Tag: 2025-06-18

12 Attack Reports | 1 Vulnerabilities

Attack reports

What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia

A Russia state-sponsored cyber threat actor impersonated the U.S. Department of State to target prominent academics and critics of Russia. The attackers used extensive rapport building and tailored lures to convince targets to set up application specific passwords (ASPs). Once obtained, these ASPs …
phishing
state-sponsored
asp
email compromise
2025-06-18
department of state
Published: June 18, 2025
Downloadable IOCs: 2

May 2025 Infostealer Trend Report

This analysis examines the distribution trends of Infostealer malware in May 2025. It highlights the use of SEO poisoning to distribute malware disguised as cracks and keygens. LummaC2, Vidar, StealC, Rhadamanthys, and Amadey were the main Infostealers observed. Distribution methods included posts …
lummac2
rhadamanthys
infostealer
seo poisoning
amadey
bat script
vidar
stealc
dll-sideloading
2025-06-18
keygens
wormhole
unicode passwords
cracks
Published: June 18, 2025
Downloadable IOCs: 3

Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet

An active campaign is exploiting CVE-2025-3248, a critical vulnerability in Langflow versions before 1.3.0, to deliver the Flodrix botnet. Attackers use the flaw to execute downloader scripts on compromised servers, which then fetch and install the Flodrix malware. The vulnerability allows full sys…
exploit
ddos
botnet
rce
CVE-2025-3248
2025-06-18
flodrix
langflow
Published: June 18, 2025
Downloadable IOCs: 41

May 2025 APT Group Trends (South Korea)

This analysis examines Advanced Persistent Threat (APT) attacks in South Korea during May 2025. The majority of identified attacks utilized spear phishing as the primary infiltration method. Two main types of attacks were observed: Type A, which uses LNK files to execute malicious scripts and downl…
obfuscation
apt
south korea
lnk files
spear phishing
decoy documents
task scheduler
2025-06-18
python scripts
Published: June 18, 2025
Downloadable IOCs: 7

Warning Against Distribution of Malware Disguised as Research Papers

The Kimsuky group has launched a sophisticated phishing attack disguised as a request for paper review from a professor. The attack involves a password-protected HWP document with a malicious OLE object, which creates six files upon opening. When executed, these files perform various malicious acti…
apt
phishing
dropbox
anydesk
remote-access
social-engineering
ole
hwp
2025-06-18
Published: June 18, 2025
Downloadable IOCs: 3

Masslogger Fileless Variant – Spreads via .VBE, Hides in Registry

A sophisticated variant of the Masslogger credential stealer malware has been identified spreading through .VBE files. This multi-stage fileless malware heavily relies on Windows Registry to store and execute its malicious payload. The infection begins with a .VBE file, likely distributed via spam …
obfuscation
persistence
windows registry
vbscript
data exfiltration
process hollowing
credential stealer
fileless malware
2025-06-18
masslogger
Published: June 18, 2025
Downloadable IOCs: 1

Famous Chollima deploying Python version of GolangGhost RAT

In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) called 'PylangGhost', used by a North Korean-aligned threat actor. PylangGhost shares similarities with the previously documented GolangGhost RAT. The threat actor, Famous Chollima, has been targeting employees with exper…
rat
cryptocurrency
browser data theft
blockchain
golangghost
2025-06-18
pylangghost
Published: June 18, 2025
Downloadable IOCs: 67

Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

Proofpoint has identified Amatera Stealer, a rebranded version of ACR Stealer with enhanced capabilities and evasion techniques. Distributed via ClearFake website injects, it utilizes sophisticated attack chains and web injects. Amatera Stealer employs NTSockets for stealthy C2 communication, WoW64…
rhadamanthys
lumma stealer
malware-as-a-service
clickfix
acr stealer
information stealer
clearfake
2025-06-18
web injects
amatera stealer
ntsockets
wow64 syscalls
Published: June 18, 2025
Downloadable IOCs: 12

Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data

A multistage malware campaign targeting Minecraft users has been discovered, distributed through the Stargazers Ghost Network on GitHub. The malware impersonates popular Minecraft mods and cheats, using a Java-based downloader that evades detection. The infection chain includes multiple stages: a J…
infostealer
minecraft
stargazers ghost network
2025-06-18
java malware
minecraft mods
Published: June 18, 2025
Downloadable IOCs: 17

GitHub's Dark Side: Unveiling Malware Disguised as Cracks, Hacks, and Crypto Tools

Cybercriminals are exploiting GitHub's reputation to distribute malware, particularly targeting gamers and children. They create repositories offering game hacks, cracked software, and crypto tools, which actually contain Lumma Stealer variants. The attack chain begins with users searching for thes…
social engineering
malware distribution
lumma stealer
cybersecurity
github
2025-06-18
cracked software
game hacks
crypto tools
Published: June 18, 2025
Downloadable IOCs: 4

From ClickFix deception to information stealer deployment

The article describes a surge in ClickFix campaigns using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware. It analyzes a multi-stage attack that begins with ClickFix social engineering, deploys GHOSTPULSE loader, and ultimately delivers ARECHCLIENT2, a potent remote access troj…
social engineering
infostealer
lumma
clickfix
multi-stage attack
remote access trojan
ghostpulse
arechclient2
eddiestealer
2025-06-18
Published: June 18, 2025
Downloadable IOCs: 47

Uncovering a Tor-Enabled Docker Exploit

A sophisticated attack campaign exploits exposed Docker Remote APIs and leverages the Tor network to deploy stealthy cryptocurrency miners. The attackers gain access to containerized environments, use Tor to mask their activities, and employ the ZStandard compression algorithm for efficient payload…
xmrig
docker
tor
cryptocurrency mining
container exploitation
ssh backdoor
api abuse
2025-06-18
zstandard compression
Published: June 18, 2025
Linked vulnerabilities : CVE-2025-3248 (CVSS 9.8)
Downloadable IOCs: 6
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-23252

4.5
    Nvidia
  • Nvdebug
Published: June 18, 2025
Click here to see more Vulnerabilities