Weekly Malware & Threats Roundup | 24 Feb - 02 Mar 2025
1️⃣ 𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮𝗻 𝗛𝗮𝗰𝗸𝗲𝗿𝘀 𝗟𝗶𝗻𝗸𝗲𝗱 𝘁𝗼 $𝟭.𝟱 𝗕𝗶𝗹𝗹𝗶𝗼𝗻 𝗕𝘆𝗕𝗶𝘁 𝗖𝗿𝘆𝗽𝘁𝗼 𝗛𝗲𝗶𝘀𝘁
North Korea's Lazarus hacking group has been identified as responsible for the largest cryptocurrency heist in history, stealing over $1.5 billion from ByBit.
Source: https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-15-billion-bybit-crypto-heist/
2️⃣ 𝗚𝗶𝘁𝗩𝗲𝗻𝗼𝗺 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗗𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗲𝘀 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝘃𝗶𝗮 𝗙𝗮𝗸𝗲 𝗚𝗶𝘁𝗛𝘂𝗯 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝗶𝗲𝘀
Attackers are using fake GitHub projects to distribute stealers, backdoors, and cryptocurrency wallet clippers, targeting developers globally.
Source: https://securelist.com/gitvenom-campaign/115694/
3️⃣ 𝟮,𝟱𝟬𝟬+ 𝗧𝗿𝘂𝗲𝘀𝗶𝗴𝗵𝘁.𝘀𝘆𝘀 𝗗𝗿𝗶𝘃𝗲𝗿 𝗩𝗮𝗿𝗶𝗮𝗻𝘁𝘀 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝘁𝗼 𝗗𝗲𝗽𝗹𝗼𝘆 𝗛𝗶𝗱𝗱𝗲𝗻𝗚𝗵𝟬𝘀𝘁 𝗥𝗔𝗧
A large-scale campaign abuses a vulnerable Windows driver to evade EDR systems and deploy remote access trojans.
Source: https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/
4️⃣ 𝗡𝗲𝘄 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗨𝘀𝗲𝘀 𝗖𝗿𝗮𝗰𝗸𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘁𝗼 𝗦𝗽𝗿𝗲𝗮𝗱 𝗟𝘂𝗺𝗺𝗮 𝗮𝗻𝗱 𝗔𝗖𝗥 𝗦𝘁𝗲𝗮𝗹𝗲𝗿
Cybercriminals are distributing malware via cracked software downloads, leveraging Dead Drop Resolver techniques to avoid detection.
Source: https://asec.ahnlab.com/en/86390/
5️⃣ 𝗚𝗿𝗮𝘀𝘀𝗖𝗮𝗹𝗹 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗗𝗿𝗮𝗶𝗻𝘀 𝗖𝗿𝘆𝗽𝘁𝗼 𝗪𝗮𝗹𝗹𝗲𝘁𝘀 𝘃𝗶𝗮 𝗙𝗮𝗸𝗲 𝗝𝗼𝗯 𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄𝘀
A Russian cybercrime group deceived Web3 job seekers into downloading malware through a fraudulent interview platform.
Source: https://www.bleepingcomputer.com/news/security/grasscall-malware-campaign-drains-crypto-wallets-via-fake-job-interviews/
Additional Cybersecurity News:
🟢 𝟮𝟬𝟮𝟱 𝗨𝗻𝗶𝘁 𝟰𝟮 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝗥𝗲𝗽𝗼𝗿𝘁: 𝗖𝘆𝗯𝗲𝗿 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝗦𝗵𝗶𝗳𝘁 𝘁𝗼 𝗗𝗶𝘀𝗿𝘂𝗽𝘁𝗶𝗼𝗻
86% of major cyber incidents in 2024 resulted in downtime or financial loss, with attackers increasingly focusing on sabotage and data exfiltration.
Source: https://www.paloaltonetworks.com/blog/2025/02/incident-response-report-attacks-shift-disruption/
🟠 𝗖𝗵𝗶𝗻𝗲𝘀𝗲 𝗖𝘆𝗯𝗲𝗿 𝗘𝘀𝗽𝗶𝗼𝗻𝗮𝗴𝗲 𝗝𝘂𝗺𝗽𝘀 𝟭𝟱𝟬%, 𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲 𝗥𝗲𝗽𝗼𝗿𝘁𝘀
Chinese state-backed cyber espionage activities surged in 2024, targeting finance, media, and manufacturing sectors.
Source: https://www.crowdstrike.com/en-us/global-threat-report/
🔴 𝟲𝟭% 𝗼𝗳 𝗛𝗮𝗰𝗸𝗲𝗿𝘀 𝗨𝘀𝗲 𝗡𝗲𝘄 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗖𝗼𝗱𝗲 𝗪𝗶𝘁𝗵𝗶𝗻 𝟰𝟴 𝗛𝗼𝘂𝗿𝘀 𝗼𝗳 𝗗𝗶𝘀𝗰𝗹𝗼𝘀𝘂𝗿𝗲
Cybercriminals are exploiting newly released vulnerabilities faster than ever, with ransomware attacks targeting healthcare at record levels.
Source: https://www.sonicwall.com/threat-report