SecuriTricks - 2025-06-06

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

cobalt strike

CVE-2024-1709

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct var…

Published: June 6, 2025

Downloadable IOCs: 969

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

APT37, a North Korean state-sponsored hacking group, launched a spear phishing campaign targeting activists focused on North Korea. The attack involved emails with Dropbox links to malicious LNK files, which when executed, activated additional malware. The group utilized legitimate cloud services a…

Published: June 6, 2025

Downloadable IOCs: 1

Threat Analysis: DCRat presence growing in Latin America

Hive0131 is conducting email campaigns targeting users in Colombia with fake electronic notifications of criminal proceedings, purportedly from The Judiciary of Colombia. The campaigns deliver DCRat, a banking trojan operated as Malware-as-a-Service, through embedded links or PDF lures. DCRat's pre…

Published: June 6, 2025

Downloadable IOCs: 3

BladedFeline: Whispering in the dark

ESET researchers have uncovered a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has been targeting Kurdish and Iraqi government officials since at least 2017, using various malicious tools including reverse tunnels, backdoors, and a ma…

Published: June 6, 2025

Downloadable IOCs: 3

Abusing Paste.ee to Deploy XWorm and AsyncRAT Across Global C2 Infrastructure

A sophisticated malware campaign has been discovered utilizing paste.ee to distribute XWorm and AsyncRAT. The attackers employ obfuscated JavaScript with Unicode characters to download and execute malicious code from paste.ee URLs. The infrastructure includes multiple C2 servers across Europe and t…

Published: June 6, 2025

Downloadable IOCs: 12

Tag: 2025-06-06

Attack reports

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

Blitz Malware: A Tale of Game Cheats and Code Repositories

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721

From open-source to open threat: Tracking Chaos RAT’s evolution

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

Threat Analysis: DCRat presence growing in Latin America

BladedFeline: Whispering in the dark

Abusing Paste.ee to Deploy XWorm and AsyncRAT Across Global C2 Infrastructure

Vulnerabilities

CVE-2025-5705

CVE-2025-5706

CVE-2025-5707

CVE-2025-5708

CVE-2025-5709

CVE-2025-5710

CVE-2024-22330

CVE-2024-56342

CVE-2024-56343