Cybersec Sentinel - Cybersec Sentinel (Page 2)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

Fileless EggStreme Malware Campaign Attributed to Chinese APT Against Military Organisations

Malware, EggStreme, Fileless Malware, DLL Sideloading, Espionage, APT

Fileless EggStreme Malware Campaign Attributed to Chinese APT Against Military Organisations

Threat Group – China-based APT actors Threat Type – Fileless malware and espionage backdoor Exploited Vulnerabilities – DLL sideloading, fileless memory injection (no CVEs assigned) Malware Used – EggStremeFuel, EggStremeLoader, EggStremeReflectiveLoader, EggStremeAgent, EggStremeKeylogger, EggStremeWizard Threat Score – 8.0 🔴 High Last Threat Observation – 11 September 2025 Overview A newly discovered espionage framework named EggStreme has

MostereRAT Expands Post-Exploitation with Remote Access Software

MostereRAT, Remote Access Trojan, AnyDesk, TightVNC, Phishing

MostereRAT Expands Post-Exploitation with Remote Access Software

Threat Group – Unknown Threat Type – Remote Access Trojan with remote administration tool deployment Exploited Vulnerabilities – Phishing vectors, TightVNC privilege escalation CVE-2023-27830 Malware Used – MostereRAT Threat Score – 7.8 🔴 High Last Threat Observation – 9 September 2025 Overview A phishing campaign uncovered by Fortinet on 9 September 2025 is distributing MostereRAT, a

Unknown Actors Launch High Severity NPM Supply Chain Malware Attack

SupplyChain, Malware, OpenSource, NPM, Phishing

Unknown Actors Launch High Severity NPM Supply Chain Malware Attack

Threat Group – Unknown criminal actors via phishing campaign Threat Type – Supply-Chain Attack / Malware Injection Exploited Vulnerabilities – Phishing via typosquatted domain, credential theft, token misuse Malware Used – Crypto-wallet address swap, WebSocket-based backdoor, Scavenger infostealer Threat Score – 7.5 🔴 High – Advanced targeted attack on trusted dev ecosystem; widespread impact and high stealth

Plex users urged to reset passwords after database compromise

Breach, Article, news, Plex

Plex users urged to reset passwords after database compromise

Threat Group – Unknown threat actor Threat Type – Data Breach / Account Compromise Exploited Vulnerabilities – Unauthorised access to Plex authentication database Malware Used – None confirmed Threat Score – 🔴 7.5 High – Large-scale exposure of account credentials with password reuse risks Last Threat Observation – 8 September 2025 Overview On 8 September 2025, Plex confirmed

Windows under threat from Rustonotto Rust backdoor and Python loader operated by APT37

Windows under threat from Rustonotto Rust backdoor and Python loader operated by APT37

Threat Group – APT37 (ScarCruft / Ruby Sleet / Velvet Chollima) Threat Type – Backdoor / Surveillance Exploited Vulnerabilities – Spear-phishing via malicious Windows shortcut (LNK) and CHM help file vectors Malware Used – Rustonotto (Rust-based backdoor), Chinotto (PowerShell), FadeStealer (Python-based stealer) Threat Score – 5.5 🟠 Elevated Justification – Combines multiple stages: stealthy Rust backdoor, multi-stage infection chain,

Sindoor Dropper Phishing Exploits Linux Desktop Files for Persistent Remote Control

Sindoor Dropper Phishing Exploits Linux Desktop Files for Persistent Remote Control

Threat Group: Transparent Tribe / APT36 / Mythic Leopard / G0134 Threat Type: Targeted phishing dropper, Linux desktop shortcut abuse, remote administration tool deployment, cyber espionage Exploited Vulnerabilities: No public CVE exploitation confirmed. Abuse of Linux .desktop launcher behaviour, user execution, weak attachment controls, and trusted cloud storage delivery. Malware Used: Sindoor Dropper

ScarCruft and RokRAT Pose High Threat to Government and Academia

ScarCruft and RokRAT Pose High Threat to Government and Academia

Threat Group: ScarCruft / APT37 / Reaper / Red Eyes Threat Type: Advanced Persistent Threat (APT), Remote‑Access Trojan (RAT), Espionage and Ransomware Exploited Vulnerabilities: CVE‑2017‑8291 (Encapsulated PostScript vulnerability in Hangul Word Processor), CVE‑2024‑38178 (Internet Explorer mode of Microsoft Edge), vulnerabilities in Hancom Office; exploitation of Windows LNK files,

Fileless MixShell Malware Delivered Through Web Forms and Cloud Services

Fileless MixShell Malware Delivered Through Web Forms and Cloud Services

Threat Group: Unknown actor with possible overlaps to the UNK_GreenSec cybercriminal cluster Threat Type: Social engineering phishing campaign delivering a fileless, in memory backdoor Exploited Vulnerabilities: No software vulnerabilities exploited. The threat abuses web "Contact Us" forms, trusted cloud storage and user trust to bypass email gateways

Skype Delivered SCR and PIF Files Deploy GodRAT Malware in Financial Campaigns

Skype Delivered SCR and PIF Files Deploy GodRAT Malware in Financial Campaigns

Threat Group: Winnti (APT41) – suspected attribution based on code lineage and targeting Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Social engineering via Skype delivering malicious .SCR and .PIF files containing steganographic shellcode in JPEGs and DLL sideloading Malware Used: GodRAT – evolution of Gh0st RAT and AwesomePuppet, featuring plugin-based architecture

Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns

Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns

Threat Group: Opportunistic and financially motivated actors targeting multiple sectors Threat Type: Phishing and email infrastructure abuse Exploited Vulnerabilities: Abuse of Microsoft 365 Exchange Online Direct Send feature; implicit trust of unauthenticated internal-looking emails; weak or unenforced SPF, DKIM, and DMARC Malware Used: None required for initial access; follow-on payloads