Cyber Threat Intelligence 27 March 2025

NCSA_THAICERT

New Tooling

Malwoverview: First Response Tool For Threat Hunting
"Malwoverview is an open-source threat hunting tool designed for the initial triage of malware samples, URLs, IP addresses, domains, malware families, IOCs, and hashes. “Malwoverview is simple and direct, integrating multiple public sandboxes to retrieve and display only relevant information. It enables professionals to gather broad insights into a threat before analyzing it. The tool pulls data from sources like VirusTotal, Hybrid Analysis, Malshare, URLHaus, Polyswarm, AlienVault, Malpedia, Malware Bazaar, Triage, InQuest, and Virus Exchange."
https://www.helpnetsecurity.com/2025/03/26/malwoverview-first-response-tool-threat-hunting/
https://github.com/alexandreborges/malwoverview
Cybertron Reshapes AI Security As “Cyber Brain” Grows
"Trend Micro is excited to introduce Trend Cybertron — a groundbreaking advancement that is transforming cybersecurity in an increasingly AI-driven world. While Trend Vision One customers benefit from the fully integrated Trend Cybertron "cyber brain," Trend Micro has now made select components of Trend Cybertron available as open-source. These offerings include cybersecurity-focused LLMs, extensive training datasets, and practical tools like the Cloud Risk Assessment AI Agent."
https://www.trendmicro.com/en_us/research/25/c/cybertron-ai-security.html

Vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability"
https://www.cisa.gov/news-events/alerts/2025/03/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

