Security Signals (07/29/25 – 08/12/25)
Welcome to your biweekly digest of curated cybersecurity intelligence.
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activities, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
Turn Insights Into Action with Free Threat Intel
Security Signals gives you the insights and our Risk Indicators feeds help you apply them. Get free access to machine readable OSINT that helps you monitor emerging risks, validate indicators, and proactively defend your environment.
This Edition’s Articles
Adversary Intel: From APTs to Ransomware Groups
ShinyHunters Tactics Now Mirror Scattered Spider
Source: DARK READING
Recent cyber incidents reveal patterns in timing, shared infrastructure, and similar targets. This suggests a coordinated approach, combining ShinyHunters’ data theft with Scattered Spider’s social engineering. Read more.
Unmasking SocGholish: Silent Push Untangles the Malware Web Behind the “Pioneer of Fake Updates” and Its Operator, TA569
Source: SILENT PUSH
SocGholish, managed by TA569, acts as a Malware-as-a-Service provider, selling access to compromised systems. Their main method is fake browser update pop-ups, delivered via JavaScript on hacked sites. Read more.
Attack Surface Watch: Exploring Digital Risks
New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP
Source: The Hacker News
SafeBreach researchers have found a new attack method, Win-DDoS, that could use thousands of public domain controllers to build a botnet for DDoS attacks. Read more.
Over 29,000 Exchange servers unpatched against high-severity flaw
Source: BLEEPING COMPUTER
More than 29,000 Exchange servers are still unpatched for CVE-2025-53786, a flaw that lets attackers move through Microsoft cloud and take over domains. Read more.
WinRAR zero-day exploited to plant malware on archive extraction
Source: BLEEPING COMPUTER
A recently fixed WinRAR vulnerability (CVE-2025-8088) was used in #phishing attacks to install RomCom malware. The bug allowed files to be extracted to any folder chosen by attackers. Read more.
Incident Radar: Breaches & Attacks
‘Chairmen’ of $100 million scam operation extradited to US
Source: BLEEPING COMPUTER
The U.S. Department of Justice charged four Ghanaian nationals for their roles in a $100M fraud ring involving romance scams and business email compromise. The suspects, extradited from Ghana, allegedly targeted U.S. companies and individuals from 2016 to 2023. Read more.
Threat Lab: Malware & Attack Analysis Deep Dive
CastleLoader
Source: PolySwarm
CastleLoader is a malware loader that has infected 469 devices since May 2025. It uses Cloudflare-themed ClickFix phishing and fake GitHub links to deliver info stealers and RATs. Read more.
Wave of 150 crypto-draining extensions hits Firefox add-on store
Source: BLEEPING COMPUTER
A campaign named ‘GreedyBear’ has targeted Firefox users with 150 fake extensions on the Mozilla add-ons store. These copy well-known crypto wallets like MetaMask and TronLink, stealing over $1,000,000. Read more.
SCENE 1: SoupDealer – Technical Analysis of a Stealth Java Loader Used in Phishing Campaigns Targeting Türkiye
Source: Malwation
A recent malware bypassed almost every public sandbox and antivirus, except Threat.Zone, and even evaded EDR/XDR in real-world incidents. Many banks, ISPs, and organizations were impacted. Read more.
Makop Ransomware Identified in Attacks in South Korea
Source: ASEC
ASEC has identified Makop ransomware attacks targeting South Korean users. The ransomware is spread through fake resumes, copyright emails, and now uses RDP for attacks. Read more.
Want more articles? Check out the previous edition of Security Signals here.
