In August 2025, APT attacks in South Korea primarily utilized spear phishing techniques, with LNK files being the most prevalent method. Two main types of attacks were observed: Type A, which used compressed CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which executed RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks targeted various sectors, employing sophisticated social engineering tactics and decoy documents to increase credibility. The malware performed actions such as keylogging, taking screenshots, and executing commands based on the threat actor's instructions. The report highlights the continuous evolution of APT tactics and the importance of vigilance against targeted phishing campaigns.
Research by: Antonis Terefos (@Tera0017) Key Points Introduction The Pure malware family is a suite of malicious tools developed and sold by the author known as PureCoder. This suite includes PureHVNC RAT (a remote administration tool and predecessor to PureRAT), PureCrypter (a malware obfuscator), PureLogs (a stealer/logger), and several other tools. The malicious software is advertised and distributed through underground forums, Telegram channels, and dedicated websites. […] The post Under the Pure Curtain: From RAT to Builder to Coder appeared first on Check Point Research .
LockerGoga Ransomware Admin on EU Most Wanted List With $10M DOJ Reward
Source: https://hackread.com/lockergoga-ransomware-eu-most-wanted-list-doj-reward/
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Source: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
SmokeLoader, a modular malware loader active since 2011, has resurfaced with new versions in 2025 after Operation Endgame suppressed its activity. The latest variants, 2025 alpha and 2025, include bug fixes and improvements to evade detection. Key changes include a new mutex check in the stager, modified mutex name generation, and updates to the main module. The network protocol has been slightly adjusted in version 2025, and the scheduled task name for persistence has been updated. These versions fix performance issues and include additional anti-analysis measures. Despite efforts to dismantle it, SmokeLoader continues to evolve and is used by multiple threat groups.
Google confirms fraudulent account created in law enforcement portal
Source: https://www.bleepingcomputer.com/news/security/google-confirms-hackers-gained-access-to-law-enforcement-portal/
Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs
Source: https://thehackernews.com/2025/09/mustang-panda-deploys-snakedisk-usb.html
A threat actor exploited a SonicWall VPN vulnerability to gain initial access to an organization's network. The attacker discovered plaintext Huntress recovery codes on a user's desktop, allowing them to bypass MFA and access the Huntress portal. They then proceeded to close active incident reports and uninstall Huntress agents from compromised systems. This incident highlights the critical importance of securely storing credentials and recovery codes. The attacker also exported certificates from the domain controller, potentially for further privilege escalation or persistence. The compromise was detected by Huntress' Security Operations Center, which initiated a mass isolation response to contain the threat. This case emphasizes the need for proper credential management and the risks associated with storing sensitive information in easily accessible plaintext files.
In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.
North Korea’s Kimsuky Group Uses AI-Generated Military IDs in New Attacks
Source: https://hackread.com/north-korea-kimsuky-group-ai-generated-military-ids/
The 15th September 2025 Threat Intelligence Report by Check Point Research highlights multiple significant cyber threats including ransomware attacks, data breaches, and critical vulnerabilities. Notably, Panama’s Ministry of Economy and Finance suffered a ransomware attack with theft of 1.5TB of sensitive fiscal data by the INC Ransom group. Other incidents include breaches impacting Vietnam’s financial sector, US organizations, and a British train operator via third-party compromise. Critical vulnerabilities such as a SonicWall SSL VPN improper access control flaw (CVSS 9.3) actively exploited by Akira ransomware operators pose severe risks. Emerging threats include new ransomware families like Yurei, supply chain attacks via malicious VS Code extensions, and malware targeting exposed Docker APIs. The report underscores a global surge in ransomware and targeted attacks on government, finance, manufacturing, and critical infrastructure sectors. European organizations face heightened risks due to interconnected supply chains, reliance on affected technologies, and geopolitical tensions. Proactive patching, supply chain security, and advanced threat detection are essential to mitigate these evolving threats.
INC ransom group claimed the breach of Panama’s Ministry of Economy and Finance
Source: https://securityaffairs.com/182203/data-breach/panamas-ministry-of-economy-and-finance-data-breach.html
The Kimsuky APT group has launched a sophisticated spear-phishing campaign using AI-generated deepfake military ID cards to target South Korean defense institutions. The attack impersonates military employee ID issuance processes and exploits ChatGPT to create convincing fake ID images. The malware employs obfuscated batch files and AutoIt scripts to evade detection, connecting to command and control servers for further payload deployment. The campaign demonstrates the evolving tactics of state-sponsored threat actors in leveraging AI technologies for cyber espionage. Analysis reveals connections to previous Kimsuky operations targeting unification researchers and government agencies, highlighting the persistent nature of the threat.
600 GB of Alleged Great Firewall of China Data Published in Largest Leak Yet
Source: https://hackread.com/great-firewall-of-china-data-published-largest-leak/
WSASS - Old But Gold, Dumping LSASS With Windows Error Reporting On Modern Windows 11
Source: https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
