Weekly Cyber Round-up

UNC6032 uses fake AI video generator websites to distribute malware and steal credentials

Since November 2024, Mandiant researchers have observed an ongoing, global UNC6032 campaign leveraging fake artificial intelligence (AI) video generator websites to distribute malware and deploy Python-based infostealers and several backdoors. The campaign aims to steal login credentials, cookies, credit card data, and Facebook information. Since mid-2024, more than 30 websites distributing thousands of advertisements have been identified, with most of the sites advertised on Facebook and some on LinkedIn. The phishing sites include a fake video generation button, which leads to the installation of a ZIP file and a malicious binary containing the STARKVEIL dropper. STARKVEIL is executed twice, first dropping three modular malware families, the XWORM and FROSTRIFT backdoors and the GRIMPULL downloader, before spawning a Python launcher for the COILHATCH dropper during its second execution. UNC6032 is suspected to have a Vietnam nexus.

UNC5221 exploits Ivanti EPMM flaws to target organisations in critical sectors globally

EclecticIQ researchers observed the active exploitation of two recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, tracked as CVE-2025-4427 and CVE-2025-4428, to target organisations across multiple critical sectors in Europe, North America, and the Asia-Pacific region. The earliest observed exploitation activity dates back to May 15th, 2025. The flaws were exploited to gain initial access, after which the attackers used Java-based commands to execute malicious processes on compromised systems. One of the commands was used to obtain an interactive reverse shell, allowing for continued communication between the attacker and the victim system, while another was used for arbitrary command execution. The attackers also conducted host reconnaissance using obfuscated shell commands and a Fast Reverse Proxy, after which they deployed KrustyLoader malware via Amazon AWS S3 buckets to deliver the Sliver backdoor and establish persistence. The threat actors also targeted the ‘mifs’ database by making use of hardcoded MySQL database credentials.

Earth Lamia exploits SQL vulnerabilities and uses custom tools to exfiltrate data from targets

Trend Micro researchers identified a China-linked advanced persistent threat (APT), dubbed Earth Lamia, that has been exploiting SQL injection vulnerabilities on web applications to exfiltrate data since 2023. The group mainly targets organisations in Brazil, India, and Southeast Asia, initially focusing on the financial industry in H1 2024, before shifting to the logistics and online retail industries in H2 2024, and more recently to IT companies, universities, and government organisations. Earth Lamia frequently conducts vulnerability scans to identify potential SQL injection flaws on targets’ websites, attempting to open a system shell via tools such as ‘sqlmap’ to gain remote access to SQL servers. After successfully exploiting a flaw, Earth Lamia performs various lateral movement activities and commands that allow them to directly access and exfiltrate databases. The group leverages numerous open-source tools like Brute Ratel and Cobalt Strike, but also continuously develops its own custom tools, including the PULSEPACK backdoor and the BypassBoss privilege escalation tool.

On May 7th, 2025, EclecticIQ researchers observed the advanced persistent threat (APT) actor, Bitter APT, targeting Pakistan Telecommunication Co Ltd (PTCL) employees with a new variant of WmRAT. Bitter APT likely used credentials stolen from Pakistan’s Counter Terrorism Department (CTD) via StealC to send its spear phishing emails. The timing of the attack coincided with the reported military confrontations between India and Pakistan, likely to target Pakistan’s telecommunications sector amid regional tensions. The emails contained an internet query containing a malicious Excel macro attachment that used the Windows command line to download and execute WmRAT. After executing the file, the threat actors established a connection to a C2 domain previously linked to Bitter APT.