MuddyWater, an Iranian cyber espionage group, is deploying DCHSpy, an Android surveillance malware, amid the Israel-Iran conflict. DCHSpy is distributed through malicious VPN apps promoted on Telegram and can collect extensive data including WhatsApp messages, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have improved data exfiltration capabilities, particularly targeting WhatsApp and specific files. The malware uses lures related to StarLink to exploit internet outages in Iran. It shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This campaign poses significant espionage risks to Android users in targeted regions and conflict zones.
Chaos RAT is an open-source remote administration tool written in Golang that has evolved since 2022 to support both Linux and Windows platforms. A critical vulnerability identified as CVE-2024-30850 exists in its web control panel, allowing remote code execution on the server. Although currently limited in usage, Chaos RAT's low detection profile enables threat actors to perform espionage, data exfiltration, and maintain persistent access. The malware employs multiple techniques including privilege escalation, persistence, and command and control communications. Organizations should prioritize patching the vulnerable control panel, restrict access to administrative interfaces, and monitor for indicators of compromise. The threat is assessed as high severity due to its potential impact and ease of exploitation without user interaction. Patch status is not confirmed; no official fix or patch links are provided. The affected platforms include Linux and Windows systems. No specific countries are identified as targeted, but those with significant Linux and Windows server use and strategic geopolitical interests may be at higher risk.
The Mimo intrusion set is exploiting CVE-2024-46483, a Remote Code Execution vulnerability in Craft CMS, to deploy webshells and execute malicious payloads. The attack chain includes downloading infection scripts and deploying a loader, cryptominer (XMRig), and residential proxyware (IPRoyal) for financial gain. The group uses unique identifiers such as '4l4md4r' and 'n1tr0' and has been linked to operators 'EtxArny' and 'N1tr0'. Detection can focus on unusual processes in temporary directories and kernel module changes. The campaign targets Craft CMS installations globally, with a focus on financially motivated exploitation rather than geopolitical objectives. The threat is medium severity due to the impact on confidentiality and availability, ease of exploitation via RCE, and the scope of affected web servers. Organizations using Craft CMS should prioritize patching and monitoring for indicators of compromise.