Malware

Report On Ransomware Attacks Targeting Korean Companies
"In recent years, ransomware attacks have been increasing worldwide, with Korean companies also experiencing a rise in cases. Especially since 2023, there has been a sharp surge in ransomware incidents targeting the Asia region, highlighting the need for a systematic analysis of this trend and its impact."
https://asec.ahnlab.com/en/87009/
Unmasking The Classiscam In Central Asia
"With the rapid development of technology and the widespread digitalization of businesses and services, online platforms have become popular in developing countries. These platforms offer greater convenience for business owners and local communities. In Central Asia, the use of such online markets began after 2015, enabling the trade of a wide range of products, from used electronics to brand-new items."
https://www.group-ib.com/blog/unmasking-the-classiscam-in-central-asia/
RedCurl's Ransomware Debut: A Technical Deep Dive
"This research, conducted by Bitdefender Labs, presents the first documented analysis of a ransomware campaign attributed to the RedCurl group (also known as Earth Kapre or Red Wolf). RedCurl has historically maintained a low profile, relying heavily on Living-off-the-Land (LOTL) techniques for corporate cyber espionage and data exfiltration. This shift to ransomware marks a significant evolution in their tactics. This new ransomware, which we have named QWCrypt based on a self-reference 'qwc' found within the executable, is previously undocumented and distinct from known ransomware families."
https://www.bitdefender.com/en-us/blog/businessinsights/redcurl-qwcrypt-ransomware-technical-deep-dive
https://www.bleepingcomputer.com/news/security/redcurl-cyberspies-create-ransomware-to-encrypt-hyper-v-servers/
https://thehackernews.com/2025/03/redcurl-shifts-from-espionage-to.html
https://www.bankinfosecurity.com/mercenary-hacking-group-appears-to-embrace-ransomware-a-27834
Malware Found On Npm Infecting Local Package With Reverse Shell
"Unlike some other public repositories, the npm package repository is never really quiet. And, while there has been some decline in malware numbers between 2023 and 2024, this year's numbers don’t seem to continue that downward trend. Still, while RL has detected some interesting npm malware so far this year, none of it warranted a detailed writeup. Then March rolled around, and two very interesting packages were published on npm: ethers-provider2 and ethers-providerz."
https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell
https://thehackernews.com/2025/03/malicious-npm-package-modifies-local.html
https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/
https://hackread.com/npm-malware-infects-ethereum-library-with-backdoor/
https://www.infosecurity-magazine.com/news/malicious-npm-packages-deliver/
'Lucid' Phishing-As-a-Service Exploits Faults In iMessage, Android RCS
"Chinese phishing operatives are spreading remarkably effective scams by exploiting mobile messaging protocols. iMessage and Rich Communication Services (RCS) are the preferred ways to message others using your iPhone or Android, respectively. Unlike the Short and Multimedia Messaging Services (SMS/MMS), they offer end-to-end encryption, read-receipts messages, higher-quality media, and looser character and file-size limits. But now, Chinese malware developers have figured out how to undermine their more advanced features."
https://www.darkreading.com/threat-intelligence/lucid-phishing-exploits-imessage-android-rcs
https://catalyst.prodaft.com/public/report/lucid/overview
Booking.com Phish Uses Fake CAPTCHAs To Trick Hotel Staff Into Downloading Malware
"A new phishing campaign that uses the fake CAPTCHA websites we reported about recently is targeting hotel staff in a likely attempt to access customer data, according to research from ThreatDown. Here’s how it works: Cybercriminals send a fake Booking.com email to a hotel’s email address, asking them to confirm a booking."
https://www.malwarebytes.com/blog/news/2025/03/fake-booking-com-phish-uses-fake-captchas-to-trick-hotel-staff-into-downloading-malware
DeepSeek Users Targeted With Fake Sponsored Google Ads That Deliver Malware
"DeepSeek’s rising popularity has not only raised concerns and questions about privacy implications, but cybercriminals are also using it as a lure to trap unsuspecting Google searchers. Unfortunately, we are getting so used to sponsored Google search results being abused by criminals that we advise people not to click on them. So, it was to be expected that DeepSeek would show up in our monitoring of fake Google ads."
https://www.malwarebytes.com/blog/news/2025/03/deepseek-users-targeted-with-fake-sponsored-google-ads-that-deliver-malware
ReaderUpdate Reforged | Melting Pot Of MacOS Malware Adds Go To Crystal, Nim And Rust Variants
