Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New Flodrix Botnet Variant Exploits Langflow AI Server RCE Bug to Launch DDoS Attacks

Source: The Hacker News

Cybersecurity researchers have identified a campaign exploiting a critical security flaw in Langflow to distribute the Flodrix botnet malware. This involves CVE-2025-3248, a missing authentication flaw in Langflow, allowing attackers to execute downloader scripts on compromised servers to install Flodrix. Read more.

Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub

Source: TREND MICRO

Water Curse is a newly discovered threat actor using weaponized GitHub repositories to spread multistage malware. The malware enables data exfiltration, including credentials and browser data, and poses a significant supply chain risk, particularly affecting cybersecurity professionals, game developers, and DevOps teams reliant on open-source tools. Read more.

Tycoon 2FA: An Evolving Phishing Kit Powering PhaaS Threats

Source: SOCRadar

Cybercriminals are using Tycoon 2FA in recent phishing campaigns to create deceptive login pages that mimic trusted services like Microsoft 365. This Phishing-as-a-Service kit allows attackers to bypass Multi-Factor Authentication by stealing session cookies, granting unauthorized access to accounts despite existing security measures. Read more.

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments

Source: The Hacker News

Cybersecurity researchers have identified several npm packages laced with malware, capable of executing remote code and downloading additional malicious payloads. Although these packages, including eslint-config-airbnb-compat, ts-runtime-compat-check, solders, and @mediawave/lib, have been removed from the registry, they were downloaded hundreds of times before their removal. Read more.

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

Source: TREND MICRO

Anubis is a rising Ransomware-as-a-Service (RaaS) operation that uniquely combines file encryption with an optional “wipe mode” feature, allowing for permanent file deletion if the ransom is not paid. It operates a versatile affiliate program with negotiable revenue shares, enabling further monetization through data extortion and access sales. Read more.

Microsoft confirms auth issues affecting Microsoft 365 users

Source: BLEEPING COMPUTER

Microsoft is currently investigating an issue with M365 authentication features. It’s affecting users’ experiences, specifically causing errors during self-service password resets and when managing authentication methods. Administrators are also facing difficulties adding MFA sign-in methods. Read more.

Understanding Katz Stealer Malware and Its Credential Theft Capabilities

Source: PICUS

Katz Stealer is a newly discovered information-stealing MaaS, featuring aggressive credential theft, system fingerprinting, and stealthy persistence methods. This analysis explores its infection chain, obfuscation techniques, credential theft mechanisms, C2 behavior, and persistence strategies, providing key IOCs and insights for effective detection and defense. Read more.

Password-spraying attacks target 80,000 Microsoft Entra ID accounts

Source: BLEEPING COMPUTER

Hackers have used the TeamFiltration pentesting framework to target over 80,000 Microsoft Entra ID accounts globally, with the campaign reaching its peak on January 8 by attacking 16,500 accounts in just one day. Researchers from Proofpoint have attributed this activity, which began last December and has compromised numerous accounts, to a threat actor known as UNK_SneakyStrike. Read more.

Google suffers cloud outage, causing disruptions for OpenAI, Shopify and other services

Source: CNBC

Google’s cloud faced widespread outages on Thursday, affecting many major internet services, with disruptions starting at 10:51 a.m. PT. By Thursday evening, Kurian confirmed on X that all services were fully operational again. Read more.

GhostVendors Exposed: Silent Push Uncovers Massive Network of 4000+ Fraudulent Domains Masquerading as Major Brands

Source: SILENT PUSH

Threat analysts at Silent Push have uncovered the “GhostVendors” scam, involving online ads that impersonate major brands and spoof real products across thousands of fraudulent websites. This operation, spanning over 4,000 domains, poses a significant threat to social networks, well-known brands, advertising firms, and consumers globally. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New Linux Vulnerabilities Expose Password Hashes via Core Dumps

Source: Infosecurity Magazine

Two local information-disclosure vulnerabilities have been identified in popular Linux crash-reporting tools, allowing attackers to access sensitive system data. The vulnerabilities impact Apport on Ubuntu and systemd-coredump on Red Hat Enterprise Linux (RHEL) and Fedora. Read more.

Crocodilus Mobile Malware: Evolving Fast, Going Global

Source: Threat Fabric

In March 2025, researchers discovered Crocodilus, a new device-takeover Android banking Trojan entering the threat landscape. The first observed samples were mostly related to test campaigns, with sporadic instances of live campaigns. Ongoing monitoring of the threat landscape revealed a growing number of campaigns and continuous development of the Trojan. Read more.

