Symantec Protection Bulletins

SnakeKeylogger is an info-stealer malware that harvests credentials and other sensitive data. It targets a wide range of applications such as web browsers like Google Chrome, Mozilla Firefox, and email clients such as Microsoft Outlook and Thunderbird. It also extracts stored FTP credentials from FileZilla. This multistage attack begins with a malicious spam email containing a IMG file attachment, which when opened creates a virtual drive. Within the drive an executable file masquerades as a PDF document to increase the likelihood that the recipient will open it.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Rd32!g1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• Scr.Malcode!gen43
• Scr.Malcode!gen139
• Trojan.Gen.MBT
• WS.Malware.1
• WS.SecurityRisk.4

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Crocodilus is a new mobile banking trojan variant identified recently on the threat landscape. The malware has extensive remote control and infostealing functionalities, allowing the attackers for application overlay attacks, remote access to the compromised devices, theft of credentials/data stored on the mobile device, keylogging and execution of commands received from C2 servers, among others. Similarly to many other mobile malware strains in the wild, Crocodilus relies on abuse of access to Accessibility Services on the targeted device, before the malicious operations can proceed.

Symantec protects you from this threat, identified by the following:

Mobile-based

• Android.Reputation.2
• AppRisk:Generisk

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

CoffeeLoader is a new sophisticated malware loader designed to implement secondary payloads while evading detection. This loader leverages a packer that executes code on a system’s GPU. CoffeeLoader can establish persistence via the Windows Task Schedule and can maintain persistence via a scheduled task with a hard-coded name. For C2 communication it uses HTTPS with hard-coded servers. If these servers are unreachable it employs a domain generation algorithm and employs certificate pinning for security. 

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Rd32!g1
• ACM.Untrst-RunSys!g1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Trojan Horse
• Trojan.Gen.MBT
• WS.Malware.1
• WS.Reputation.1

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

MassLogger, an information-stealing malware designed to capture credentials, keystrokes, and clipboard data from victims, has been gaining prevalence in the threat landscape, with campaigns of various sizes and victimology observed worldwide.

In one recent campaign, an actor was observed impersonating a procurement officer from a company operating in aviation fuels and lubricants, maritime, transportation, technology, packaging, travel and tourism, water treatment, and real estate in the Middle East to create legitimacy. 

The malicious email pressures the recipient to acknowledge, sign, and stamp the fictitious XLS document, increasing urgency. If the user opens the malicious attachment, the Excel file (PO 23-179, PO 23-181.xls) will exploit CVE-2017-0199, a vulnerability in Microsoft Office that allows the execution of a remote malicious script when opening a specially crafted document. The exploit triggers the download and execution of an HTA (HTML application) file, which in turn retrieves and executes MassLogger. 

Targeted sectors: Aerospace, Agriculture, Automotive, Construction, Employment Services, Energy, Engineering, Entertainment, Financial Services, Healthcare, Industrial Air Filtration, IT Services, Laboratory Services, Logistics, Manufacturing, Marine & Offshore, Professional Services, Public Sector, Technology, Utilities.

Targeted countries: USA, Belgium, Norway, UAE, Netherlands, Greece, Finland, Switzerland, Sweden, Saudi Arabia, Malaysia, India, Australia, South Africa, France, Singapore, Taiwan, Indonesia, Turkey, Kenya, Japan, Hong Kong, Oman, Morocco, and Israel.

Symantec protects you from this threat, identified by the following:

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• CL.Downloader!gen12
• ISB.Downloader!gen80
• Scr.Malcode!gen59

A new campaign attributed to the Shuckworm APT (aka Gamaredon) has been reported by researchers from Cisco Talos. According to the released report, the attackers are targeting users from Ukraine with malicious .LNK files and PowerShell downloaders before infecting them with Remcos RAT payload. The campaign leverages phishing emails including war-related themes. The emails contain malicious .zip archive attachments with malicious .lnk files inside. Remcos is a well know and widely popular remote access trojan (RAT) variant often used by attackers for remote control, data collection, shell execution, service and process management, as well as its ability for download/execution of additional arbitrary payloads.

Symantec protects you from this threat, identified by the following:

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• Downloader
• Scr.Malcode!gen
• Scr.Mallnk!gen6
• Trojan.Gen.MBT
• Trojan.Gen.NPE
• Trojan.Gen.NPE.C
• Trojan.Mallnk
• Trojan.Mallnk!g4
• Web.Reputation.1
• Web.Reputation.2
• WS.Malware.1
• WS.SecurityRisk.4

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Argenta is a bank based in Belgium and also operates in the Netherlands and Luxembourg. Recently, Symantec has detected a new wave of phish runs spoofing Argenta's bank services with fake account notifications. The email content is brief, encouraging recipients to click and activate a security update that will provide extra layer of protection against threats. Clicking the link within the email redirects recipients to a fake Argenta bank's login page designed to steal credentials. Once compromised, attackers can access the victim's Argenta bank account.

