Threat Research | Weekly Recap [24 Aug 2025]

hendryadrian.com

hendryadrian.com

Ransomware & extortion

• Rapid SharePoint RCE exploitation leading to enterprise-wide encryption and exfiltration; actor deployed the WarLock toolkit and leveraged SYSTEM privileges for lateral movement. WarLock: From SharePoint Exploit to Ransomware — TrendMicro
• New RaaS with advanced anti-analysis, UAC bypasses and expanded exfiltration options; operator markets builder/subscription services. Bqtlock Ransomware & Variants — K7 Labs
• Evolved RaaS family targeting Windows/Linux/ESXi with TOR leak sites and advanced obfuscation (Boramae-related variant noted). Beast Ransomware Profile — SOCRadar

Backdoors, loaders & modular frameworks

• Campaigns using fake CAPTCHA (ClickFix) lures and PowerShell/JS droppers to deliver the Node.js/PHP CORNFLAKE.V3 backdoor with AD reconnaissance and Kerberoasting. Cornflake V3 Backdoor — Google Cloud
• Modular named‑pipe backdoor masquerading as trojanized ChatGPT apps; exploits CVE-2025-29824 and manages in-memory modules for payload/injection. PipeMagic Analysis — Microsoft
• New and stealthy loaders/botnets: QuirkyLoader (.NET side‑loading/process hollowing delivering multiple RATs/stealers) and stealth Java loader “SoupDealer” used in targeted phishing. QuirkyLoader — IBM X‑Force
• Delphi x86 implant using heavy obfuscation, anti‑analysis and persistence for surveillance/exfiltration. DBatLoader. DBatLoader — DeepInstinct
• Novel Linux persistence/backdoor masquerading as PAM library to provide stealthy SSH auth bypass and persistence. Plague. Plague Linux PAM Backdoor — PolySwarm
• New Gh0st-based RAT targeting finance, uses steganography for shellcode and downloads plugins/password stealers; tracked as GodRAT. GodRAT — Kaspersky Securelist

Phishing, credential theft & PhaaS

• Spoofed SendGrid emails and open-redirects lure victims to credential harvesters capturing account logins. SendGrid-themed Credential Harvesting — Cofense
• AI website builder abused at scale for phishing, MFA/AiTM and crypto drainers; tens of thousands of malicious URLs observed. Lovable AI Abuse for Phishing — Proofpoint
• New Phishing-as-a-Service framework (Salty 2FA) uses multistage obfuscated JS and domain patterns to steal Microsoft 365 creds and bypass 2FA. Salty 2FA Technical Analysis — ANY.RUN
• High‑value social‑engineering group Scattered Spider (UNC3944) continues to evolve phishing kits (Evilginx‑style) and targeting of corporate accounts. Scattered Spider Profile — DarkAtlas
• Large smishing wave impersonating UK gov services with short‑lived domains and token/websocket exfiltration behavior. UK GOV PCN/Winter Fuel Smishing — Validin
• Targeted stealer campaigns (copyright/corporate footprint lures) that focus on browser cookies and social accounts; Noodlophile evolution noted. Noodlophile Stealer — Morphisec
• Affiliate ecosystems monetizing stolen data (Lumma, Vidar, Stealc) with proxy/VPN/antidetect enablers—monitor exfiltration and underground forums. Lumma Affiliate Ecosystem — Recorded Future
• JavaScript keyloggers injected into Exchange auth pages exfiltrate creds via HTTP/Telegram/DNS—watch /owa/auth/logon.aspx modifications. Exchange JS Keyloggers — PT ESC
• VPS abuse to enable stealthy SaaS compromises (inbox rules, MFA bypass, token theft) and large-scale phishing footholds. SaaS Hijacks via VPS Abuse — Darktrace

