Cyber Threat Intelligence Digest: Week 25

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Veeam Patches Critical RCE Vulnerability in Domain-Joined Backup Servers; No Active Exploitation Observed - On June 17, 2025, Veeam patched CVE-2025-23121, a critical-severity remote code execution (RCE) vulnerability affecting its Veeam Backup & Replication versions 12 through 12.3.1. Exploitation could allow threat actors to execute arbitrary code on backup servers remotely. Veeam Backup & Replication is a comprehensive solution for data protection and disaster recovery. At the time of writing, there is no evidence of the vulnerability being actively exploited in the wild.

Veeam also patched two other vulnerabilities affecting Veeam Backup & Replication and Veeam Agent for Windows.

• CVE-2025-24286 - A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.
• CVE-2025-24287 - A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.

 

Team46 Exploits CVE-2025-2783 to Deploy Trinper Backdoor in Phishing Campaign - Team46 APT group exploited a Google Chrome vulnerability, CVE-2025-2783, to deploy Trinper backdoor malware in a phishing campaign observed in March 2025. According to a June 16, 2025, report by Positive Technologies, this activity is also attributed to the TaxOff threat group due to its consistent use of PowerShell syntax, loader architecture, infrastructure patterns, and malware deployment techniques. Due to the consistencies, however, Positive Technologies assessed with high confidence that Team46 and TaxOff are the same APT group and have decided to refer to both collectively as Team46.

The attack chain begins with a phishing email impersonating an invitation to the Primakov Readings forum, delivering a one-click exploit (CVE-2025-2783) that triggers PowerShell script execution. This script downloaded a multi-stage encrypted loader, known as the Trinper Loader, which conducted environment validation and decrypted successive payload layers. The loader ultimately deployed the Trinper Backdoor capable of collecting file system data, encrypting data, intercepting keystrokes, and accessing the clipboard.

 

Threat Actors Actively Exploiting CVE-2025-3248 Vulnerability in Langflow to Deliver Flodrix Botnet -Unidentified threat actors are exploiting CVE-2025-3248, a critical-severity remote code execution (RCE) vulnerability in Langflow (versions before 1.3.0), to deploy a new variant of the LeetHozer botnet dubbed "Flodrix". According to a report by Trend Micro dated June 17, 2025, this ongoing botnet campaign is aimed at carrying out distributed denial-of-service (DDoS) attacks. Langflow is an open-source framework for building Large Language Model (LLM) applications in Python.

• CVE-2025-3248 - Langflow versions before 1.3.0 are vulnerable to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

 

Potential Threats 

FIN6 Deploys More_eggs via Fake Resumes and Cloud Services to Compromise Enterprise Recruiters - On June 10, 2025, DomainTools reported that the financially motivated threat group Skeleton Spider, also known as FIN6, is using fraudulent AWS-hosted resume websites to socially engineer recruiters through job platforms, including LinkedIn and Indeed. FIN6 delivers the More_eggs backdoor by embedding malicious Windows shortcut (. LNK) payloads in CAPTCHA-protected ZIP files.

The attack begins with FIN6 impersonating job seekers, initiating contact with recruiters via professional emails devoid of clickable links, likely to evade detection by automated email filters. These emails direct recipients to enter spoofed domain names resembling personal resume portfolios manually (for example, bobbyweisman[.]com), which FIN6 registers anonymously using GoDaddy and Whois privacy services. The domains are hosted on Amazon Web Services (AWS) infrastructure, which provides scalability, cost efficiency, and perceived legitimacy due to its trusted IP space.

 

New Prometei Botnet Employs Obfuscation and Uses Domain Generation Algorithm (DGA) for Its C2 Infrastructure - On June 20, 2025, Palo Alto Networks' Unit 42 published an analysis detailing new TTPs demonstrated by Prometei botnet versions 3 and 4. The Prometei botnet is a modular malware family first discovered in 2020, although it is believed to have been active since at least 2016. In March 2025, Unit 42 observed campaigns delivering the Prometei botnet Linux variant, specifically versions 3 and 4. Per Unit 42, these versions incorporate the following features and capabilities:

• Employ the open-source packer UPX to compress and obscure its executable, complicating analysis.
• Integrate modular structures, enabling component updates or replacements
• Employ a Domain Generation Algorithm (DGA) to create domain names for command-and-control (C2) servers dynamically
• Automatically adapt through self-updating routines, enhancing malware persistence and evading detection mechanisms
• Include an appended JSON configuration trailer, increasing control and operational flexibility

 

New Malware Campaign Uses Cloudflare Tunnels to Deliver RATs via Phishing Chains - On June 18th 2025, security researchers uncovered a phishing campaign dubbed Serpentine#Cloud, which leverages Cloudflare Tunnel infrastructure to deliver malware through a stealthy multi-stage infection chain. The attack begins with invoice-themed phishing emails containing ZIP attachments. These include LNK files disguised as PDFs, which, when executed, initiate a download of a malicious script via a Cloudflare-exposed WebDAV share. This leads to the execution of a batch script that downloads and runs Python-based shellcode loaders entirely in memory.