Email Headers:

• Beveiligingscontrole: Bevestig uw accountgegevens
• Translated: Security check: Confirm your account details

Symantec protects you from this threat, identified by the following:

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

RALord is a new Rust-based ransomware variant identified in the wild. The malware encrypts user data and appends ".RALord" extension to the names of the locked files. The dropped ransom note advises the victims to contact the attackers via qTox chat for further instructions. The threat actors behind this ransomware variant also threaten the victims with releasing of the stolen data via a public leak page if the ransom demands are not met.

Symantec protects you from this threat, identified by the following:

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Trojan.Gen.MBT
• WS.Malware.1

Machine Learning-based

• Heur.AdvML.A!500
• Heur.AdvML.C

VIPKeyLogger, a stealthy keylogging malware, has been observed in two phishing campaigns targeting Japanese organizations and international companies with local offices in Japan. Designed to capture user input, including credentials, it is deployed by groups and individuals worldwide for espionage, credential theft, and fraud, using business-themed phishing emails to lure victims.

Campaign #1: 

Attackers impersonate a Japanese company specializing in vibration testing systems, claiming to follow up on a past quotation from 2019. The email is polite and professional, requesting price confirmation and attaching a malicious purchase order.

• Subject: 価格と期限情報(ref:0467) 【注文書】WP2501001152 WP2501001153
• Attachment: (ref0467) 【注文書】sales Agreement WP2501001152 WP2501001153.7z
• Attack Chain: Email > 7z archive > PEEXE (32-bit .NET)

Campaign #2:

A second campaign impersonates a Japanese company specializing in industrial piping materials. The email requests a quotation, appearing professional and including contact details and an office address.

• Subject: 見積依頼 関電プラント向け
• Attachment: 見積依頼_関電プラント向け_pdf.r00
• Attack Chain: Email > r00 archive > PEEXE (32-bit .NET)

Symantec protects customers from this threat, identified by the following:

Adaptive-based

• ACM.Untrst-RunSys!g1

Behavior-based

• SONAR.ProcHijack!g55

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• Scr.Malcode!gdn32

Machine Learning-based

• Heur.AdvML.B

Network-based

• Audit: Untrusted Telegram API Connection

A new campaign distributing PJobRAT malware for Android has been discovered by the researchers from Sophos. The campaign targets mostly the mobile users from Taiwan and aims at collection and exfiltration of sensitive data including SMS messages, contact lists as well as documents and media file stored on the compromised devices. PJobRAT is distributed under the disguise of legitimate messaging apps. The malware uses FCM (Firebase Cloud Messaging) cross-platform messaging solution for the purpose of C2 communication as well as the HTTP protocol for exfiltration of the stolen data.

Symantec protects you from this threat, identified by the following:

Mobile-based

• AdLibrary:Generisk
• Android.Reputation.2

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

CVE-2025-24799 is a recently identified SQL injection vulnerability affecting GLPI, which is a popular and open-source IT Service Management (ITSM) software. If successfully exploited, the flaw might enable remote unauthenticated attackers to achieve SQL database injection, leading potentially up to remote code execution via the compromised instance. The vulnerability has been already patched in the 10.0.18 version of the product.

Symantec protects you from this threat, identified by the following:

Network-based

• Web Attack: GLPI CVE-2025-24799

CVE-2025-29891 is a second recently identified bypass/injection vulnerability affecting Apache Camel, which is a popular open source integration framework. If successfully exploited, the flaw might enable the remote attackers to inject arbitrary parameters in the HTTP requests that are sent to the Camel application. This vulnerability is related to previously disclosed CVE-2025-27636 affecting injection of arbitrary HTTP headers. Patched Apache Camel versions that address this vulnerability have been already released by the product vendor.

Symantec protects you from this threat, identified by the following:

Network-based

• Web Attack: Apache Camel CVE-2025-29891

Policy-based

• Symantec Data Center Security (DCS) default lockdown policy protects the underlying operating systems from the CVE-2025-29891 exploit.

A new Go-based strain of the macOS malware dubbed ReaderUpdate has been discovered in the wild. Previous variants of this malware were based on Crystal, Nim and Rust programming languages. The malware is known to be distributed via 3rd party software download websites and with means of trojanized apps. ReaderUpdate loader has the functionality to retrieve and execute remote commands from its operators, this includes delivery of additional arbitrary payloads such as adware or malware.

