Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs
Source: https://thehackernews.com/2025/09/mustang-panda-deploys-snakedisk-usb.html
In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.
North Korea’s Kimsuky Group Uses AI-Generated Military IDs in New Attacks
Source: https://hackread.com/north-korea-kimsuky-group-ai-generated-military-ids/
Two cyber criminal groups, UNC6040 and UNC6395, are targeting organizations' Salesforce platforms for data theft and extortion. UNC6040 uses social engineering, particularly voice phishing, to gain access to Salesforce accounts. They trick employees into granting access or sharing credentials, then use API queries or malicious connected apps to exfiltrate data. UNC6395 exploits compromised OAuth tokens for the Salesloft Drift application to access Salesforce instances. Both groups have been observed exfiltrating large volumes of customer data. Victims of UNC6040 have received extortion emails demanding cryptocurrency payments to prevent data publication. The FBI has provided numerous IP addresses and other indicators of compromise associated with these groups, along with recommended mitigations to enhance security and prevent such attacks.
The 15th September 2025 Threat Intelligence Report by Check Point Research highlights multiple significant cyber threats including ransomware attacks, data breaches, and critical vulnerabilities. Notably, Panama’s Ministry of Economy and Finance suffered a ransomware attack with theft of 1.5TB of sensitive fiscal data by the INC Ransom group. Other incidents include breaches impacting Vietnam’s financial sector, US organizations, and a British train operator via third-party compromise. Critical vulnerabilities such as a SonicWall SSL VPN improper access control flaw (CVSS 9.3) actively exploited by Akira ransomware operators pose severe risks. Emerging threats include new ransomware families like Yurei, supply chain attacks via malicious VS Code extensions, and malware targeting exposed Docker APIs. The report underscores a global surge in ransomware and targeted attacks on government, finance, manufacturing, and critical infrastructure sectors. European organizations face heightened risks due to interconnected supply chains, reliance on affected technologies, and geopolitical tensions. Proactive patching, supply chain security, and advanced threat detection are essential to mitigate these evolving threats.
INC ransom group claimed the breach of Panama’s Ministry of Economy and Finance
Source: https://securityaffairs.com/182203/data-breach/panamas-ministry-of-economy-and-finance-data-breach.html
New VoidProxy Phishing Service Bypasses MFA on Microsoft and Google Accounts
Source: https://hackread.com/voidproxy-phishing-service-bypasses-mfa-microsoft-google/
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks
Source: https://thehackernews.com/2025/09/fbi-warns-of-unc6040-and-unc6395.html
Yurei, a newly emerged ransomware group, targeted a Sri Lankan food manufacturing company on September 5, 2025. The group employs a double-extortion model, encrypting files and exfiltrating sensitive data. Check Point Research discovered that Yurei's ransomware is based on the open-source Prince-Ransomware, with minor modifications. The ransomware, written in Go, contains a flaw allowing partial recovery through Shadow Copies. Since its first victim, Yurei has quickly expanded to three victims across Sri Lanka, India, and Nigeria. The investigation suggests the threat actor may originate from Morocco. Yurei's operation demonstrates how open-source malware lowers the entry barrier for cybercriminals, enabling less-skilled actors to launch ransomware attacks.
This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It employs advanced anti-analysis methods, including anti-VM checks and registry manipulation. The final payload, typically an infostealer like NekoStealer or Lumma, is delivered via a multi-stage process involving packed .NET executables and protected DLLs. The loader's evolution and its role in the broader malware-as-a-service ecosystem underscore the need for organizations to focus on detecting initial access and intermediate stages rather than just final payloads.
Key Points Yurei Ransomware Check Point Research discovered a new ransomware group on September 5. The group calls themselves Yurei (a sort of spirit in Japanese folklore), and initially listed one victim, a Sri Lankan food manufacturing company, on their darknet blog. These blogs are used by ransomware groups to list their victims, show proofs […] The post Yurei & The Ghost of Open Source Ransomware appeared first on Check Point Research .
UK train operator LNER (London North Eastern Railway) discloses a data breach
Source: https://securityaffairs.com/182128/data-breach/uk-train-operator-lner-london-north-eastern-railway-discloses-a-data-breach.html
U.S. CISA adds Dassault Systèmes DELMIA Apriso flaw to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/182120/hacking/u-s-cisa-adds-dassault-systemes-delmia-apriso-flaw-to-its-known-exploited-vulnerabilities-catalog.html
In 2025, a significant surge in phishing attacks targeting major U.S.energy companies was observed. The campaign primarily focused on Chevron, ConocoPhillips, PBF Energy, and Phillips 66, utilizing sophisticated impersonation techniques. Attackers employed HTTrack-based cloning to replicate legitimate websites, creating over 1,465 phishing domains. The infrastructure was distributed across multiple hosting providers and countries to evade takedowns. Notably, Chevron faced the highest volume of impersonation attempts with 158 fake domains. The phishing sites combined credential harvesting with investment scam frameworks, enhancing their profitability. Many malicious domains showed low detection rates across security vendors, exposing gaps in current defense systems. The analysis highlights the need for improved threat intelligence integration and faster mitigation strategies in the energy sector.
In mid-2025, China-aligned threat actor Hive0154 deployed new malware variants, including an updated Toneshell backdoor and a novel USB worm called SnakeDisk. Toneshell9 evades detection and supports C2 communication through local proxies. SnakeDisk only executes on devices in Thailand, propagating via USB drives and dropping the Yokai backdoor. The malware shows code overlaps with previous Tonedisk variants. Hive0154 continues to refine its large malware arsenal, targeting organizations worldwide with frequent development cycles. The group uses multiple custom loaders, backdoors, and USB worm families, showcasing advanced capabilities. Defenders should monitor for suspicious network activity, USB drives with hidden components, and implement recommended security measures to mitigate risks from this evolving threat.