"ReaderUpdate is a macOS malware loader platform that, despite having been in the wild since at least 2020, has passed relatively unnoticed by many vendors and remains widely undetected. A report in 2023 observed that ReaderUpdate infections were contiguous with but distinct from WizardUpdate (aka UpdateAgent, Silver Toucan) infections and seen to deliver Genieo (aka DOLITTLE) adware. The loader seems to have been largely dormant since then until the latter half of 2024, when several vendors began reporting on previously unseen macOS malware samples written in the Crystal programming language. Variants written in Nim and Rust were also identified."
https://www.sentinelone.com/blog/readerupdate-reforged-melting-pot-of-macos-malware-adds-go-to-crystal-nim-and-rust-variants/
https://www.securityweek.com/macos-users-warned-of-new-versions-of-readerupdate-malware/
https://securityaffairs.com/175891/malware/readerupdate-malware-variants-targets-macos.html
Blacklock Ransomware: A Late Holiday Gift With Intrusion Into The Threat Actor's Infrastructure
"Dubbed “BlackLock” (aka "El Dorado" or "Eldorado"), the ransomware-as-a-service (RaaS) outfit has existed since March 2024. In Q4 of last year, it increased its number of data leak posts by a staggering 1,425% quarter-on-quarter. According to independent reporting, a relatively new group has rapidly accelerated attacks and could become the most dominant RaaS group in 2025."
https://www.resecurity.com/blog/article/blacklock-ransomware-a-late-holiday-gift-with-intrusion-into-the-threat-actors-infrastructure
https://securityaffairs.com/175877/cyber-crime/blacklock-ransomware-targeted-by-cybersecurity-firm.html
CoffeeLoader: A Brew Of Stealthy Techniques
"Zscaler ThreatLabz has identified a new sophisticated malware family that we named CoffeeLoader, which originated around September 2024. The purpose of the malware is to download and execute second-stage payloads while evading detection by endpoint-based security products. The malware uses numerous techniques to bypass security solutions, including a specialized packer that utilizes the GPU, call stack spoofing, sleep obfuscation, and the use of Windows fibers. ThreatLabz has observed CoffeeLoader being distributed via SmokeLoader, and both malware families share some behavioral similarities."
https://www.zscaler.com/blogs/security-research/coffeeloader-brew-stealthy-techniques
You Will Always Remember This As The Day You Finally Caught FamousSparrow
"In July 2024, ESET Research noticed suspicious activity on the system of a trade group in the United States that operates in the financial sector. While helping the affected entity remediate the compromise, we made an unexpected discovery in the victim’s network: malicious tools belonging to FamousSparrow, a China-aligned APT group. There had been no publicly documented FamousSparrow activity since 2022, so the group was thought to be inactive. Not only was FamousSparrow still active during this period, it must have also been hard at work developing its toolset, since the compromised network revealed not one, but two previously undocumented versions of SparrowDoor, FamousSparrow’s flagship backdoor."
https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/
https://thehackernews.com/2025/03/new-sparrowdoor-backdoor-variants-found.html
https://therecord.media/china-famous-sparrow-back-eset
https://www.helpnetsecurity.com/2025/03/26/famoussparrow-cyberespionage-attacks-united-states/
Shifting The Sands Of RansomHub’s EDRKillShifter
"ESET researchers take a look back at the significant changes in the ransomware ecosystem in 2024 and focus on the newly emerged and currently dominating ransomware-as-a-service (RaaS) gang, RansomHub. We share previously unpublished insights into RansomHub’s affiliate structure and uncover clear connections between this newly emerged giant and well-established gangs Play, Medusa, and BianLian. We also emphasize the emerging threat of EDR killers, unmasking EDRKillShifter, a custom EDR killer developed and maintained by RansomHub. We have observed an increase in ransomware affiliates using code derived from publicly available proofs of concept, while the set of drivers being abused is largely fixed."
https://www.welivesecurity.com/en/eset-research/shifting-sands-ransomhub-edrkillshifter/
https://www.helpnetsecurity.com/2025/03/26/ransomhub-edrkillshifter-tool/
Inside Kimsuky’s Latest Cyberattack: Analyzing Malicious Scripts And Payloads
"Kimsuky, also known as “Black Banshee,” a North Korean APT group active at least from 2012, is believed to be state-sponsored. Their cyber espionage targets countries like South Korea, Japan, and the U.S. Their tactics include phishing, malware infections (RATs, backdoors, wiper malware), supply chain attacks, lateral movement within networks and data exfiltration. Recently , we came across IOCs of this APT’s latest attack shared in a tweet, which pointed to a ZIP file containing the actual payloads. In this blog, we will analyse the infection chain and conduct a deep dive into the examination of these payloads. We will also explore how the malware operates, its behaviour, and the techniques used to execute the attack."
https://labs.k7computing.com/index.php/inside-kimsukys-latest-cyberattack-analyzing-malicious-scripts-and-payloads/

