Android Malware Posing As Indian Bank Apps

This report analyzes a sophisticated Android malware targeting Indian banking apps. The malware uses a dropper and main payload structure, leveraging permissions like SMS access and silent installation to steal credentials, intercept messages, and perform unauthorized financial activities. It employs Firebase for command and control, phishing pages to mimic banking interfaces, and techniques like call forwarding abuse. The malware's modular architecture, evasion tactics, and persistence mechanisms pose significant threats to mobile banking security. Distribution methods include smishing, fake websites, and malvertising. The report provides detailed static and dynamic analysis, highlighting the malware's capabilities in data exfiltration, debit card harvesting, and remote command execution.

Pulse ID: 68835c6fda683e2a665d5722
Pulse Link: https://otx.alienvault.com/pulse/68835c6fda683e2a665d5722
Pulse Author: AlienVault
Created: 2025-07-25 10:29:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Gunra Ransomware Emerges with New DLS

A new ransomware group called Gunra has emerged with a Dedicated Leak Site (DLS) in April 2025. Gunra's code shows similarities to the infamous Conti ransomware, suggesting it may be leveraging Conti's leaked source code. The group employs aggressive tactics, including a time-based pressure technique that forces victims to begin negotiations within five days. Gunra ransomware encrypts files using a combination of RSA and ChaCha20 algorithms, excludes certain folders and file types from encryption, and drops a ransom note named 'R3ADM3.txt'. The ransomware also deletes volume shadow copies to hinder recovery efforts. As the threat of DLS ransomware grows, organizations are advised to implement robust security measures, including regular updates, backups, and user education.

Pulse ID: 688219586599cc75ec92a318
Pulse Link: https://otx.alienvault.com/pulse/688219586599cc75ec92a318
Pulse Author: AlienVault
Created: 2025-07-24 11:30:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

NET RFQ: Request for Quote Scammers Casting Wide Net to Steal Real Goods

This intelligence analysis examines a widespread Request for Quote (RFQ) scam that exploits Net financing options to steal high-value electronics and goods. The scammers pose as procurement agents for legitimate companies, using stolen information and lookalike domains to appear credible. They request quotes for specific items and inquire about Net 15/30/45-day financing. Once credit is approved, they provide shipping addresses, often using freight forwarding services or residential addresses. The scammers utilize a network of shipping services, warehouses, and money mules to facilitate their operations. Key characteristics of the scam include urgent financing requests, suspicious delivery addresses, and the use of free email accounts. Mitigation efforts included domain takedowns and intercepting fraudulent shipments.

Pulse ID: 6880970dcf6caa73c7a79b70
Pulse Link: https://otx.alienvault.com/pulse/6880970dcf6caa73c7a79b70
Pulse Author: AlienVault
Created: 2025-07-23 08:02:21

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

Two critical zero-day vulnerabilities, CVE-2025-53770 and CVE-2025-53771, are actively exploited in on-premises Microsoft SharePoint servers. These flaws enable unauthenticated remote code execution through an exploit chain dubbed ToolShell. CVE-2025-53770 is a critical RCE vulnerability caused by unsafe deserialization, while CVE-2025-53771 is a spoofing vulnerability allowing authentication bypass. The vulnerabilities affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Cloud-hosted self-managed SharePoint instances are also at risk. Exploitation has been observed since July 18, 2025, with attacks targeting sensitive data extraction and persistent remote access. Microsoft has released emergency patches, and organizations are urged to update immediately or implement workarounds if patching is not possible.

Pulse ID: 687ec30ead4d6a2798563303
Pulse Link: https://otx.alienvault.com/pulse/687ec30ead4d6a2798563303
Pulse Author: AlienVault
Created: 2025-07-21 22:45:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Large-scale exploitation of new SharePoint RCE vulnerability chain identified

A new SharePoint remote code execution vulnerability chain, later named CVE-2025-53770 and CVE-2025-53771 by Microsoft, was discovered being exploited in the wild. The exploitation affected on-premise SharePoint Servers globally, with dozens of systems compromised during two attack waves on July 18 and 19, 2025. The first wave originated from a US-based IP address (107.191.58.76) at 18:06 UTC, deploying spinstall0.aspx. The second wave, also from a US-based IP (104.238.159.149), occurred at 07:28 UTC the following day. Two additional IP addresses were identified in connection with the attacks. Organizations are advised to patch their systems and conduct compromise assessments if they suspect being affected.

