VulnHub

The latest Security Affairs Malware newsletter covers several significant malware threats that have emerged recently. Notably, a group identified as Stan Ghouls is targeting users in Russia and Uzbekistan using the NetSupport Remote Access Trojan (RAT), which allows attackers to control infected systems remotely. Another concerning development is the discovery of ZeroDayRAT, a new spyware designed to infiltrate both Android and iOS devices. Additionally, researchers have uncovered a Linux botnet named SSHStalker, which utilizes old-school IRC methods to compromise new victims. These activities demonstrate the evolving tactics of cybercriminals and emphasize the need for users and organizations to remain vigilant against these persistent threats.

A newly identified hacking group, suspected to be linked to Russian intelligence, has launched attacks against various Ukrainian sectors, including defense, government, and energy. This group is using a malware called CANFAIL, which was uncovered by researchers from Google Threat Intelligence Group. The targeting of critical infrastructure and military entities raises significant concerns about national security and the ongoing conflict in the region. As these attacks could disrupt essential services and information systems, the situation highlights the need for enhanced cybersecurity measures among the affected organizations. This incident is part of a broader pattern of cyber warfare tactics being employed against Ukraine.

North Korean hackers are running a fake recruiter scheme aimed at JavaScript and Python developers, using enticing cryptocurrency-related coding challenges to lure victims. These challenges often contain hidden malware designed to compromise the developers' systems. This tactic exploits the growing interest in cryptocurrency and the remote job market, making it especially appealing to tech professionals looking for work. Developers who engage with these fake opportunities risk not only their personal data but also their work environments, as the malware can lead to further security breaches. Awareness of these scams is crucial for developers to protect themselves from potential attacks.

A new threat actor known as UAT-9921 has been targeting the technology and financial services sectors using a malware framework called VoidLink. Cisco Talos researchers discovered that UAT-9921 has been active since at least 2019, though this is the first time they have employed VoidLink in their attacks. The malware's modular design suggests it can be adapted for various purposes, raising concerns about its potential to evolve and impact a wide range of systems within these industries. Companies in the tech and finance sectors should be vigilant and enhance their security measures to defend against this emerging threat. The situation highlights the ongoing challenges organizations face in protecting sensitive information from sophisticated cyber attacks.

The Dutch National Police have arrested a 21-year-old man from Dordrecht in connection with the distribution of a malicious tool known as JokerOTP. This bot is designed to intercept one-time passwords (OTPs), which are commonly used to secure online accounts and financial transactions. Authorities believe the suspect was selling the bot through a Telegram account and possessed license keys related to it. This arrest is part of a broader effort by police to combat cybercrime and follows two previous arrests in the same investigation. The use of tools like JokerOTP poses significant risks to individuals and organizations, as it can facilitate unauthorized access to sensitive information and financial resources.

Researchers have identified a series of malicious packages in both the npm and Python Package Index (PyPI) repositories, linked to a recruitment-themed campaign by the Lazarus Group, which is associated with North Korea. This operation, dubbed graphalgo, reportedly began in May 2025, aiming to trick developers into downloading harmful software disguised as legitimate packages. The malicious payloads can compromise user systems and potentially lead to data theft or other cybercrimes. Developers using these package repositories should be particularly cautious and verify the authenticity of packages before installation, as this incident emphasizes the ongoing risks associated with open-source software ecosystems. Awareness and vigilance are crucial for maintaining security in the software development community.

North Korean hackers have launched a sophisticated campaign targeting cryptocurrency firms by using deepfake video calls to impersonate legitimate company representatives. These attackers have stolen Telegram accounts and are conducting fake Zoom meetings to trick users into installing infostealer malware. This malware is designed to harvest sensitive information, which could lead to significant financial losses for the affected companies. The use of deepfake technology in these scams highlights a concerning trend in cybercrime, where attackers are becoming increasingly adept at using advanced tactics to deceive their targets. Cryptocurrency firms, already vulnerable to various cyber threats, must remain vigilant against such innovative attack methods.

Researchers have recently identified a new strain of malware named React2Shell, which has infected over 90 hosts. This malware, discovered through a Docker honeypot, is primarily used for cryptojacking, a practice where attackers hijack computing resources to mine cryptocurrency without the owner's consent. The emergence of React2Shell signals a growing trend in the use of artificial intelligence to create more sophisticated malware. Organizations need to be vigilant about their Docker environments and ensure they have robust security measures in place to protect against such threats. The impact of this malware could lead to significant financial losses for businesses if their systems are compromised.

A new botnet named SSHStalker has emerged, targeting Linux servers and infecting around 7,000 systems. This botnet exploits vulnerabilities from older 2009-era software, utilizing IRC bots and mass-scanning techniques to gain access. Researchers from Flare discovered SSHStalker while monitoring SSH honeypots over a two-month period, specifically using weak credentials to attract attackers. The presence of this botnet underscores the ongoing risk posed by outdated security measures, especially for systems that have not been updated in years. Users and administrators of Linux servers need to be vigilant and ensure their systems are secure against such legacy exploits.

A North Korea-associated hacking group known as UNC1069 is targeting cryptocurrency organizations to steal sensitive information from both Windows and macOS systems. Their approach involves social engineering tactics, including the use of a compromised Telegram account to set up a fake Zoom meeting. This deception leads victims to download malware through a method called ClickFix, which researchers believe may also utilize AI-generated content to enhance its effectiveness. The implications of these attacks are significant, as they not only threaten the financial security of targeted companies but also highlight the evolving tactics used by cybercriminals in the cryptocurrency sector. Protecting against such sophisticated schemes is increasingly critical for organizations in this space.

A recent cybersecurity incident has raised concerns involving multiple companies, including Ivanti and SmarterTools. Researchers discovered a malware strain named ZeroDayRat that targets users of certain gambling platforms in Singapore. This malware is designed to steal sensitive data, potentially impacting users' personal and financial information. The incident is particularly alarming as it highlights the risks associated with online gambling and the importance of securing personal data against such threats. Users are advised to remain vigilant and ensure their devices are protected against this evolving malware.

The article discusses the threat posed by a malware known as ZeroDayRAT, which has been identified as a form of stalkerware. This malware can bypass multi-factor authentication (MFA) by gaining access to users' SIM cards, location data, and recent text messages. With this information, attackers can take over accounts or conduct targeted social engineering attacks. The implications are serious, as individuals' privacy and security can be compromised, leading to potential identity theft or harassment. Users need to be vigilant about their mobile security and consider additional protective measures to safeguard their information.

A new cyber campaign known as Bloody Wolf is actively targeting individuals in Uzbekistan and Russia using the NetSupport Remote Access Trojan (RAT). Researchers report that around 50 victims have been affected in Uzbekistan and about 10 in Russia, with smaller numbers in Kazakhstan, Turkey, Serbia, and Belarus. This type of malware allows attackers to gain control over infected systems, posing significant risks to personal and sensitive information. The targeting of these specific regions suggests a focused effort by the attackers, likely indicating political or economic motivations behind the campaign. Users in these countries should be vigilant about suspicious emails and software installations to protect against such threats.

A new phishing campaign linked to the Phorpiex malware is targeting users globally, delivering ransomware through emails with malicious attachments. These emails often use deceptive double extensions, such as Document.doc.lnk, to trick recipients into opening them. Once activated, the malware can spread across networks, potentially locking files and demanding ransom payments from affected organizations. This ongoing threat, active throughout 2024 and 2025, poses significant risks to businesses and individuals alike, as it can lead to the loss of sensitive data and financial resources. Users need to remain vigilant about email attachments and ensure robust security measures are in place to defend against such attacks.