A mysterious leaker is exposing ransomware hackers to the world

Source: TechRadar

A mysterious leaker has been spotted unveiling the identities of some of the world’s most wanted cybercriminals, including the masterminds behind Conti and Trickbot ransomware, infamous groups responsible for some of the biggest extortions in modern history. Read more.

Pro-Ukraine hacker group Black Owl poses ‘major threat’ to Russia, Kaspersky says

Source: The Record

BO Team, also known as Black Owl, has been active since early 2024 and appears to operate independently, with its own arsenal of tools and tactics, researchers at Russian cybersecurity firm Kaspersky said. Read more.

Cybercriminals camouflaging threats as AI tool installers

Source: Cisco Talos

Talos has recently uncovered multiple threats masquerading as AI solutions being circulated in the wild, including the CyberLock and Lucky_Gh0$t ransomware families, along with a newly discovered destructive malware, dubbed “Numero.” The legitimate versions of these AI tools are particularly popular within the B2B sales domain and the technology and marketing sectors. Read more.

Monkey-Patched PyPI Packages Use Transitive Dependencies to Steal Solana Private Keys

Source: Socket

Once imported, the malware monkey-patches Solana key-generation methods by modifying functions at runtime without altering the original source code. Each time a keypair is generated, the malware captures the private key. It then encrypts the key using a hardcoded RSA?2048 public key and encodes the result in Base64. Read more.

Your AI Notetaker Might Be a Liability: Insights from Stealer Logs

Source: SOCRadar

Using AI note-taking tools can be incredibly helpful but they also come with some serious legal and ethical responsibilities. Organizations need to think about how these tools collect, store, and use data, and how the output might influence decisions or impact privacy. If you’re choosing a transcription service, make sure it follows data privacy laws and uses secure, well-managed systems. Read more.

Tracking AyySSHush: a Newly Discovered ASUS Router Botnet Campaign

Source: Censys

A new, stealthy ASUS router botnet, dubbed AyySSHush, abuses trusted firmware features through a multi-stage attack sequence to backdoor routers and persist across firmware updates, evading traditional detection methods. Read more.

Police takes down AVCheck site used by cybercriminals to scan malware

Source: BLEEPING COMPUTER

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. The service’s official domain at avcheck.net now displays a seizure banner with the crests of the U.S. Department of Justice, the FBI, the U.S. Secret Service, and the Dutch police (Politie). Read more.

Russian-linked hackers target UK Defense Ministry while posing as journalists

Source: KYIV Independent

Russian-linked hackers targeted U.K. Defense Ministry staff in an espionage operation while posing as journalists, Sky News reported on May 29, citing the British government. The cyber attack was detected and thwarted, the government said. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

SEC SIM-swapper who Googled ‘signs that the FBI is after you’ put behind bars

Source: The Register

An Alabama man who SIM-swapped his way into the SEC’s official X account, enabling a fake ETF announcement that briefly pumped Bitcoin, has been sentenced to 14 months in prison and three years of supervised release. Prior to his conviction and sentencing on Friday, Eric Council Jr., 26, of Huntsville, Alabama, proved once again that cybercriminals are very bad at internet search hygiene. Read more.

Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems

Source: GBHackers

Often compared to .NET for its persistence in malicious campaigns, AutoIT’s simplicity and ability to interact with Windows components make it a favored tool among cybercriminals. This weekend, a particularly intricate malware delivery mechanism was identified, featuring a double-layered AutoIT script designed to deploy a potentially devastating payload. Read more.

Malware of the Day – C2 over ICMP (ICMP-GOSH)

Source: ACTIVE COUNTER MEASURES

The potential for ICMP to be used as a C2 channel is often overlooked precisely because it is such a foundational troubleshooting protocol, integral to the normal functioning of network communication. Many people view it as “background chatter”, not considering its potential to be intentionally leveraged to carry data for this exact reason. Read more.

Backdoor implant discovered on PyPI posing as debugging utility

Source: REVERSING LABS

On Tuesday, the RL threat research team detected a newly uploaded malicious package that poses as a Python debugging utility. When installed, the package implants a backdoor on the developer’s system, enabling malicious actors to execute malicious code and exfiltrate sensitive data. Read more.