Symantec protects you from this threat, identified by the following:

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• OSX.Trojan.Gen
• OSX.Trojan.Gen.2
• WS.Malware.1

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

In recent weeks, there has been an increase in phishing campaigns targeting users of Rakuten Securities (楽天証券), one of Japan’s largest and most well-established online brokerage firms. The company offers a wide range of investment services, including stocks, ETFs, mutual funds, futures, options, forex trading, and NISA (Japan’s tax-advantaged investment accounts).

Actors behind these campaigns have generated a large set of randomized subdomains under the .cn top-level domain, all mimicking Rakuten Securities. In the latest campaign, the domains follow a pattern of five-character alphanumeric strings, followed by /rakusec (e.g., yuowy[.]cn/rakusec). The phishing emails used in this campaign feature the subject line "以降のオンラインサービスログイン時の確認画面表示について【楽天証券】", designed to deceive recipients into believing the message is a legitimate security notice from Rakuten Securities.

According to reports, the attackers, upon successfully stealing credentials, have in some instances attempted to liquidate the victim's portfolio and execute mass purchases of Chinese stocks.

Rakuten Securities users should be vigilant and verify all emails and links before clicking. It is strongly advised to enable SMS authentication for withdrawals and logins, ensuring an extra layer of protection.

Symantec protects you from this threat, identified by the following:

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

A new Android malware variant leveraging .NET MAUI framework has been identified in the wild. .NET MAUI is a cross-platform framework used to build native, desktop and mobile apps with C# and XAML. The distributed malicious binaries are masquaraded as legitimate applications such as banking, dating or social networking apps. The deployed malware targets prevalently the collection and exfiltration of sensitive user data including personal and financial information, among others. 

Symantec protects you from this threat, identified by the following:

Mobile-based

• Android.Reputation.2
• AppRisk:Generisk

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Symantec has observed a new email campaign delivering a JavaScript downloader as an attachment. The JS arrives under various filenames in an email with variable subjects. On execution, the JS launches a PowerShell script to download, decode, and inject a keylogger payload into a new process named MSBuild.exe. This keylogger uses Telegram as its C2. Possible email traits include the following:

Subject:

• NEW Contract & PI
• Remittance Slip Attached

Attachment:

• NEWContractPI.js
• PaymentSwiftCopy.js
• inquiry0950.js
• shippingdocuments.js

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Base64!g1
• ACM.Ps-Wscr!g1
• ACM.Wscr-Ps!g1

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• ISB.Downloader!gen48
• Web.Reputation.1

Network-based

• Audit: Suspicious Process Accessing Lets Encrypt Certified Site
• Web Attack: Webpulse Bad Reputation Domain Request

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Security researchers have observed active exploitation attempts of CVE-2025-24813, a critical Remote Code Execution (RCE) vulnerability in Apache Tomcat, an open-source servlet container and web server for Java applications. The flaw, caused by a path equivalence issue, allows attackers to bypass security constraints and execute arbitrary code remotely. Exploits leverage HTTP PUT-based file uploads, NTFS junction exploitation and malicious deserialization to gain persistence and escalate privileges. This vulnerability presents a serious risk to organizations using Apache Tomcat to host web applications in both enterprise and cloud environments.

Symantec protects you from this threat, identified by the following:

Network-based

• Web Attack: Apache Tomcat CVE-2025-24813

Policy-based

• Symantec Data Center Security (DCS) default hardening for Apache tomcat application can reduce the attack surface and exposure in many different ways
• Lock down Tomcat network exposure such that this or similar remote CVEs for Apache Tomcat cannot be exploited over the public internet
• Prevent access to OS critical files such as /etc/passwd on Linux/UNIX such that sensitive system information does not leak

Dragon RaaS, a ransomware group that emerged in July 2024, primarily targets organizations in the US, Israel, UK, France and Germany. The group leverages web application vulnerabilities, brute-force attacks and stolen credentials as its main attack vectors using two ransomware variants: a Windows-focused encryptor, likely a modified version of StormCry and a PHP webshell which provides both backdoor functionality and persistent ransomware capabilities.

Symantec protects you from this threat, identified by the following:

Behavior-based

• SONAR.RansomPlay!gen1

File-based

• Trojan Horse
• Trojan.Gen.MBT
• WS.Malware.1

Machine Learning-based

• Heur.AdvML.A!500
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products.

