This analysis examines the Bookworm malware family and its connection to the Chinese APT group Stately Taurus. Using a structured attribution framework, the study evaluates tactics, tooling, operational security, infrastructure, victimology and timelines to establish a high-confidence link between Bookworm and Stately Taurus. Key evidence includes shared program database paths, overlapping command and control infrastructure, and consistent targeting of Southeast Asian governments. The framework assigns scores to each piece of evidence, resulting in an overall attribution confidence score of 58.4 out of 100, indicating strong confidence in the connection. This systematic approach aims to improve analytical rigor and collaboration in threat intelligence.
Critical CVSS 10 Flaw in GoAnywhere File Transfer Threatens 20,000 Systems
Source: https://hackread.com/critical-cvss-10-flaw-goanywhere-file-transfer/
This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The researchers developed hunting strategies based on API key detection and prompt analysis, leading to the discovery of new samples, including 'MalTerminal'. The implications for defenders are discussed, highlighting both the adaptability and potential brittleness of LLM-enabled malware. The research also uncovered various offensive tools leveraging LLMs for operational capabilities.
I’ve been seeing more and more cases where the SOC reports success, process killed, host isolated, dashboard green. Yet weeks later the same organisation is staring at ransom notes or data leaks.
The problem: we treat every alert like a dodgy PDF. Malware was contained. The threat actor was not.
SOCs measure noise (MTTD, MTTR, auto-contain). Adversaries measure impact (persistence, privilege, exfiltration). That’s why even fully “security-compliant” companies lose millions every day. Look at what's happening in the UK.
Curious how others here are approaching this:
* Do you have workflows that pivot from containment to investigation by default?
* How do you balance speed vs depth when you suspect a human adversary is involved?
* Are you baking forensic collection into SOC alerts, or leaving it for the big crises?
Full piece linked for context.
Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
Source: https://thehackernews.com/2025/09/chinese-hackers-rednovember-target.html
RedNovember, a Chinese state-sponsored threat group, has expanded its cyber-espionage activities globally. The group targets high-profile government, intergovernmental, and private sector organizations, focusing on defense, aerospace, and technology sectors. It uses the Go-based backdoor Pantegana and Cobalt Strike for intrusions, exploiting vulnerabilities in perimeter appliances. RedNovember's tactics include combining weaponized proof-of-concept exploits with open-source tools, allowing for scalable operations and attribution obfuscation. The group has shown particular interest in targets across the US, Taiwan, South Korea, and Panama, often aligning its activities with geopolitical events and Chinese strategic interests.
UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors
Source: https://thehackernews.com/2025/09/unc5221-uses-brickstorm-backdoor-to.html
New YiBackdoor Malware Shares Major Code Overlaps with IcedID and Latrodectus
Source: https://thehackernews.com/2025/09/new-yibackdoor-malware-shares-major.html
In late July 2025, an organized APT attack using shortcut files was discovered, attributed to the North Korean Kimsuky group. The attackers distribute decoy zip files containing password-protected documents and a disguised shortcut file. When executed, it connects to a C2 server, downloads encrypted payloads, and performs various malicious activities. These include collecting sensitive information from browsers, cryptocurrency wallets, messaging apps, and system files. The collected data is encrypted and sent to the C2 server, which can issue additional commands for remote execution. The attack employs anti-VM techniques and establishes persistence through registry modifications. It also includes a separate malicious DLL for browser process injection.
A campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new PlugX variant. The campaign, active since 2022, shows overlaps with RainyDay and Turian backdoors, including the abuse of legitimate applications for DLL sideloading and shared encryption methods. The new PlugX variant's configuration format resembles that of RainyDay, suggesting attribution to Naikon. Analysis of victimology and technical implementation indicates a potential connection between Naikon and BackdoorDiplomacy, possibly sourcing tools from the same vendor. The malware families use similar infection chains, loaders, and shellcode structures, with shared RC4 keys for payload decryption. This campaign highlights the evolving tactics of Chinese-speaking threat actors and the potential convergence of previously distinct groups.
Libraesva ESG issues emergency fix for bug exploited by state hackers
Source: https://www.bleepingcomputer.com/news/security/libraesva-esg-issues-emergency-fix-for-bug-exploited-by-state-hackers/
US Secret Service dismantled covert communications network near the U.N.in New York
Source: https://securityaffairs.com/182499/intelligence/us-secret-service-dismantled-covert-communications-network-near-the-u-n-in-new-york.html
Inc Ransomware Claims 5.7 TB of Data Theft at Pennsylvania Attorney General
Source: https://hackread.com/inc-ransomware-data-pennsylvania-attorney-general/
BadIIS Malware Spreads via SEO Poisoning — Redirects Traffic, Plants Web Shells
Source: https://thehackernews.com/2025/09/badiis-malware-spreads-via-seo.html