The final payload includes remote access trojans (RATs) such as AsyncRAT and RevengeRAT, deployed using Donut shellcode to evade detection. The campaign has a global reach, targeting users in the U.S., U.K., Germany, and parts of Asia. Attribution remains unclear, but the attackers show signs of professional-grade coding and English fluency, suggesting a skilled and organised group. By abusing trusted Cloudflare domains, the campaign bypasses traditional URL filtering and enhances stealth.

Serpentine#Cloud builds on past Cloudflare-based malware operations but adds deeper obfuscation and a more refined execution chain. Its abuse of legitimate infrastructure underlines the need for enhanced monitoring of cloud-based services and better email security practices to prevent similar threats.

 

General News

Echo Chamber Jailbreak Tricks LLMs Like OpenAI and Google into Generating Harmful Content - Echo Chamber jailbreak tricks LLMs like OpenAI and Google into generating harmful content – Cybersecurity researchers have revealed a new form of multi-step jailbreak attack called Echo Chamber, which exploits a model’s own semantic reasoning and conversational context to produce forbidden outputs, bypassing established safety mechanisms .

Unlike previous techniques such as Crescendo or many-shot attacks, Echo Chamber doesn’t use adversarial wording or explicit prompts. Instead, it seeds seemingly innocent conversation, then leverages repeated indirect references ("Refer back to the second sentence…") and context poisoning to guide the model step-by-step toward policy-violating content, all while staying within the model’s "green zone" of acceptable inputs.

In controlled tests on OpenAI’s GPT‑4.1 nano, GPT‑4o mini, GPT‑4o, and Google’s Gemini 2.0 Flash Lite and Gemini 2.5 Flash, the Echo Chamber method achieved over 90% success rates for generating content related to sexism, violence, hate speech, and pornography—and approximately 80% success in eliciting misinformation and self-harm prompts.

Researchers warn this technique highlights a deeper alignment problem: as LLMs become better at sustained inference, they’re increasingly vulnerable to subtle, multi-turn semantic manipulation.

 

Sixteen billion passwords exposed in record-breaking data breach, opening access to Facebook, Google, Apple, and any other service imaginable. In June 2025, Cybernews researchers uncovered a massive compilation of 30 exposed datasets containing approximately 16 billion login credentials, an unprecedented scale that is roughly twice the global population. These credentials encompass data for major platforms, including Google, Facebook, and Apple. The incident stems not from a single breach, but from the aggregation of multiple infostealer malware operations over time, which were briefly left publicly exposed.

The leaked credentials, originating from infostealers, credential-stuffing logs, and recycling of older breaches, are recent, not relics. They contain URL‑password pairs, tokens, cookies, and metadata for services ranging from social media to developer tools. While duplicate records mean the exact number of unique users isn’t clear, the scale remains alarming. Researchers emphasised that this exposure provides cybercriminals with “fresh, weaponisable intelligence at scale”

Cybersecurity experts warn that such a breach massively elevates risks, including account takeover, identity theft, phishing, ransomware, and business email compromise. They stress the urgent importance of practising strong "cyber hygiene": regularly changing and unique passwords, enabling multi-factor authentication, monitoring for infostealer infections, and leveraging password managers or passkeys.

 

Meta Adds Passkey Login Support to Facebook for Android and iOS Users. In June 2025, Meta announced support for passkey logins across Facebook, Instagram, and Messenger, marking a pivotal shift away from traditional passwords. Passkeys, based on FIDO standards and backed by cryptographic authentication, aim to simplify and strengthen account security. Unlike passwords, they are resistant to phishing and cannot be reused or stolen in data breaches, offering a more secure login alternative across devices and platforms.

Meta's implementation uses device-based biometric verification—such as Face ID or fingerprint—enabling users to sign in without entering a password or dealing with two-factor prompts. These passkeys are stored securely on the user’s device and synchronised via cloud services like iCloud Keychain or Google Password Manager. Meta's move aligns with efforts by Apple, Google, and Microsoft, signalling a broader industry push toward a passwordless future.

Cybersecurity analysts view Meta's rollout as a critical defence against rising cyber threats, including phishing, credential-stuffing, and social engineering attacks. With infostealer malware and data breaches on the rise, traditional passwords have proven increasingly vulnerable. Experts advocate for the broad adoption of passkeys alongside other hygiene practices, underscoring their potential to drastically reduce attack surfaces and enhance user protection at scale.

 

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group’s severity. These updates can be seen below.

● Limited Severity

● Basic Severity

● Moderate Severity

● High Severity

Global Trends Powered by Recorded Future

Within each category, we have provided the current top five globally trending items. Each item is linked to how actively trending it is and is marked with a small symbol. 