Mobile & endpoint threats

• Android banking trojan Anatsa/TeaBot expanded targets (831+ apps), uses runtime DES decryption, device checks, and Google Play decoys for updates. Anatsa (TeaBot) Updates — Zscaler
• Sideloaded APK droppers delivering AndroidOS SpyNote RAT via cloned Play Store pages and DEX injection with anti‑analysis. SpyNote Malware — DomainTools
• NFC‑relay Android malware targeting Brazilian banking (tap-to-pay fraud) delivered via fake Play pages; affiliate MaaS model. PhantomCard. PhantomCard NFC Relay — Zimperium
• APK lure impersonating Indian energy subsidy scheme to steal UPI credentials and SMS; repo/FCM mitigations applied. Android “Energy Subsidy” Stealer — McAfee
• macOS malvertising and one‑liner installers delivering SHAMOS (AMOS variant) to steal Keychain/notes—CrowdStrike Falcon blocked widespread attempts. SHAMOS on macOS — CrowdStrike
• Rooting/jailbreak frameworks (KernelSU, Magisk, APatch) have exploitable weaknesses that can let malicious apps gain full device control. Rooting Framework Risks — Zimperium

Abuse of legitimate tools, supply-chain & monetization schemes

• Phishing campaign used a fake digital‑signature patch to install legitimate remote‑management tool Action1 for unauthorized remote access. Fake Action1 Patch — CERT‑AGID
• Fake YouTube downloader pages distributing Proxyware installers (WinMemoryCleaner droppers) that install clients like HoneyGain/Infatica and run scheduled Node.js/PowerShell tasks. Proxyware Distribution via Fake Downloader — AhnLab
• Attackers exploiting GeoServer RCE (CVE‑2024‑36401) to deploy SDKs/apps that covertly sell victims’ bandwidth as residential proxies. SDK Abuse to Monetize Bandwidth — Unit42
• Open‑source ecosystem abuse: malicious Go module masquerading as SSH brute‑forcer exfiltrates first‑success creds to a Telegram bot. Malicious Go Module — Socket
• Large-scale trojan campaign force‑installs malicious Chrome/Edge extensions via fake installer sites, scheduled tasks and registry/policy abuse—>300k+ affected. Extension Trojans via Fake Installers — ReasonLabs

Notable APT & targeted campaigns

• APT36 campaigns against Indian targets used weaponized .desktop files and Google Drive droppers to deliver Go-based ELF payloads targeting BOSS Linux systems (WebSocket C2s observed). APT36 Targeting BOSS Linux — Cyfirma
• Persistent campaign (UAC‑0057 / UNC1151) deploying weaponized XLS (obfuscated VBA) against Ukraine/Poland with DLL implants and web C2s. UAC‑0057 Targeting Ukraine & Poland — HarfangLab
• Long‑running Russian espionage group Static Tundra abuses EoL/unpatched network gear (Cisco Smart Install/CVE‑2018‑0171) to steal configs and maintain long-term access. Static Tundra (FSB-linked) — Talos
• EncryptHub operation combining social engineering, Teams-based remote access, and exploitation of CVE‑2025‑26633 to deliver backdoors and steal data. EncryptHub Campaign — Trustwave SpiderLabs

Vulnerabilities, cloud & infra research

• AWS Resource Explorer ListResources allowed quiet resource enumeration because it wasn’t CloudTrail‑logged by default; AWS reclassified it as a management event after disclosure. CloudTrail‑free AWS enumeration — Datadog
• SQL injection in a reference Postgres MCP server could chain stacked statements (e.g., COMMIT; DROP SCHEMA) enabling arbitrary writes; patches released in forks. MCP Postgres SQLi Case Study — Datadog
• Research into programmatic start of the WebClient service shows multiple vectors but a final ETW consumer descriptor limits remote start without elevated token conditions—relevant to NTLM relay mitigations. Will WebClient Start? — SpecterOps

Cryptojacking & illicit mining

• Long-running cryptomining group TA‑NATALSTATUS exploits exposed Redis instances to gain root and deploy rootkit‑style miners that kill rival miners and persist across thousands of hosts. TA‑NATALSTATUS Cryptojacking Dossier — CloudSEK

Threat Research | Weekly Recap – hendryadrian.com