ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

ThreatsDay Bulletin: AI, Malware, and Global Cybersecurity Challenges

This ThreatsDay Bulletin from The Hacker News outlines the evolving landscape of cyber threats in late 2025, emphasizing how digital vulnerabilities are increasingly weaponized for real-world harm, economic exploitation, and political manipulation. Key themes include AI’s dual role in malware analysis, critical Windows vulnerabilities, ransomware proliferation, and the convergence of cyber and physical extortion.

1. Critical Windows GDI Vulnerabilities

CVE Details: Three patched flaws in Windows GDI (CVE-2025-30388, CVE-2025-53766, CVE-2025-47984) allowed remote code execution via malformed EMF/EMF+ files.
- Impact: Exploited through memory corruption during image rendering in gdiplus.dll and gdi32full.dll.
- Resolution: Patched in Microsoft updates (May–August 2025), but Check Point noted incomplete fixes left vulnerabilities active for years.
Broader Implication: Highlights challenges in verifying the completeness of security patches.

2. Cybercrime Syndicate Using Fake Work Permits

Case Study: Three Chinese nationals (Yan Peijian, Huang Qinzheng, Liu Yuqi) convicted in Singapore for hacking gambling sites and stealing PII.
- Tools Used: PlugX malware, hundreds of remote access trojans.
- Financial Impact: Earned $3 million by working under a fake Ni-Vanuatu citizen, Xu Liangbiao, who fled in 2023.
- Scope: Syndicate accessed foreign government data, including confidential communications.

3. AI in Malware Analysis: Accelerating Triage

ChatGPT Integration: Check Point demonstrated using ChatGPT to analyze encrypted malware like XLoader.
- Process: Combines static analysis with runtime key extraction (MCP) and live debugging.
- Impact: Reduces malware triage time from days to hours, though manual analysis remains critical for complex protections.
- Quote: “AI doesn’t eliminate the need for human expertise,” said Alexey Bukhteyev.

4. RondoDox Malware Expands to Enterprise Systems

Growth: 650% increase in exploitation vectors, targeting enterprise systems (e.g., Oracle WebLogic, D-Link, TP-Link).
- Mechanics: Kills competing malware (e.g., XMRig), disables SELinux/AppArmor, and uses C2 infrastructure on residential IPs.
- Threat Level: Represents a shift from niche DVR attacks to broader enterprise targeting.

5. DHS Proposes Sweeping Biometric Rules

Regulation: Requires biometric data (e.g., fingerprints, facial recognition) for immigration benefits, affecting U.S. citizens and residents.
- Purpose: Combat trafficking, verify identities, and deter fraud.
- Timeline: Public comments accepted until January 2, 2026.
- Privacy Concerns: Raises questions about data storage and misuse risks.

6. TruffleNet: Large-Scale AWS Abuse Network

Discovery: Cybersecurity researchers identified TruffleNet, leveraging TruffleHog (a secret-scanning tool) to exploit AWS credentials.
- Activity: 800+ hosts across 57 Class C networks, using Portainer for container management.
- Attack Vectors: SES abuse for BEC attacks, credential testing via GetCallerIdentity API.
- Implication: Reflects reliance on low-complexity methods (e.g., stolen credentials) by financially motivated adversaries.

7. FIN7 Deploys Stealthy SSH Backdoor

Method: FIN7 (Savage Ladybug) used a custom SSH backdoor via install.bat to gain persistent access.
- Functionality: Outbound reverse SSH tunnel for file exfiltration and SFTP.
- Persistence: Designed for long-term access to financial targets.

8. Cloudflare Mitigates Massive DDoS During Moldova Elections

Event: CEC (Moldova’s election body) faced 898 million malicious requests on September 28, 2025.
- Timing: Attacks timed to disrupt election processes and news sites.
- Impact: Highlighted the strategic use of DDoS to undermine democratic processes.

9. Silent Lynx Targets Diplomacy and Industry

Campaigns:
- Operation Peek-a-Baku: Phishing lures tied to Azerbaijan-Russian diplomacy, using Ligolo-ng and SilentSweeper.
- China-Central Asia: RAR archives delivering SilentSweeper for data exfiltration.
Tools: PowerShell-based reverse shells, C++ implant Laplas, and .NET backdoor SilentSweeper.

10. Ransomware Surge in Europe

Stats: 13% increase in ransomware attacks (2024–2025), 1,380 European victims.
- Top Groups: Akira, LockBit, RansomHub, Lynx, Sinobi.
- Trends: 92% of attacks involved encryption/data theft; 17 physical attacks (e.g., fake bomb threats) linked to groups like Renaissance Spider.

11. Fake Apps Exploiting Brand Trust

Examples:
- Fake ChatGPT App: Connects to OpenAI APIs but misleads users as an “unofficial interface.”
- WhatsApp Plus: Harvests contacts, SMS, and call logs via stealth payloads.
Risk: Exploits user trust in established brands for ad revenue or data theft.

12. Phishing Campaigns Post-Breach

Tactic: Threat actors use compromised email accounts to launch credential-harvesting phishing campaigns.
- Goal: Expand reach within organizations and to partners.
- Defenses: Improved phishing detection may drive adversaries to use compromised accounts for legitimacy.

13. Asia-Wide Phishing with Multilingual Lures

Methods:
- Multilingual ZIP files and web templates targeting government/financial institutions.
- Shared toolkits for scalable, automated attacks across China, Japan, and Southeast Asia.
Impact: Demonstrates a shift to centralized, automated phishing infrastructure.

14. Remote Kill-Switch Risks in Chinese Electric Buses

Discovery: Danish authorities investigated Yutong buses with remote deactivation capabilities.
- Concern: Potential for exploitation during transit, raising national security risks.
- Response: Norwegian transport authority Ruter confirmed measures to address vulnerabilities.

15. China’s Crackdown on Cross-Border Scams

Case: 21 members of a Myanmar-based syndicate received death sentences for operating 41 scam parks.
- Scale: Fraudulent activities spanned 193 countries, defrauding €300M (€750M attempted).
- Global Context: Part of a global effort to dismantle cyber-enabled scam centers in Southeast Asia.

16. Massive Credit Card Fraud Sting (Chargeback)

Operation: 18 suspects arrested across 7 countries for fake subscriptions to dating/streaming services.
- Method: Monthly payments kept below €50 to avoid suspicion.
- Loss: €300M stolen from 4.3 million users across 19 million accounts (2016–2021).

Recommendations for Cybersecurity Teams

AI Integration: Use AI for triage but retain human expertise for complex malware analysis.
Patch Management: Verify patch completeness to avoid residual vulnerabilities (e.g., GDI issues).
Credential Security: Monitor for TruffleHog-like tools and enforce MFA for AWS environments.
Phishing Defense: Detect compromised accounts post-breach and train users on multilingual phishing lures.
Biometric Risks: Advocate for strict data governance when adopting DHS-style biometric rules.

Reference: ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

On This Page