Breaches/Hacks/Leaks

Oracle Customers Confirm Data Stolen In Alleged Cloud Breach Is Valid
"Despite Oracle denying a breach of its Oracle Cloud federated SSO login servers and the theft of account data for 6 million people, BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. Last week, a person named ‘rose87168’ claimed to have breached Oracle Cloud servers and began selling the alleged authentication data and encrypted passwords of 6 million users. The threat actor also said that stolen SSO and LDAP passwords could be decrypted using the info in the stolen files and offered to share some of the data with anyone who could help recover them."
https://www.bleepingcomputer.com/news/security/oracle-customers-confirm-data-stolen-in-alleged-cloud-breach-is-valid/
StreamElements Discloses Third-Party Data Breach After Hacker Leaks Data
"Cloud-based streaming company StreamElements confirms it suffered a data breach at a third-party service provider after a threat actor leaked samples of stolen data on a hacking forum. The platform has reassured users that the attack didn't impact its servers, though older data at a third-party provider they stopped working with last year was still exposed. "We recently became aware of a data security incident involving a third-party service provider we stopped working with last year," the company tweeted on X."
https://www.bleepingcomputer.com/news/security/streamelements-discloses-third-party-data-breach-after-hacker-leaks-data/
New Ransomware Group Claims Attack On US Telecom Firm WideOpenWest
"A new ransomware group claims to have hacked the systems of US telecommunications provider WideOpenWest (WOW!), and to have taken control of critical systems, in addition to stealing customer information. Calling itself Arkana Security, the threat actor claims to be performing penetration testing, hacking into organizations’ networks by exploiting vulnerabilities in corporate systems. They also steal the victims’ data to coerce them into paying a so-called “fee”."
https://www.securityweek.com/new-ransomware-group-claims-attack-on-us-telecom-firm-wideopenwest/
Thousands Of NSW Court Documents Downloaded In "major Data Breach"
"Thousands of “sensitive” NSW court filings have been downloaded by unknown threat actors after a breach of the NSW Online Registry website. The website provides online court services for the NSW Supreme, District and Local Courts, and is overseen by the state’s Department of Communities and Justice (DCJ). NSW Police said they were alerted to the “major data breach” of the website on Tuesday. Cybercrime detectives are investigating the incident under what they are calling ‘Strike Force Pardey’."
https://www.itnews.com.au/news/thousands-of-nsw-court-documents-downloaded-in-major-data-breach-615999
https://www.theregister.com/2025/03/26/nsw_police_investigating_court_system/

