM abuse.
Web/SEO spam campaigns compromised WordPress sites to inject cloaked casino pages and resilient payloads (DB‑stored payloads, .dat files, theme/plugin changes) to push gambling spam. Slot Gacor — casino SEO spam.
Analysis of supply‑chain and malware trends highlights abuse of cloud/file hosts, CI/CD tokens, and attacker use of commodity RMM and tunneling tools in targeted campaigns. Supply‑chain & tooling trends.