Symantec has observed a new email campaign delivering a JavaScript downloader as an attachment. The JS arrives under various filenames in an email with variable subjects. On execution, the JS launches a PowerShell script to download, decode, and inject a keylogger payload into a new process named MSBuild.exe. This keylogger uses Telegram as its C2. Possible email traits include the following:

Subject:

• NEW Contract & PI
• Remittance Slip Attached

Attachment:

• NEWContractPI.js
• PaymentSwiftCopy.js
• inquiry0950.js
• shippingdocuments.js

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Base64!g1
• ACM.Ps-Wscr!g1
• ACM.Wscr-Ps!g1

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• ISB.Downloader!gen48
• Web.Reputation.1

Network-based

• Audit: Suspicious Process Accessing Lets Encrypt Certified Site
• Web Attack: Webpulse Bad Reputation Domain Request

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Symantec has observed a new email campaign delivering a JavaScript downloader as an attachment. The JS arrives under various filenames in an email with variable subjects. On execution, the JS launches a PowerShell script to download, decode, and inject a keylogger payload into a new process named MSBuild.exe. This keylogger uses Telegram as its C2. Possible email traits include the following:

Subject:

• NEW Contract & PI
• Remittance Slip Attached

Attachment:

• NEWContractPI.js
• PaymentSwiftCopy.js
• inquiry0950.js
• shippingdocuments.js

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Base64!g1
• ACM.Ps-Wscr!g1
• ACM.Wscr-Ps!g1

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• ISB.Downloader!gen48
• Web.Reputation.1

Network-based

• Audit: Suspicious Process Accessing Lets Encrypt Certified Site
• Web Attack: Webpulse Bad Reputation Domain Request

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Recent security research uncovered over 20 apps on Google Play and the iOS App Store using OCR-based techniques to extract and exfiltrate sensitive data, dubbed "SparkCat". These apps scanned local and cloud storage, targeting crypto keys, passwords, and financial documents, then sent the data to AWS-controlled servers.

iOS Malware: A Sophisticated Threat

Our primary focus was iOS due to its impact on enterprise security. The malicious framework within these apps:

• Activated when users opened a support window, granting file access.

• Used OCR to scan files for sensitive keywords, including crypto recovery keys.

• Exfiltrated identified files to an Amazon-hosted server controlled by a C2 infrastructure.

Notably, not all app versions were affected, suggesting a supply chain attack where malicious code was injected at some point in the development pipeline.

Why This Research Stands Out

• Evasion at Scale – The malware remained undetected on the App Store for over a year, bypassing Apple's security reviews.

• Stealth Tactics – Attackers used legitimate network services to evade detection.

• AI-Driven Exfiltration – Machine learning played a role in extracting and transmitting sensitive data, marking a new level of sophistication in mobile threats.

• Beyond Static Detection – Traditional security tools failed to detect these threats, underscoring the need for a behavioral-driven security approach.

How Symantec Protected Customers

Despite the malware’s stealthy approach, Symantec’s Mobile Threat Defense (MTD) identified and mitigated the threat early on:

• Network Integrity Policy flagged C2 servers as suspicious using WebPulse reputation analysis.

• Unwanted Mobile Application Policy detected infected versions of the apps attempting to exfiltrate sensitive data.

• Behavior-based detection identified risks beyond static signatures, flagging high-risk activity before public disclosure.

Interestingly, our systems had already flagged these behaviors in additional apps before they were widely reported, going back to January 2024. We had also flagged risky behaviors for infected apps not covered in the original research, including the attackers AWS access key ID & secret key embedded in the malicious library and frameworks. 

Ongoing Risks & The Need for Continuous Protection

The apps remain active on the iOS App Store, reinforcing the likelihood of a supply chain attack. However, developers must have integrated the malicious framework—either directly or through a trojanized tool like Xcode. This means static detection alone is insufficient; every app version must be dynamically analyzed for high-risk behaviors.

Key Takeaway: The App Store is Not Enough

Corporate mobile protection requires proactive, dynamic security to prevent data loss. Relying solely on Apple or Google’s app review process is insufficient when threats continue evolving in sophistication and scale.

Click here to learn more about Symantec Mobile Endpoint Protection.

CVE-2025–26319 is a recently disclosed pre-auth arbitrary file upload vulnerability affecting Flowise, which is a popular open source tool for developers to build customized LLM (Large Language Model) orchestration flows and AI agents. If successfully exploited, the flaw might allow the unauthenticated attackers to obtain remote control of the vulnerable server and allow them to upload malicious files, scripts, configuration files, SSH keys, etc.

