The ransomware group Qilin has been highly active in 2025, publishing over 40 victim cases per month on its leak site. Manufacturing, professional services, and wholesale trade are the most affected sectors. Attackers likely originate from Eastern Europe or Russian-speaking regions. They use tools like Cyberduck for data exfiltration and leverage notepad.exe and mspaint.exe to view sensitive information. The attack flow includes initial VPN access, reconnaissance, credential theft, lateral movement, and ransomware deployment. Two encryptors are often used: one spread via PsExec and another targeting network shares. The ransomware encrypts files, deletes backups, and leaves ransom notes. Persistence is achieved through scheduled tasks and registry modifications.
The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting Windows Server machines primarily in government, financial, and industrial sectors across Asia, Africa, and Latin America. Attackers gain initial access by exploiting SQL servers and deploy custom implants such as Neursite and NeuralExecutor. These implants employ advanced persistence, evasion, and command execution techniques, using a multi-stage loading process and diverse communication protocols for command and control (C2). Although attribution is uncertain, indicators suggest possible links to Chinese-speaking threat actors. The campaign highlights the critical need for robust server security and continuous monitoring to detect complex multi-stage intrusions. No known exploits are currently in the wild, and the campaign is rated medium severity. The focus on Windows Server environments and SQL exploitation techniques underscores the risk to organizations relying on these technologies.
Conti, a notorious ransomware operation identified in 2019, quickly gained infamy for its advanced encryption, rapid lateral movement, and double extortion tactics. Operated by the Russia-based Wizard Spider group, Conti evolved from Ryuk ransomware and maintained suspected ties to Russian state interests. Between 2019 and 2022, Conti targeted healthcare providers, governments, educational institutions, critical infrastructure, and private businesses, earning an estimated $180 million in 2021. Their aggressive tactics highlighted the urgent need for strong cybersecurity defenses. In 2022, internal divisions arose following leaked private chats. Conti's operations mimicked legitimate businesses, showcasing the industrialization of cybercrime and its devastating impact on critical sectors.
Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortion campaigns, leveraging compromised websites and multi-stage social engineering techniques to deliver payloads. Interlock's attack chain involves initial access through fake software updaters, execution of PowerShell scripts, and the use of custom remote access trojans. The group has targeted various sectors across North America and Europe, including education, healthcare, technology, and government entities. Notable attacks include the DaVita breach in April 2025 and the ransomware attack on the city of St. Paul, Minnesota in July 2025.
From September to December 2024, incidents involving CrossC2, an extension tool for Cobalt Strike Beacon on Linux, were confirmed. The attacker used CrossC2 along with other tools like PsExec, Plink, and Cobalt Strike to penetrate AD. A custom malware called ReadNimeLoader was used as a loader for Cobalt Strike. The campaign may have affected multiple countries. CrossC2 is an unofficial Beacon and builder compatible with Cobalt Strike 4.1+, designed for Linux and macOS. It contains anti-analysis features and encrypted configuration data. The attack flow involved java.exe, ReadNimeLoader, and OdinLdr to execute Cobalt Strike Beacon. Other tools used include SystemBC, GetNPUsers, and privilege escalation tools. The campaign shows potential connections to BlackBasta based on similar characteristics.
An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embedded payload, and injects a Cobalt Strike beacon. The beacon is configured to mimic Bilibili traffic and communicates with a specific C2 server. The loader also patches the entry point of the loading executable with an infinite loop. This activity shares similarities with previously reported SLOW#TEMPEST campaigns, including targeting, folder structures, and the use of DLL sideloading for Cobalt Strike beacons.
Chinese cyberespionage group APT41 conducted a targeted attack against government IT services in Africa. The attackers used various tools including Impacket, Cobalt Strike, and custom malware for lateral movement, privilege escalation, and data exfiltration. They leveraged DLL sideloading techniques and a compromised SharePoint server as a command and control center. The attack involved credential harvesting, use of web shells, and custom stealers to collect sensitive data. Notable TTPs included using hardcoded internal service names and proxy servers in malware, and exploiting a captive SharePoint server for C2 communication. The incident highlights the importance of comprehensive infrastructure monitoring and proper access controls.
Silent Lynx, a persistent cyber espionage threat actor, has conducted targeted intrusion campaigns against government ministries, diplomatic missions, and civil society organizations across Central Asia since 2024. The group focuses on high-value public sector organizations in Commonwealth of Independent States countries, leveraging spear-phishing campaigns through compromised government email accounts and malware staging via GitHub. Operations from late 2024 through 2026 reveal extensive infrastructure including exposed open directories, newly registered domains, and GitHub repositories. The actor employs lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity shows adoption of exploit-assisted delivery via CVE-2025-8088, expanding focus on Linux systems, and interest in FortiWeb vulnerability CVE-2025-25257. Attribution indicators point to Russian-speaking operators likely based in Kazakhstan, with targeting concentrated on water resources, environmenta...
Operation DRAGONCLONE is an advanced cyber espionage campaign active since March 2025 targeting China Mobile Tietong and potentially European telecom organizations connected to Chinese infrastructure. It employs sophisticated malware loaders such as VELETRIX and the VShell adversary simulation tool, delivered via malicious ZIP files exploiting DLL sideloading and anti-analysis techniques like IPFuscation. The campaign is linked to China-nexus threat groups UNC5174 (Uteus) and Earth Lamia and uses tools including SuperShell, Cobalt Strike, and Asset Lighthouse System. Its objectives include credential theft, network reconnaissance, and callback execution. Germany, France, and the UK are identified as higher-risk countries due to their telecom sectors and economic ties to China. The threat is assessed as high severity given its advanced evasion techniques and espionage intent.
Earth Lamia is an advanced persistent threat (APT) actor active since 2023, targeting organizations primarily in Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, notably SQL injection, to gain initial access. They have developed custom malware tools such as the PULSEPACK backdoor and BypassBoss for privilege escalation. Their targeting has evolved from financial services to logistics, online retail, IT companies, universities, and government organizations. Techniques used include DLL sideloading, leveraging legitimate binaries, and modular backdoor deployment. The group's campaigns are linked to other reported activities, indicating a sophisticated and evolving threat actor.
A remote code execution zero-day vulnerability (CVE-2025-0994) in Cityworks, an asset management system, is actively exploited by a Chinese-speaking threat group called UAT-6382. The attacks, ongoing since January 2025, target local government utilities management systems in the United States. The attackers deploy web shells such as AntSword and Chopper, and use custom Rust-based loaders named TetraLoader to deliver Cobalt Strike beacons and VSHell malware. Their operations include reconnaissance, directory enumeration, and staging files for exfiltration. This activity demonstrates a high level of sophistication and language proficiency consistent with Chinese origin threat actors.
A threat actor campaign observed in late 2023 and early 2024 targeted multiple regions, initially in the Far East and later Sweden, using DLL sideloading techniques combined with the Minhook library to intercept Windows API calls. The attackers leveraged compromised digital signatures, including an expired signature from a Korean game developer, to sign components and evade detection. The final payload deployed was Cobalt Strike, a known post-exploitation tool. Three distinct sideloading scenarios were identified: MiracastView, PrintDialog, and SystemSettings. The clean loader used in the attack was sourced from infected systems rather than bundled with the sideloading package, complicating detection. Indicators include multiple file hashes and suspicious domains. This campaign demonstrates sophisticated use of API hooking and sideloading to maintain persistence and evade security controls, posing a medium severity risk to affected organizations, especially in Sweden.
