Cyber Threat Intelligence 31 March 2025
-
Healthcare Sector
- Claroty’s State Of CPS Security Report: Healthcare Exposures 2025
"Hospitals and healthcare delivery organizations must manage a barrage of risks to connected medical devices and critical OT systems, protecting them from disruptions that could impact patient safety and the uninterrupted availability of patient care. This is the backdrop for Claroty’s latest State of CPS Security Report: Healthcare Exposures 2025. The goal of this report is to shed light on the riskiest exposures facing healthcare devices and networks—as well as OT within hospitals—provide some context to help identify those assets most in jeopardy, and demonstrate the number of devices burdened not only by known and exploited vulnerabilities, but those that are most at risk to ransomware and extortion attacks, and insecurely connected to the internet."
https://claroty.com/blog/clarotys-state-of-cps-security-report-healthcare-exposures-2025
https://claroty.com/resources/reports/state-of-cps-security-healthcare-exposures-2025
https://www.securityweek.com/critical-condition-legacy-medical-devices-remain-easy-targets-for-ransomware/
https://www.infosecurity-magazine.com/news/healthcare-vulnerable-iot-devices/
https://www.helpnetsecurity.com/2025/03/28/healthcare-devices-vulnerabilities/
New Tooling
- Cloudflare Open Sources OPKSSH To Bring Single Sign-On To SSH
"OPKSSH (OpenPubkey SSH) makes it easy to authenticate to servers over SSH using OpenID Connect (OIDC), allowing developers to ditch manually configured SSH keys in favor of identity provider-based access. By tightly integrating with identity providers (IdPs) and avoiding any additional trusted third party, OPKSSH offers a streamlined and secure way to manage SSH authentication. This week, OPKSSH was officially open-sourced under the umbrella of the OpenPubkey project. While OpenPubkey itself became a Linux Foundation open-source initiative in 2023, OPKSSH remained closed-source until now."
https://www.helpnetsecurity.com/2025/03/28/opkssh-sso-ssh/
https://github.com/openpubkey/opkssh/
Vulnerabilities
- Qualys TRU Discovers Three Bypasses Of Ubuntu Unprivileged User Namespace Restrictions
"Qualys TRU uncovered three distinct bypasses of these namespace restrictions, each enabling local attackers to create user namespaces with full administrative capabilities. These bypasses facilitate exploiting vulnerabilities in kernel components requiring powerful administrative privileges within a confined environment. The restrictions on unprivileged user namespaces were initially introduced in Ubuntu 23.10 and enabled by default in Ubuntu 24.04. It is important to note that these bypasses alone do not enable complete system takeover; however, they become dangerous when combined with other vulnerabilities, typically kernel-related."
https://blog.qualys.com/vulnerabilities-threat-research/2025/03/27/qualys-tru-discovers-three-bypasses-of-ubuntu-unprivileged-user-namespace-restrictions
https://www.bleepingcomputer.com/news/security/new-ubuntu-linux-security-bypasses-require-manual-mitigations/
Malware
- CISA Releases Malware Analysis Report On RESURGE Malware Associated With Ivanti Connect Secure
"CISA has published a Malware Analysis Report (MAR) with analysis and associated detection signatures on a new malware variant CISA has identified as RESURGE. RESURGE contains capabilities of the SPAWNCHIMERA[1] malware variant, including surviving reboots; however, RESURGE contains distinctive commands that alter its behavior."
https://www.cisa.gov/news-events/alerts/2025/03/28/cisa-releases-malware-analysis-report-resurge-malware-associated-ivanti-connect-secure
https://www.cisa.gov/news-events/analysis-reports/ar25-087a
https://thehackernews.com/2025/03/resurge-malware-exploits-ivanti-flaw.html
https://securityaffairs.com/176040/breaking-news/cisa-warns-of-resurge-malware-exploiting-ivanti-flaw.html - Gamaredon Campaign Abuses LNK Files To Distribute Remcos Backdoor
"The invasion of Ukraine is a common theme used by the Gamaredon group in their phishing campaigns and this campaign continues the use of this technique. The actor distributes LNK files compressed inside ZIP archives, usually disguising the file as an Office document and using names that are related to the invasion. Although Talos was not able to pinpoint the exact method by which these files are distributed, it is likely that Gamaredon continues to send phishing e-mails with either the ZIP file directly attached to it or containing a URL link to download the file from a remote host."