Symantec protects you from this threat, identified by the following:

Network-based

• Attack: Flowise Pre-Auth Arbitrary File Upload CVE-2025-26319

A new campaign targeting Polish-speaking job-seeking developers has been reported to deliver a new backdoor variant dubbed FogDoor. The attackers lure the victims with a fake recruitment test that leads to a download of a .iso archive containing a malicious .lnk file. The executed .lnk file runs a PowerShell script responsible for installing the malware payload. The deployed backdoor allows the threat actors to perform remote command execution and data collection from the infected endpoints. FogDoor leverages a technique called Dead Drop Resolver (DDR), where legitimate websites (social media profiles for example) are used as intermediary C2 servers.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Mshta-Http!g1
• ACM.Mshta-Ps!g1
• ACM.Ps-Http!g2
• ACM.Ps-Mshta!g1
• ACM.Untrst-RunSys!g1

Behavior-based

• SONAR.TCP!gen1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Scr.Lemonduck!gen1
• Scr.Malcode!gen43
• Trojan Horse
• Trojan.Gen.MBT
• Trojan.Gen.NPE.C
• Web.Reputation.1
• WS.Malware.1
• WS.Malware.2
• WS.SecurityRisk.4

Machine Learning-based

• Heur.AdvML.C

Network-based

• Audit: Bad Reputation Application Activity
• Audit: PowerShell Process Accessing Github

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

CVE-2024-56346 and CVE-2024-56347 are two recently disclosed critical (CVSS score 10.0 and 9.6 respectively) vulnerabilities affecting IBM AIX operating system. If successfully exploited the flaws could allow remote attackers to execute arbitrary commands due to improper process controls. CVE-2024-56346 affects AIX's nimesis Network Installation Management (NIM) master service and CVE-2024-56347 relates to AIX's nimsh service SSL/TLS protection mechanisms, according to IBM's recent security advisory. Both vulnerabilities have been already addressed in released product patches. 

Symantec protects you from this threat, identified by the following:

Policy-based

• Symantec Data Center Security (DCS) default hardening policy provides zero-day protection for the underlying operating systems (IBM AIX) from CVE-2024-56346 and CVE-2024-56347 exploits.

SVCStealer is a new C++based infostealing malware identified in the wild. The infostealer collects various sensitive information from the infected endpoints such as system information, credentials, cryptocurrency wallets, data stored in browsers, screenshots, data from messaging applications (Discord, Tox, Telegram) or VPN apps, and others. The collected information is compressed into a .zip archive and extracted to the C2 servers controlled by the attackers.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Untrst-RLsass!g1

Behavior-based

• SONAR.Dropper
• SONAR.MalTraffic!gen1
• SONAR.Stealer!gen1
• SONAR.TCP!gen1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Trojan Horse
• Trojan.Gen.MBT
• WS.Malware.1

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Network-based

• Audit: Bad Reputation Application Activity
• System Infected: Bad Reputation Process Request 4
• Web Attack: Webpulse Bad Reputation Domain Request

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Symantec Threat Intelligence teams around the world provide unparalleled analysis and commentary on the cyberthreats affecting businesses today. Symantec’s browser extensions bring this intelligence into your browser to effectively detect and block various web-borne threats.

Symantec Endpoint Security (SES) and Symantec Endpoint Protection (SEP) deliver browser protection through browser extensions for Google Chrome and Microsoft Edge. These extensions rely on two key technologies:

• URL reputation, which identifies and blocks websites that host malicious content such as phishing, malware, fraud, scams, and spam.
• Browser Intrusion Prevention, which leverages Symantec's deep packet inspection engine to safeguard customers against a variety of threats.

Bringing these technologies together in the browser provides an effective browser protection solution.

In the last 7 days, we blocked a total of 7.3M attacks across 172.1K protected endpoints via the Endpoint protection browser extensions.

• 7M attacks were blocked on blocked on 165.2K endpoints using URL reputation
• 269.2K attacks were blocked on 19.5K endpoints attempting to redirect users to attacker-controlled websites
• 109.7K Browser Notification Scam/Technical Support Scam/Cryptojacking attacks were blocked on 5.7K endpoints
• 2.9K attacks were blocked on 186 endpoints which leverage malicious script injections on compromised websites

Customers are advised to enable Endpoint browser protection. Click here for instructions on how to do so.
Don't have SEP? Try protecting your browser with Symantec Browser Protection.

Symantec's IPS is a best-in-class deep packet inspection engine, protecting hundreds of millions of endpoints (desktops and servers) including Fortune 500's and consumers.

In the last 7 days, SEP's network protection engine (IPS) blocked a total of 44.8M attacks across 374.2K protected endpoints. 82.5% of these attacks were blocked at the pre-infection stage.