Pulse ID: 687e1326defc04da82d0b809
Pulse Link: https://otx.alienvault.com/pulse/687e1326defc04da82d0b809
Pulse Author: AlienVault
Created: 2025-07-21 10:15:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

For our MSFT-aligned friends in particular,

Happy POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit day to all who celebrate!

https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 #sharepoint #bugs #msft #post #rce

Morning, cyber pros! It's been a bit quiet over the last 24 hours, but we've still got some critical updates to chew on, including a nasty SharePoint zero-day, new GRU malware, and a warning about hardcoded credentials in Aruba access points. Let's dive in:

SharePoint Zero-Day Under Active RCE Exploitation

- A critical zero-day, CVE-2025-53770, in Microsoft SharePoint Server is being actively exploited for Remote Code Execution (RCE) since at least July 18th, with over 75 organisations already compromised.
- This flaw is a variant of CVE-2025-49706, part of the "ToolShell" chain demonstrated at Pwn2Own Berlin, and allows attackers to steal the server's MachineKey configuration to craft valid ViewState payloads for RCE.
- No patch is available yet, but Microsoft recommends enabling AMSI integration (default since Sep 2023 updates for SharePoint Server 2016/2019/Subscription Edition) and deploying Defender AV. If AMSI isn't an option, disconnect servers from the internet. Check for `C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\spinstall0.aspx` and specific IIS log entries as IOCs.

Bleeping Computer | https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

UK Sanctions GRU, Uncovers New Microsoft Credential Stealer

- The UK government has sanctioned three GRU units (26165, 29155, 74455) and several individuals for a sustained campaign of malicious cyber activity, including targeting logistics providers and using cyber reconnaissance for missile strikes in Ukraine.
- Specifically, GRU's APT28 (Fancy Bear/Forest Blizzard, Unit 26165) is attributed to deploying "Authentic Antics," a novel Windows malware that steals Microsoft email credentials and OAuth tokens by displaying fake login prompts.
- Authentic Antics also exfiltrates victim data by sending emails from the compromised account to an actor-controlled address without appearing in the 'sent' folder, highlighting the sophistication and stealth of GRU operations.

The Register | https://go.theregister.com/feed/www.theregister.com/2025/07/20/uk_microsoft_snooping_russia/

HPE Warns of Hardcoded Passwords in Aruba Access Points

- HPE has issued a critical warning (CVE-2025-37103, CVSS 9.8) regarding hardcoded administrative credentials in Aruba Instant On Access Points running firmware version 3.2.0.1 and below.
- This vulnerability allows remote attackers to bypass authentication and gain full administrative access to the web interface, enabling configuration changes, backdoor installation, or traffic surveillance.
- A second high-severity flaw, CVE-2025-37102, an authenticated command injection, can be chained with the hardcoded password vulnerability for further compromise. Immediate upgrade to firmware version 3.2.1.0 or newer is recommended as no workarounds are available.

Bleeping Computer | https://www.bleepingcomputer.com/news/security/hpe-warns-of-hardcoded-passwords-in-aruba-access-points/

Warnung: Kritische Zero‑Day‑RCE‑Kette in SharePoint! Eye Security berichtet, dass seit dem 18. Juli 2025 weltweit on‑premise SharePoint‑Server von einer neuen, vollständig unauthentifizierten Remote Code Execution (RCE)-Kette – genannt ToolShell – angegriffen werden. Betroffen sind nur on-premise SharePoint Server (nicht SharePoint Online). Weitere Details unter: https://research.eye.security/sharepoint-under-siege/ #SharePoint #CVE202553770 #ToolShell #CyberSecurity #RCE #ZeroDay

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

The article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-platform RAT, and Fscan, a network scanning tool. After gaining initial access, the threat actors performed lateral movement using brute-force attacks, exploited vulnerabilities, and used stolen credentials. They established persistence by creating domain accounts and registering malware as services or scheduled tasks. The attackers employed various evasion techniques, including the use of legitimate files and ETW bypasses.

Pulse ID: 6879f8b560d48aaf15291507
Pulse Link: https://otx.alienvault.com/pulse/6879f8b560d48aaf15291507
Pulse Author: AlienVault
Created: 2025-07-18 07:33:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Chinese Mobile Forensic Tooling Discovered

Lookout Threat Lab has uncovered a mobile forensics application called Massistant, used by Chinese law enforcement to extract extensive data from mobile devices. Believed to be the successor of MFSocket, Massistant requires physical access to install and is not distributed through official app stores. It collects sensitive information including GPS data, SMS messages, images, audio, contacts, and phone services. The tool is associated with Xiamen Meiya Pico Information Co., Ltd., a Chinese technology company controlling a significant portion of China's digital forensics market. Massistant introduces new features like Accessibility Services to bypass device security prompts and support for additional messaging apps. The discovery raises concerns about data privacy for travelers to China, as law enforcement can potentially access and analyze confiscated devices without a warrant.