https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/ - TsarBot: A New Android Banking Trojan Targeting Over 750 Banking, Finance, And Cryptocurrency Applications
"Cyble Research and Intelligence Labs (CRIL) discovered a new Android banking trojan that uses an overlay attack to target over 750 applications, including banking, finance, cryptocurrency, payment, social media, and e-commerce applications, across multiple regions. While the malware mainly utilizes overlay attacks to steal credentials, it also carries out various other malicious actions. It is capable of recording and remotely controlling the screen, enabling attackers to monitor and manipulate the device. Additionally, it employs lock-grabbing techniques, keylogging, and intercepting SMS messages."
https://cyble.com/blog/tsarbot-using-overlay-attacks-targeting-bfsi-sector/ - Stealing User Credentials With Evilginx
"Evilginx, a tool based on the legitimate (and widely used) open-source nginx web server, can be used to steal usernames, passwords, and session tokens, allowing an attacker to potentially bypass multifactor authentication (MFA). In this post, we’ll demonstrate how evilginx works and what information it is able to acquire; we also have advice for detecting this tool in use, as well as potential mitigations against its use."
https://news.sophos.com/en-us/2025/03/28/stealing-user-credentials-with-evilginx/
https://www.darkreading.com/endpoint-security/evilginx-bypasses-mfa - Russian Intelligence Service-Backed Campaigns Impersonate The CIA To Target Ukraine Sympathizers, Russian Citizens And Informants
"The rise in cyberattacks during ongoing conflicts of war has become a significant concern in recent years, especially as cyber capabilities are increasingly being leveraged as a form of modern warfare. Motivations behind these cyberattacks vary, from disrupting an opponent’s operations and causing widespread panic to gathering intelligence and creating strategic advantages. Silent Push Threat Researchers have identified phishing pages on a known bulletproof hosting provider, Nybula LLC, ASN 401116, but a financial motive has not yet been found for the threat actor group. The phishing pages appear to impersonate the official websites of multiple organizations, including the U.S. Central Intelligence Agency (CIA), the Russian Volunteer Corps (RVC), Legion Liberty, and the appeals hotline group Hochuzhit."
https://www.silentpush.com/blog/russian-intelligence-phishing/
https://hackread.com/russia-phishing-fake-cia-sites-anti-war-ukraine-supporters/ - Grandoreiro Trojan Distributed Via Contabo-Hosted Servers In Phishing Campaigns
"Cybercriminals are reviving the Grandoreiro banking trojan. It is actively being used in large-scale phishing campaigns, primarily targeting banking users in Latin America and Europe. Cybercriminals are leveraging VPS hosting providers and obfuscation techniques to evade detection. The malware continuously adapts, using dynamic URLs and social engineering to maximize its reach and effectiveness."
https://www.forcepoint.com/blog/x-labs/grandoreiro-trojan-targets-mexico-argentina-spain
https://www.securityweek.com/fresh-grandoreiro-banking-trojan-campaigns-target-latin-america-europe/
https://securityaffairs.com/175964/malware/crooks-are-reviving-the-grandoreiro-banking-trojan.html - A Deep Dive Into Water Gamayun’s Arsenal And Infrastructure
"Water Gamayun, a suspected Russian threat actor also known as EncryptHub and Larva-208, has been exploiting the MSC EvilTwin (CVE-2025-26633), a zero-day vulnerability that was patched on March 11. In the first installment of this two-part series, Trend Research discussed in depth its discovery of an Water Gamayun campaign exploiting this vulnerability. In this blog entry, we will cover the various delivery methods, custom payloads and techniques used by Water Gamayun to compromise victim systems and exfiltrate sensitive data."
https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html - Iran's MOIS-Linked APT34 Spies On Allies Iraq & Yemen
"Hackers believed to be working on behalf of Iranian government intelligence have been spying on organizations in Iraq and Yemen. In many other respects — religiously, politically, economically, etc. — these countries might be considered allies. But as it is with friends of the US, North Korea, and other major cyber powers, diplomatic ties with Iran do not preclude attempts at cyberespionage."