• 17.1M attempts to scan for Web Server Vulnerabilities blocked on 79K endpoints
• 6.4M attempts to exploit Windows OS Vulnerabilities blocked on 78.4K endpoints
• 5.9M attacks blocked on 24K Windows Servers
• 1.7M attempts to scan for Server Vulnerabilities blocked on 49.5K endpoints
• 929.2K attempts to scan for CMS Vulnerabilities blocked on 11.9K endpoints
• 1.7M attempts to exploit Application Vulnerabilities blocked on 43.8K endpoints
• 2.4M attacks blocked on 108.2K endpoints attempting to redirect users to attacker-controlled websites
• 781.1K coin mining attempts blocked on 1.7K endpoints
• 7.2M malware C&C attempts blocked on 110.4K endpoints
• 79.8K Cryptojacking attempts were blocked on 555 endpoints

Customers are advised to enable IPS on Desktops and Servers, for best protection. Click here for instructions on enabling IPS.

A new strain of the Albabat ransomware has been reported to offer multi-OS support, according to latest report from Trend Micro. New Albabat variant is still under active development and it adds Linux and macOS to the list of the targeted platforms. The ransomware encrypts files on the infected endpoint with exception of those located in specific system-related folders. The malware has also functionality to kill various system, debugging or VM-related processes. Most recent Albabat variants have been reported to leverage GitHub REST API for the purpose of configuration data retrieval.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Http!g2
• ACM.Ps-Net!g1
• ACM.Ps-Reg!g1
• ACM.Ps-Sc!g1
• ACM.Ps-Wbadmin!g1
• ACM.Untrst-Bcdedit!g1
• ACM.Untrst-RunSys!g1
• ACM.Untrst-Wbadmin!g1
• ACM.Vss-DlShcp!g1
• ACM.Wbadmin-DlBckp!g1
• ACM.Wmic-DlShcp!g1

Behavior-based

• SONAR.MalTraffic!gen1
• SONAR.SuspLaunch!gen4
• SONAR.SuspLaunch!g18
• SONAR.SuspLaunch!g193
• SONAR.SuspLaunch!g195
• SONAR.SuspLaunch!g250
• SONAR.SuspLaunch!g253
• SONAR.TCP!gen6

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Ransom.Albabat
• Trojan.Gen.MBT
• WS.Malware.1

Machine Learning-based

• Heur.AdvML.A
• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.C

Network-based

• Audit: Bad Reputation Application Activity
• Audit: Github Cloud Service Connect Attempt
• System Infected: Bad Reputation Application Connecting to Cloud Storage

Symantec has detected a phishing campaign targeting Japanese users with fake Pocket Card notification emails. The emails use the subject line:

• レジットカードのポケットカード会員専用ネットサービスからのお知ら
• (Translated: "Notice from the online service for Credit Card Pocket Card members")

The scammers exploit the familiar "Identity Authentication Service (3D Secure)" process, which is an additional authentication service used to secure customer accounts. This makes the emails appear legitimate and relevant to the users. Clicking on the registration link within the email redirects users to a fake Pocket Card login page designed to steal credentials. Once compromised, the attackers can access the victim's Pocket Card account.

Symantec protects you from this threat, identified by the following:

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

VanHelsing is a new ransomware variant recently identified in the wild. The malware encrypts user data and appends .vanhelsing or .vanlocker extension to the locked files. VanHelsing drops the ransom note in form of a text file called “README.txt” and it is also able to modify the desktop wallpaper. The ransomware has capabilities to delete the volume shadow copies on the infected endpoint. The threat actors behind this malware employ double extortion tactics by threatening the victims with publishing the stolen data if the ransom demands are not met. 

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Untrst-RunSys!g1
• ACM.Wmic-DlShcp!g1

Behavior-based

• SONAR.Ransom!gen14
• SONAR.RansomGen!gen3
• SONAR.RansomPlay!gen1
• SONAR.Ransomware!g16
• SONAR.SuspLaunch!g193
• SONAR.TCP!gen1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Ransom.Gen
• WS.Malware.1
• WS.SecurityRisk.3

Machine Learning-based

• Heur.AdvML.A!500
• Heur.AdvML.C

Network-based

• Attack: Ransom.Gen Activity 46

A phishing campaign impersonating Booking.com to deliver credential stealing malware has been observed targeting hospitality organizations in Asia, North America, Oceania, and Europe. The attackers send fake emails impersonating the online travel agency. The content of the mails vary, referencing topics in regards to negative guest reviews, requests from prospective guests, online promotion opportunities, account verification etc., but contain a URL within the body of the message or within a PDF attachment. Clicking the link leads to a webpage that displays a fake CAPTCHA with a subtly visible background designed to mimic a legitimate Booking.com page. The fake CAPTCHA is where the webpage employs the ClickFix social engineering technique to download the malicious payload. 