Ransomware gangs increasingly use Skitnet post-exploitation malware

Source: BLEEPING COMPUTER

Ransomware gang members increasingly use a new malware called Skitnet (“Bossnet”) to perform stealthy post-exploitation activities on breached networks. The malware has been offered for sale on underground forums like RAMP since April 2024, but according to Prodaft researchers, it started gaining significant traction among ransomware gangs since early 2025. Read more.

Researchers Expose New Intel CPU Flaws Enabling Memory Leaks and Spectre v2 Attacks

Source: The Hacker News

The vulnerability, referred to as Branch Privilege Injection (BPI), “can be exploited to misuse the prediction calculations of the CPU (central processing unit) in order to gain unauthorized access to information from other processor users,” ETH Zurich said. Read more.

Android users bombarded with unskippable ads

Source: Malwarebytes Labs

Researchers have discovered a very versatile ad fraud network—known as Kaleidoscope—that bombards users with unskippable ads. Kaleidoscope targets Android users through seemingly legitimate apps in the Google Play Store, as well as malicious lookalikes distributed through third-party app stores. Read more.

Operation RoundPress

Source: welivesecurity

In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim’s webmail page. In 2023, Operation RoundPress only targeted Roundcube, but in 2024 it expanded to other webmail software including Horde, MDaemon, and Zimbra. Read more.

GovDelivery, an email alert system used by governments, abused to send scam messages

Source: TechCrunch

An email notification system used by U.S. federal and state government departments to alert residents to important information has been used to send scam emails, TechCrunch has learned. Read more.

APT GROUP123

Source: CYFIRMA

Group123 is a North Korean state-sponsored APT group active since at least 2012. It is also tracked under other names such as APT37, Reaper, and ScarCruft by various cybersecurity firms. The group is known for its cyber espionage campaigns primarily targeting South Korea, however since 2017 it has expanded its operations to Japan, Vietnam, the Middle East, and other regions. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New “Bring Your Own Installer” EDR bypass used in ransomware attack

Source: Bleeping Computer

A new “Bring Your Own Installer” EDR bypass technique is exploited in attacks to bypass SentinelOne’s tamper protection feature, allowing threat actors to disable endpoint detection and response (EDR) agents to install the Babuk ransomware. Read more.

Mamona: Technical Analysis of a New Ransomware Strain

Source: ANY RUN

Mamona is a newly identified commodity ransomware strain. The malware operates entirely offline, with no observed Command and Control (C2) channels or data exfiltration. All cryptographic processes are executed locally using custom routines, with no reliance on standard libraries. Read more.

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Source: Arctic Wolf

Arctic Wolf® observed a recent campaign by the financially motivated threat group Venom Spider targeting hiring managers with spear-phishing emails. The group abuses legitimate messaging services and job platforms to apply for real jobs using fake malicious resumes that drop a backdoor called More_eggs. Read more.

The Signal Clone the Trump Admin Uses Was Hacked

Source: 404 Media

A hacker has breached and stolen customer data from TeleMessage, an obscure Israeli company that sells modified versions of Signal and other messaging apps to the U.S. government to archive messages. The data stolen by the hacker contains the contents of some direct messages and group chats sent using its Signal clone, as well as modified versions of WhatsApp, Telegram, and WeChat. Read more.

Critical Commvault Vulnerability in Attacker Crosshairs

Source: Security Week

A second Commvault flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog within a week, signaling increased threat actor interest in the platform. Tracked as CVE-2025-34028 (CVSS score of 10/10), the issue is described as a path traversal flaw in Commvault Command Center that could be exploited without authentication for remote code execution (RCE). Read more.

Revived CryptoJS library is a crypto stealer in disguise

Source: Sonatype

An illicit npm package called ‘crypto-encrypt-ts’ may appear to revive the unmaintained but vastly popular CryptoJS library, but what it actually does is peek into your crypto wallet and exfiltrate your secrets to threat actors. Read more.

Ukrainian Nefilim Ransomware Affiliate Extradited to US

Source: Security Week

A Ukrainian national was extradited from Spain to the US on Wednesday to face charges related to his involvement in Nefilim ransomware attacks. The man, Artem Stryzhak, was arrested in Spain in 2024. He is charged with fraud conspiracy, including extortion, and faces up to five years in prison. Read more.

Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin

Source: Wordfence

The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin, often with the name ‘WP-antymalwary-bot.php’, and contains several functions that allow attackers to maintain access to your site, hide the plugin from the dashboard, and execute remote code. Read more.