General News

How Does Your Data End Up On The Dark Web?
"The dark web is a hidden corner of the internet where people can remain anonymous. It’s often confused with the deep web, but they’re not quite the same thing. The deep web is just everything online that’s not indexed by search engines. This includes things like email accounts, private databases, and paid services. It’s not illegal, it’s just not meant to be found with a simple Google search. The dark web, however, is a specific, hidden section of the deep web. To access it, you need special software like Tor."
https://www.helpnetsecurity.com/2025/03/26/how-dark-web-works/
Threat Actors Abuse Trust In Cloud Collaboration Platforms
"Threat actors constantly evolve with new mechanisms to bypass multiple secure email gateways (SEGs). A specific mechanism to evade detection is using online documents, such as Adobe, DocuSign, Dropbox, Canva, and Zoho. These services are often used internally and externally by companies, making the domains a trusted source when it comes to SEG automation. Some of these services will even email the recipient of the document directly, allowing threat actors to put little effort into their campaigns. These document websites took up 8.8% of all credential phishing campaigns in 2024, showing the growing significance of this method."
https://cofense.com/blog/threat-actors-abuse-trust-in-cloud-collaboration-platforms
https://www.infosecurity-magazine.com/news/threat-actors-abuse-cloud-platforms/
Cybersecurity Gaps Leave Doors Wide Open
"Cybercriminals don't always need cutting-edge hacks to breach organizations when they can just waltz in through the front door. Despite pouring millions into advanced cybersecurity technologies, many organizations continue to overlook essential security practices — such as timely patching, vulnerability scanning, and penetration testing — leaving them susceptible to pricey and often very preventable breaches."
https://www.darkreading.com/cyberattacks-data-breaches/cybersecurity-gaps-leave-doors-wide-open
https://www.horizon3.ai/downloads/research/annual-insights-report-the-state-of-cybersecurity-in-2025/
Beyond STIX: Next-Level Cyber-Threat Intelligence
"Cybersecurity has become central to every enterprise's digital strategy, but to stay ahead of evolving cyber threats, organizations need a common language that turns complex threat data into something universally understandable and actionable. This is where Structured Threat Information Expression (STIX) comes in — a standardized language for sharing, storing, and analyzing cyber threat intelligence."
https://www.darkreading.com/threat-intelligence/beyond-stix-next-level-cyber-threat-intelligence
Security Tech That Can Make a Difference During An Attack
"When the FBI contacted Massachusetts-based Littleton Electric Light and Water Departments (LELWD) about Volt Typhoon, the small public utility was not aware the Chinese attack group had already been in the company's network for more than 300 days. While the utility had security controls protecting the perimeter, there were some gaps in its security technology and policy. A more rigorous update strategy for its network and security appliances would have prevented the initial compromise. In addition, monitoring internal traffic — the "east-west" traffic — could have potentially detected anomalies in how the attackers were using the administrator tools, says John Burns, director of OT threat hunting for Dragos, an operational-technology security firm."
https://www.darkreading.com/cybersecurity-operations/east-west-monitoring-visibility-critical-apt-detection
SecurityScorecard Observes Surge In Third-Party Breaches
"Cyber-attacks leveraging third-party vulnerabilities are on the rise, according to a new SecurityScorecard report. The cyber risk assessment provider released its 2025 Global Third-Party Breach Report on March 26. In the report, SecurityScorecard’s STRIKE Threat Intelligence Unit analyzed 1000 cyber breaches across industries and regions in 2024. It found that 35.5% of breaches were third-party related, up from 29% the previous year, representing a 6.5% increase."
https://www.infosecurity-magazine.com/news/securityscorecard-surge-third/
https://securityscorecard.com/resource/global-third-party-breach-report/
ETSI Launches New Standard For Quantum-Safe Hybrid Key Exchanges To Secure Future Post-Quantum Encryption
"Today, ETSI announces the launch of its post-quantum security standard to guarantee the protection of critical data and communications in the future. The specification “Efficient Quantum-Safe Hybrid Key Exchanges with Hidden Access Policies” (ETSI TS 104 015) has been developed to enhance security mechanisms, ensuring that only authorized users with the correct permissions can access sensitive data to decrypt them."
https://www.etsi.org/newsroom/press-releases/2513-etsi-launches-new-standard-for-quantum-safe-hybrid-key-exchanges-to-secure-future-post-quantum-encryption
https://www.etsi.org/deliver/etsi_ts/104000_104099/104015/01.01.01_60/ts_104015v010101p.pdf
https://www.infosecurity-magazine.com/news/etsi-quantum-safe-encryption/
ENISA Space Threat Landscape 2025
"The primary objective of this report is to identify and assess the cybersecurity threat landscape for commercial satellites – exploring both existing and emerging challenges for the industry. This is achieved by focusing on cybersecurity aspects at each phase of the satellite lifecycle – development, deployment, operations, and decommissioning, and the stakeholders involved."
https://www.enisa.europa.eu/publications/enisa-space-threat-landscape-2025
https://www.enisa.europa.eu/sites/default/files/2025-03/Space_Threat_Landscape_Report_fin.pdf
https://www.infosecurity-magazine.com/news/enisa-probes-space-threat/
PERSPECTIVE: 25 Years Of Evolving Information Sharing Into Actionable Intelligence
"The IT-ISAC is celebrating its 25th Anniversary this year. This has caused me to reflect on the new challenges we continue to face as a cybersecurity community. When I first joined the IT-ISAC in 2005, a leader of another ISAC (information sharing and analysis center) commented to me that his team would have a party every time a member shared information. In those early days, there was a dearth of even basic information about threat actors and attacks. Today, the challenge is reversed. So much information is available to analysts that it’s hard to keep track of it all and understand what is accurate and relevant. Rather than scouring any source possible for any type of threat intelligence, a key role of our analytic team is now to turn the vast amount of available information into curated intelligence our members can use."
https://www.hstoday.us/perspective/perspective-25-years-of-evolving-information-sharing-into-actionable-intelligence/

อ้างอิง
Electronic Transactions Development Agency(ETDA)