https://www.darkreading.com/cyberattacks-data-breaches/irans-mois-linked-apt34-spies-allies-iraq-yemen - SnakeKeylogger: A Multistage Info Stealer Malware Campaign
"Info-stealer malware has become a growing threat, with attackers constantly refining their techniques to evade detection. Among these threats, SnakeKeylogger has emerged as one of the highly active credential-stealing malware, targeting individuals and businesses. Known for its multi-stage infection chain and stealthy in-memory execution, SnakeKeylogger is designed to harvest sensitive data while remaining undetected. Recently, at Seqrite Labs, we observed an interesting malicious campaign delivering SnakeKeylogger as a final payload to compromised systems."
https://www.seqrite.com/blog/snakekeylogger-a-multistage-info-stealer-malware-campaign/ - SquareX Discloses Browser-Native Ransomware That Puts Millions At Risk
"From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging cyberthreats to plague enterprises. Chainalysis estimates that corporations spend nearly $1 billion dollars on ransom each year, but the greater cost often comes from the reputational damage and operational disruption caused by the attack."
https://hackread.com/squarex-discloses-browser-native-ransomware-that-puts-millions-at-risk/
https://sqrx.com/browser-native-ransomware - Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices
"The mobile threat landscape has been shaped over the years by well-established banking Trojan families such as Anatsa, Octo, Hook, each evolving to introduce new techniques for evading detection and maximising financial gain. These malware strains have demonstrated how effective mobile-focused threats can be, particularly when equipped with capabilities like overlay attacks, keylogging, and abuse of Android’s Accessibility Services. Their success has not only impacted banks and crypto platforms globally, but also has inspired a growing underground market hungry for similar or improved tools."
https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices
https://thehackernews.com/2025/03/new-android-trojan-crocodilus-abuses.html
https://www.bleepingcomputer.com/news/security/new-crocodilus-malware-steals-android-users-crypto-wallet-keys/
https://securityaffairs.com/175976/malware/new-sophisticate-crocodilus-mobile-banking-trojan.html
Breaches/Hacks/Leaks
- Twitter (X) Hit By 2.8 Billion Profile Data Leak In Alleged Insider Job
"A data leak involving a whopping 2.87 billion Twitter (X) users has surfaced on the infamous Breach Forums. According to a post by a user named ThinkingOne, the leak is the result of a disgruntled X employee who allegedly stole the data during a period of mass layoffs. If true, this would be the largest social media data leak in history, but surprisingly, neither X nor the broader public appears to be aware of it."
https://hackread.com/twitter-x-of-2-8-billion-data-leak-an-insider-job/ - Retail Giant Sam’s Club Investigates Clop Ransomware Breach Claims
"Sam's Club, an American warehouse supermarket chain owned by U.S. retail giant Walmart, is investigating claims of a Clop ransomware breach. The Walmart division operates over 600 warehouse clubs with millions of members across the United States and Puerto Rico and almost 200 additional locations in Mexico and China. Sam's Club has over 2.3 million employees and reported a total revenue of $84.3 billion for the fiscal year ending January 31, 2023."
https://www.bleepingcomputer.com/news/security/retail-giant-sams-club-investigates-clop-ransomware-breach-claims/
https://securityaffairs.com/175999/cyber-crime/sams-club-investigates-alleged-cl0p-ransomware-breach.html - Oracle Health Breach Compromises Patient Data At US Hospitals
"A breach at Oracle Health impacts multiple US healthcare organizations and hospitals after a threat actor stole patient data from legacy servers. Oracle Health has not yet publicly disclosed the incident, but in private communications sent to impacted customers and from conversations with those involved, BleepingComputer confirmed that patient data was stolen in the attack."
https://www.bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals/ - Cardiff's Children's Chief Confirms Data Leak 2 Months After Cyber Risk Was 'escalated'
"Cardiff City Council's director of children's services says data was leaked or stolen from the organization, although she did not clarify how or what was pilfered. Deborah Driffield confirmed a "data breach" while giving an update to the Welsh council's Governance and Audit Committee, which assembled on Tuesday. "We have had a data breach that we are currently managing, and drawing up new arrangements in relation to this world of people stealing data and sharing it on the dark web, and trying to understand how we can mitigate against that."