Symantec protects you from this threat, identified by the following:

Behavior-based

• SONAR.Dropper

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• Trojan.Gen.MBT
• WS.Malware.1 

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.B!200
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Researchers from Cisco Talos have reported a long-lasting campaign targeting entities in Taiwan and attributed to the UAT-5918 APT. The attackers are known to obtain access to the targeted environments usually via vulnerability exploitation. This threat actor has been leveraging miscellaneous web shells, open-source tools, network monitoring utilities, credential harvesters, etc. According to the released report, the activities conducted by the UAT-5918 group show certain amount of similarities with TTPs employed by several other threat actors such as Volt Typhoon, Flax Typhoon, Earth Estries and Dalbit.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Untrst-RunSys!g1

Behavior-based

• SONAR.SuspLaunch!g445
• SONAR.TCP!gen1
• SONAR.TCP!gen6

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Hacktool
• Infostealer
• Trojan Horse
• Trojan.Gen.MBT
• Trojan.Gen.NPE
• WS.Malware.1
• WS.Malware.2

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

According to a recent alert released by Ukraine's Computer Emergency Response Team (CERT-UA), a new wave of attacks against the defense sector in Ukraine has been detected. The campaign dubbed as UAC-0200 distributes malicious messages via the Signal messenger leading the victims to execution of DarkTortilla loader, which in turn decrypts and runs the DarkCrystal RAT (aka DCRat) payload. DarkCrystal RAT is a well known modular remote access trojan with functionalities allowing for command execution, remote control and data exfiltration among others.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Wscr!g1
• ACM.Untrst-RunSys!g1
• ACM.Wscr-Cmd!g1

Behavior-based

• SONAR.SuspBeh.C!gen18
• SONAR.TCP!gen1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Backdoor.DCRat
• ISB.Malscript!gen25
• Scr.Malcode!gdn32
• Scr.Malscript!gen4
• Trojan Horse
• Trojan.Gen.MBT
• Trojan.Gen.NPE.C
• WS.Malware.1

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B!100
• Heur.AdvML.B!200

Network-based

• System Infected: Trojan.Backdoor Activity 721
• Web Attack: Webpulse Bad Reputation Domain Request

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

The Symantec Threat Hunter team has observed activity from a custom backdoor that can be tied to a RansomHub affiliate. RansomHub is a Ransomware-as-a-Service offering and the backdoor has been named Betruger. This is a multi-function backdoor which appears to have been developed specifically for carrying out ransomware attacks. Betruger incorporates functionality typically seen across multiple tools leveraged during ransomware attacks. It is believed this could have been done in an effort to reduce the footprint during an attack by reducing the number of different tools required. Some of the features include:

• Capture screenshots
• Credential theft
• Logging keystrokes
• Network scanning
• Privilege escalation

Read more in our blog: RansomHub: Attackers Leverage New Custom Backdoor

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-RgPst!g1
• ACM.Ps-SvcReg!g1
• ACM.Rcln-Lnch!g1
• ACM.Untrst-RunSys!g1

Behavior-based

• SONAR.TCP!gen1 

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Backdoor.Betruger
• Backdoor.Cobalt
• Backdoor.Trojan
• Backdoor.SystemBC
• Hacktool
• Ransom.Ransomhub!g1
• Trojan.Dropper
• Trojan.Gen.2
• Trojan.Gen.MBT
• WS.Malware.1
• WS.Malware.2
• WS.SecurityRisk.4

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

A new steganographic malware campaign has been identified, using JPEG image files to distribute various infostealer malwares. The attack starts by luring users into downloading an obfuscated JPEG file, which contains hidden malicious scripts and executables. Once executed, these scripts target the extraction of sensitive credentials and data from browsers, email clients, and FTP applications. The malware then triggers a chain of events that downloads additional payloads including customized infostealer tools such as Vidar, Raccoon, and Redline.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Base64!g1
• ACM.Ps-Http!g2
• ACM.Ps-Wscr!g1
• ACM.Wscr-Ps!g1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• CL.Downloader!aat171
• ISB.Downloader!gen80
• ISB.Heuristic!gen5
• ISB.Houdini!gen6
• Scr.Malcode!gen
• Hacktool
• Trojan Horse
• Trojan.Malimg