Finding Minhook in a sideloading attack – and Sweden too

Source: SOPHOS

The campaign made use of the Minhook DLL (Minhook is a minimalistic API hooking library for Windows) to detour Windows API calls. The clean loader was not part of the sideloading package; instead, it was snatched from the infected system. Read more.

French Foreign Ministry blames Russian GRU-linked APT28 for cyberattacks on national entities; urges global action

Source: Industrial Cyber

The French foreign ministry has attributed a series of cyberattacks on national interests to APT28, a group linked to Russia’s military intelligence agency (GRU), and has strongly condemned its use by the Russian state. Since 2021, this attack group has been used to target or compromise a dozen French entities. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Phishers Exploit Google Sites and DKIM Replay to Send Signed Emails, Steal Credentials

Source: The Hacker News

In what has been described as an “extremely sophisticated phishing attack,” threat actors have leveraged an uncommon approach that allowed bogus emails to be sent via Google’s infrastructure and redirect message recipients to fraudulent sites that harvest their credentials. Read more.

False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation

Source: Unit 42

Evidence suggests that North Korean IT workers are using real-time deepfake technology to infiltrate organizations through remote work positions, which poses significant security, legal and compliance risks. The detection strategies we outline in this report provide security and HR teams with practical guidance to strengthen their hiring processes against this threat. Read more.

Unmasking the Evolving Threat: A Deep Dive into the Latest Version of Lumma InfoStealer with Code Flow Obfuscation

Source: Trellix

Lumma Stealer, first identified in 2022, remains a significant threat to this day, continuously evolving its tactics, techniques, and procedures (TTPs) to stay aligned with emerging trends. It is distributed on the dark web via a subscription-based model, Malware-As-A-Service(MaaS). Read more.

Critical AnythingLLM Vulnerability Exposes Systems to Remote Code Execution

Source: GBHackers

A critical security flaw (CVE-2024-13059) in the open-source AI framework AnythingLLM has raised alarms across cybersecurity communities. The vulnerability, discovered in February 2025, allows attackers with administrative privileges to execute malicious code remotely, potentially compromising entire systems. Read more.

IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia

Source: SECURE LIST

However, recently we managed to spot attempted deployments of a new version of this implant, occurring in government organizations located in Mongolia and Russia. To us, this observed choice of victims wasn’t surprising, as back in 2018, we wrote that IronHusky, the actor related to this RAT, has a specific interest in targeting these two countries. Read more.

Emulating the Stealthy StrelaStealer Malware

Source: ATTACK IQ

In recent analysis, StrelaStealer has been associated with the threat actor group HIVE-0145, a cluster identified for its focus on credential theft and espionage-driven campaigns. As reported by IBM, HIVE-0145 is likely to be a financially motivated initial access broker (IAB), active since late 2022 and potentially the sole operator of StrelaStealer. Read more.

Cisco Webex bug lets hackers gain code execution via meeting links

Source: BLEEPING COMPUTER

Tracked as CVE-2025-20236, this security flaw was found in the Webex custom URL parser and can be exploited by tricking users into downloading arbitrary files, which lets threat actors execute arbitrary commands on systems running unpatched software in low complexity attacks. Read more.

Billbug: Intrusion Campaign Against Southeast Asia Continues

Source: Symantec

The Billbug espionage group (aka Lotus Blossom, Lotus Panda, Bronze Elgin) compromised multiple organizations in a single Southeast Asian country during an intrusion campaign that ran between August 2024 and February 2025. Targets included a government ministry, an air traffic control organization, a telecoms operator, and a construction company. Read more.

Malware of the Day – C2 over NTP (goMESA)

Source: Active Countermeasures

To complete the disguise, an attacker’s NTP server used for C2 can often be set up to also respond with valid time information, making the malicious traffic blend seamlessly with legitimate NTP activity and harder to detect by both automated systems and security analysts. This combination of permitted passage, potential for data hiding, and plausible deniability makes NTP an attractive channel for stealthy C2 operations. Read more.

Unmasking the new XorDDoS controller and infrastructure

Source: CISCO TALOS

Cisco Talos observed an existing distributed denial-of-service (DDoS) malware known as XorDDoS, continuing to spread globally between November 2023 and February 2025. A significant finding shows that over 70 percent of attacks using XorDDoS targeted the United States from Nov. 2023 to Feb. 2025. Read more.