https://www.theregister.com/2025/03/28/cardiff_childrens_chief_says_city/
General News
- Navigating Cyber-Risks And New Defenses
"Cyberattacks on critical infrastructure are on the rise, driven by supply chain vulnerabilities, bad actors exploiting small and midsize businesses (SMBs) as entry points into larger organizations, and the rapid pace of digitalization. Internet of Things (IoT) devices have connected industrial settings and physical environments to digital networks, enhancing monitoring and management. But this connectivity has also introduced new entry points for cyber threats. In 2025, the threat of cyberattacks on critical infrastructure most likely will remain significant. However, continued advancements and adoption of technologies like artificial intelligence (AI) and private networks can serve as powerful countermeasures."
https://www.darkreading.com/vulnerabilities-threats/navigating-cyber-risks-new-defenses - Student-Powered SOCs Train Security's Next Generation
"Higher educational institutions are among the most common targets of cyberattacks in the US, but universities increasingly see a silver lining to the threat landscape: Defending against such attacks can be a good training opportunity for the next generation of cybersecurity professionals. The cybersecurity incidents are usually fairly simple — a phishing attack, a bad password, or suspicious network traffic — and can be handled by student analysts, such as Ellen Hoffman, an industrial engineering student at Louisiana State University."
https://www.darkreading.com/cybersecurity-operations/student-powered-socs-train-security-next-generation - Android Financial Threats: What Businesses Need To Know To Protect Themselves And Their Customers
"The rise of mobile banking has changed how businesses and customers interact. It brought about increased convenience and efficiency, but has also opened new doors for cybercriminals, particularly on the Android platform, which dominates the global smartphone market. According to ESET research, Android financial threats, targeting banking apps and cryptocurrency wallets, grew by 20% in H2 of 2024 compared to the first half of the year."
https://www.helpnetsecurity.com/2025/03/28/android-financial-threats/ - Cybersecurity Spending Set To Jump 12.2% In 2025
"Global cybersecurity spending is expected to grow by 12.2% in 2025, according to the latest forecast from the IDC Worldwide Security Spending Guide. The rise in cyber threats is pushing organizations to invest more in their defenses. AI tools are making these threats more sophisticated, which is adding to the urgency. IDC says this steady climb in spending will continue through 2028, hitting $377 billion by then."
https://www.helpnetsecurity.com/2025/03/28/idc-cybersecurity-spending-2025/ - U.S. Seized $8.2 Million In Crypto Linked To 'Romance Baiting' Scams
"The U.S. Department of Justice (DOJ) has seized over $8.2 million worth of USDT (Tether) cryptocurrency that was stolen via 'romance baiting' scams. Previously referred to as 'pig butchering,' in this type of financial fraud victims are manipulated into making investments on fraudulent websites/apps that showcase massive returns. Convinced they're making a profit, the victims invest increasing amounts, but when they attempt to make any significant withdrawals, they hit various problems that prevent them from completing the action."
https://www.bleepingcomputer.com/news/cryptocurrency/us-seized-82-million-in-crypto-linked-to-romance-baiting-scams/
https://securityaffairs.com/175990/cyber-crime/fbi-and-doj-seize-8-2-million-in-romance-baiting-crypto-fraud-scheme.html - Malware In Lisp? Now You're Just Being Cruel
"Malware authors looking to evade analysis are turning to less popular programming languages like Delphi or Haskell. Computer scientists affiliated with the University of Piraeus and Athena Research Center in Greece and Delft University of Technology in the Netherlands have taken a look at recent malware to better understand why some of it gets missed by static analysis – a software testing technique for understanding code without executing it."
https://www.theregister.com/2025/03/29/malware_obscure_languages/
https://arxiv.org/abs/2503.19058
อ้างอิง
Electronic Transactions Development Agency(ETDA)
- Claroty’s State Of CPS Security Report: Healthcare Exposures 2025