The spikes in references are calculated over 60 days and are normalised to ensure they aren’t disproportionate when compared to bigger entities that will naturally have more baseline mentions.

▲- Spike – This indicates a large increase in reporting volume and a high diversity in the event descriptions,
▲- Rise – This indicates a small increase in reporting volume with little diversity in the descriptions.

Prominent Information Security Events

FIN6 Deploys More_eggs via Fake Resumes and Cloud Services to Compromise Enterprise Recruiters

Source: Insikt Group | Validated Intelligence Event

IOC: URL - hxxp://bobbyweisman[.]com/index.html

IOC: Domain Name - hxxp://bobbyweisman[.]com

IOC: SHA256 - c2c40859f5d589538b6c16d654373b696c48e0be9092b56a57d2cf6ce768e1fe

On June 10, 2025, DomainTools reported that the financially motivated threat group Skeleton Spider—also tracked by Recorded Future as FIN6—is actively targeting recruiters through fraudulent AWS-hosted resume websites. These operations exploit popular job platforms such as LinkedIn and Indeed, using social engineering tactics to deliver the More_eggs backdoor. The group embeds malicious Windows shortcut (.LNK) files within CAPTCHA-protected ZIP archives, making detection and analysis more difficult.

FIN6 initiates contact by impersonating job seekers and sending professionally crafted emails that contain no clickable links, a tactic likely designed to evade automated email security filters. Instead, recipients are instructed to manually type domain names that closely resemble personal resume portfolios (e.g., bobbyweisman[.]com). These domains are registered anonymously through GoDaddy and Whois privacy services. They are hosted on Amazon Web Services (AWS), leveraging the trust associated with AWS infrastructure to increase credibility and success rates.

To avoid detection and frustrate analysis, FIN6 employs a multilayered approach to access control on its phishing infrastructure. This includes filtering traffic through residential IPs, verifying that the target is using a Windows browser, and deploying conditional CAPTCHA challenges. The infrastructure actively blocks traffic from cloud-based IP addresses, VPNs, sandbox environments, and security analysis tools, often displaying decoy content, such as fake resumes or error messages. When a target downloads and opens the ZIP archive, the .LNK file executes a JavaScript payload via wscript.exe, which connects to a remote server to retrieve More_eggs—a malware capable of credential theft, command execution, in-memory operations, and persistence via registry run keys or scheduled tasks.

New Prometei Botnet Employs Obfuscation and Uses Domain Generation Algorithm (DGA) for Its C2 Infrastructure

Source: Insikt Group | Validated Intelligence Event

IOC: SHA256 - 46cf75d7440c30cbfd101dd396bb18dc3ea0b9fe475eb80c4545868aab5c578c

IOC: URL - hxxp://103.41.204[.]104/k.php

IOC: URL - hxxp://152.36.128[.]18/cgi-bin/p.cgi

On June 20, 2025, Palo Alto Networks’ Unit 42 published an analysis outlining new tactics and techniques used by versions 3 and 4 of the Prometei botnet. Although first identified in 2020, Prometei is believed to have been active since at least 2016. In March 2025, Unit 42 observed campaigns distributing Linux variants of Prometei. These newer versions feature UPX-packing for obfuscation, a modular structure for component updates, Domain Generation Algorithms (DGA) for dynamic C2 domains, self-updating routines for persistence, and an appended JSON configuration trailer for added flexibility.

Unit 42 shared two Linux samples, v3.05L and v4.02V, with Insikt Group. Sandbox analysis flagged both as malicious, exhibiting capabilities including system discovery, crypto mining, persistence, botnet functionality, and privilege escalation. The samples were confirmed to be UPX-packed and matched detection rules specific to Prometei. These updates reflect the botnet's growing sophistication and ability to evade traditional detection mechanisms.

Once executed, the malware creates a copy of itself as uplugplay in /usr/sbin and drops a related systemd service file to enable automatic startup. It checks process status, reloads systemd configurations, and starts the service. Additional actions include modifying the host file, enumerating processes, collecting system information from /proc, retrieving the kernel version, detecting debuggers, and self-deletion to cover tracks—demonstrating Prometei’s focus on stealth and persistence.

Remediation Actions

Following the information provided above, we recommend that the technologies mentioned be fully patched and updated. We also want to highlight and recommend applying the following patches where applicable:

• CVE-2025-2312, CVE-2025-24286 and CVE-2025-24287: Organisations should upgrade to Veeam Backup & Replication 12.3.2 to remedy these vulnerabilities.
• CVE-2025-2783: Organisations are strongly advised to to 134.0.6998.177/.178 for Windows to remedy this vulnerability.
• CVE-2025-3248: Organisations should install Langflow 1.3.0 or later to mitigate this vulnerability.

If you are currently an Acumen Cyber Vulnerability Management customer, we will be proactively performing related searching and hunting activities within your environment.