Machine Learning-based

• Heur.AdvML.B
• Heur.AdvML.B!100
• Heur.AdvML.B!200

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

Another fake captcha campaign is resulting in rootkits being deployed to unsuspecting victims. The attack is spread via fake captchas that impersonate popular software tools and websites, the captcha copies a malicious powershell command using curl to the users clipboard and provides instructions on how to run it to prove they are human. In reality this script deploys a BAT file that installs a rootkit on the target machine.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-RgPst!g1
• ACM.Ps-RgPst!g1
• ACM.Untrst-RgPst!g1
• ACM.Untrst-RunSys!g1
• ACM.Untrst-Schtsk!g1

Behavior-based

• SONAR.SuspBeh!gen6
• SONAR.SuspBeh!gen752
• SONAR.SuspBeh!gen93
• SONAR.SuspDataRun

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service

File-based

• CL.Suspexec!gen152
• CL.Suspexec!gen52
• Scr.Malcode!gdn14
• Scr.Malcode!gdn20
• Trojan.Gen.MBT
• Trojan.Gen.NPE.C
• Trojan.Remcos
• WS.Malware.1
• WS.Malware.2
• WS.SecurityRisk.4

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

New reports emerged about threat actors actively exploiting an older Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-27564) affecting OpenAI’s ChatGPT. The vulnerability resides in ChatGPT Commit f9f4bbc, which is a open source GitHub project based on PHP. If successfully exploited, the flaw might allows the attackers to inject crafted URLs into input parameters, forcing the application to make arbitrary requests. The observed exploitation attempts of this vulnerability have been reported to target governmental institutions in the US. 

Symantec protects you from this threat, identified by the following:

Network-based

• Attack: ChatGPT commit f9f4bbc SSRF CVE-2024-27564

NailaoLocker is a ransomware variant distributed last year in campaigns targeting various European healthcare organizations. The attackers responsible for the attacks have been leveraging previously disclosed Check Point Security Gateway vulnerability CVE-2024-24919 in the initial attack stages. The ransomware payload is decrypted and loaded into memory with help of malicious loader dubbed NailaoLoader. Upon successful infection NailaoLocker encrypts user data and appends ".locked" extension to the encrypted files. The ransom note is dropped in form of a .html file advising the victims to contact the attackers for further instructions. The observed campaigns conducted by the same threat actors have been also delivering the ShadowPad and PlugX malware variants to its victims.

Symantec protects you from this threat, identified by the following:

Behavior-based

• SONAR.RansomNailo!g1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Ransom.Nailo
• Trojan.Gen.MBT
• Trojan Horse

Machine Learning-based

• Heur.AdvML.A!300
• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.B!100
• Heur.AdvML.B!200
• Heur.AdvML.C

Network-based

• Web Attack: CheckPoint Gateway Information Disclosure CVE-2024-24919

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

A relatively new backdoor malware dubbed AnubisBackdoor has been spotted in the wild. This Python-based backdoor is attributed to the Savage Ladybug group, which is reportedly connected to the notorious Coreid (aka Fin7) APT group. The malware is designed to grant remote access, execute commands, and facilitate data exfiltration, all while evading detection by most antivirus solutions. Unlike the original Anubis malware, which is known for targeting Android devices with banking trojan capabilities, AnubisBackdoor is specifically crafted for remote command execution and system compromise on other platforms.

Symantec protects you from this threat, identified by the following:

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Backdoor.Trojan
• Trojan Horse

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products

CVE-2025-27636 is a recently identified bypass/injection vulnerability affecting Apache Camel, which is a popular open source integration framework. If successfully exploited, the flaw might enable the remote attackers to inject arbitrary headers into requests which in turn could allow them to to execute internal Camel methods. Patched Apache Camel versions that address this vulnerability have been already released by the product vendor.

Symantec protects you from this threat, identified by the following:

Network-based

• Web Attack: Apache Camel CVE-2025-27636

StilachiRAT is a new remote access trojan variant discovered recently by researchers from Microsoft. The malware possesses extensive remote control as well as infostealing capabilities. It collects information about the infected device, credentials, clipboard data and targets over 20 different cryptocurrency wallet Google Chrome extensions for data exfiltration. StilachiRAT employs various anti-analysis and evasion techniques including event log deletion, registry manipulation, sandbox-evading behaviors and others. The malware also supports RDP session monitoring and execution of commands received from attackers' controlled C2 servers.

Symantec protects you from this threat, identified by the following:

Adaptive-based

• ACM.Ps-Rd32!g1

Carbon Black-based

• Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

File-based

• Trojan Horse
• WS.Malware.2

Machine Learning-based

• Heur.AdvML.A!400
• Heur.AdvML.A!500
• Heur.AdvML.C

Web-based

• Observed domains/IPs are covered under security categories in all WebPulse enabled products