Pulse ID: 6879f93b6deb93df0f1e6c0c
Pulse Link: https://otx.alienvault.com/pulse/6879f93b6deb93df0f1e6c0c
Pulse Author: AlienVault
Created: 2025-07-18 07:35:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

GhostContainer backdoor for Exchange servers

A sophisticated backdoor targeting Exchange servers of high-value organizations in Asia has been discovered. The malware, named GhostContainer, is a multi-functional backdoor that can be dynamically extended with additional modules. It leverages several open-source projects and employs various evasion techniques to avoid detection. The backdoor grants attackers full control over the Exchange server and can function as a proxy or tunnel. The malware is believed to be part of an APT campaign targeting government and high-tech companies in Asia. It includes components for C2 parsing, virtual page injection, and web proxy functionality. The attackers demonstrated expertise in exploiting Exchange systems and assembling sophisticated espionage tools.

Pulse ID: 68790fea4a8a9331ee6ff876
Pulse Link: https://otx.alienvault.com/pulse/68790fea4a8a9331ee6ff876
Pulse Author: AlienVault
Created: 2025-07-17 14:59:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.

Pulse ID: 6877cee47723c96cd1d54e25
Pulse Link: https://otx.alienvault.com/pulse/6877cee47723c96cd1d54e25
Pulse Author: AlienVault
Created: 2025-07-16 16:10:12

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

The Solidity Language open-source package was used in a $500,000 crypto heist

A blockchain developer in Russia lost $500,000 in crypto assets due to a malicious Solidity Language extension for Cursor AI IDE. The fake extension, downloaded 54,000 times, appeared higher in search results than the legitimate one due to ranking algorithms. It installed malware that allowed remote access and data theft. The attackers used ScreenConnect for remote control and deployed various scripts to steal wallet passphrases. A new malicious package was published shortly after the first was removed, with an inflated download count of 2 million. Similar attacks were found targeting blockchain developers through other extensions and npm packages. The incident highlights the ongoing threat of malicious open-source packages in the crypto industry.

Pulse ID: 6877cefdf99ce3c2912e8daa
Pulse Link: https://otx.alienvault.com/pulse/6877cefdf99ce3c2912e8daa
Pulse Author: AlienVault
Created: 2025-07-16 16:10:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Unmasking AsyncRAT: Navigating the labyrinth of forks

AsyncRAT, an open-source remote access trojan, has spawned numerous forks since its 2019 release, becoming a cornerstone of modern malware. This analysis maps out the relationships among AsyncRAT variants, focusing on prominent forks like DcRat and VenomRAT, as well as lesser-known versions. The research explores the evolution of these forks, their unique features, and the methods used to identify them. It also delves into exotic variants with specialized plugins, such as NonEuclid RAT's jump scare and malware spreader functionalities. The proliferation of AsyncRAT forks highlights the risks associated with open-source malware frameworks and the need for proactive detection strategies.

Pulse ID: 687758ff039275831fbcb386
Pulse Link: https://otx.alienvault.com/pulse/687758ff039275831fbcb386
Pulse Author: AlienVault
Created: 2025-07-16 07:47:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

WinRAR Zero-Day Exploit Allegedly on Sale for $80,000 https://dailydarkweb.net/winrar-zero-day-exploit-allegedly-on-sale-for-80000/ #Vulnerability #CyberSecurity #vulnerability #exploit #ZeroDay #WinRAR #RCE

CVE-2025-25257 Vulnerability: Critical SQL Injection in Fortinet FortiWeb Enables Unauthenticated Remote Code Execution – Source: socprime.com https://ciso2ciso.com/cve-2025-25257-vulnerability-critical-sql-injection-in-fortinet-fortiweb-enables-unauthenticated-remote-code-execution-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #Vulnerability #socprimecom #socprime #Blog #CVE #rce

Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors

A sophisticated piece of malware was discovered embedded in a WordPress site's core files, specifically in wp-settings.php. The malware uses a ZIP archive to hide malicious code and perform search engine poisoning and unauthorized content injection. It employs dynamic Command and Control server selection, anti-bot mechanisms, and manipulates SEO-related files. The malware's main goals include manipulating search engine rankings, injecting spam content, and performing unauthorized redirects. It uses obfuscation techniques and ZIP archives for code inclusion, making it challenging to detect and remove. Prevention measures include keeping software updated, using reputable sources for themes and plugins, implementing strong credential security, utilizing a Web Application Firewall, and regularly scanning for malware.

Pulse ID: 68750b271ed247073ded7ab1
Pulse Link: https://otx.alienvault.com/pulse/68750b271ed247073ded7ab1
Pulse Author: AlienVault
Created: 2025-07-14 13:50:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#FortiWeb Pre-Auth #RCE (CVE-2025-25257)

https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce