The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding sophisticated malware campaigns targeting Ivanti Endpoint Manager Mobile (EPMM) systems.

Cybercriminals are actively exploiting two critical vulnerabilities, CVE-2025-4427 and CVE-2025-4428, to deploy advanced persistent threats that enable complete system compromise and arbitrary code execution on targeted servers.

The attack campaign emerged shortly after Ivanti disclosed the vulnerabilities on May 13, 2025, with threat actors beginning exploitation around May 15, 2025, following the publication of proof-of-concept code.

The vulnerabilities affect all Ivanti EPMM versions including 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior, representing a significant attack surface for organizations relying on mobile device management infrastructure.

The malicious actors demonstrate sophisticated techniques by chaining CVE-2025-4427, an authentication bypass vulnerability, with CVE-2025-4428, a code injection flaw, to gain unauthorized access to EPMM deployments.

Once inside the system, attackers target the /mifs/rs/api/v2/ endpoint using HTTP GET requests with malicious remote commands embedded in the ?format= parameter, enabling them to collect system information, download malicious payloads, enumerate network resources, and extract LDAP credentials.

CISA Cyber Team analysts identified two distinct malware sets during their investigation, each containing sophisticated loaders and malicious listeners designed to maintain persistent access to compromised infrastructure.

The first set consists of three components: Loader 1 (web-install.jar), ReflectUtil.class, and SecurityHandlerWanListener.class, while the second set includes Loader 2 (web-install.jar) and WebAndroidAppInstaller.class, with each component serving specific functions in the attack chain.

The threat actors employ advanced evasion techniques to bypass security controls and deliver their malware effectively.

Rather than uploading complete malicious files that might trigger security alerts, the attackers segment their payloads into multiple Base64-encoded chunks and transmit each segment through separate HTTP requests.

This approach serves dual purposes: circumventing signature-based detection systems and avoiding file size limitations that might prevent successful malware deployment.

Advanced Payload Delivery and Persistence Mechanisms

The malware deployment process showcases remarkable technical sophistication in how threat actors establish and maintain persistence on compromised systems.

The attack begins with Java Expression Language injection techniques that create malicious JAR files in the /tmp directory through a methodical chunk-based reconstruction process.

For the initial payload delivery, attackers craft HTTP GET requests containing Java EL injection code that creates FileOutputStream objects to write Base64-decoded malware segments directly to the target system.

The malicious request structure follows this pattern: GET /mifs/rs/api/v2/featureusage?format=${""getClass().forName("java.io.FileOutputStream").getConstructor("".getClass(),"".getClass().forName("[Z").getComponentType()).newInstance("/tmp/web-install.jar",true).write("".getClass().forName("java.util.Base64").getMethod("getDecoder").invoke(null).decode("[BASE64_CHUNK]"))}.

This technique enables the malware to evade signature-based detection while reconstructing complete executable files on the target system.

Once the malware components are successfully deployed, Set 1 operates through a sophisticated three-stage process.

Loader 1 contains and dynamically loads ReflectUtil.class, which then manipulates Java objects to inject SecurityHandlerWanListener into the Apache Tomcat server running on the compromised system.

The ReflectUtil.class component bypasses Java Development Kit module restrictions, iterates through object contexts, and attempts to load the malicious listener class using hard-coded strings that masquerade as legitimate JUnit framework components.

SecurityHandlerWanListener establishes a persistent backdoor by intercepting specific HTTP requests containing predetermined authentication tokens.

The listener monitors for requests containing the string “pass 7c6a8867d728c3bb”, a “Referer” header, and the header value “https://www[.]live.com”.

When these conditions are met, the malware retrieves Base64-encoded payloads from the request stream, decodes them, and decrypts the data using AES encryption with the stored key, creating new Java class files that enable arbitrary code execution.

Set 2 operates through a more streamlined but equally effective approach, with Loader 2 containing and loading WebAndroidAppInstaller.class at runtime.

This component masquerades as part of the legitimate com.mobileiron.service package and intercepts HTTP requests with specific Content-Type headers containing “application/x-www-form-urlencoded”.

The malware retrieves password parameters from incoming requests, performs Base64 decoding and AES decryption using the hard-coded key “3c6e0b8a9c15224a”, and dynamically creates new malicious classes based on the decrypted instructions.

The sophisticated nature of these attacks demonstrates the threat actors’ deep understanding of Java-based enterprise applications and their ability to exploit complex software architectures for persistent access.

Organizations must immediately upgrade their Ivanti EPMM installations to the latest patched versions and implement additional monitoring for mobile device management systems, treating them as high-value assets requiring enhanced security controls and continuous surveillance.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post CISA Warns of Hackers Exploiting Ivanti Endpoint Manager Mobile Vulnerabilities to Deploy Malware appeared first on Cyber Security News.

The emergence of a new campaign weaponizing legitimate remote monitoring and management software has alarmed security teams worldwide.

Attackers are distributing trojanized installers for ConnectWise ScreenConnect—now known as ConnectWise Control—to deliver dual payloads: the widely used AsyncRAT and a custom PowerShell-based RAT.

By leveraging trusted software footprints and open directories, adversaries bypass signature-based defenses and maintain long-term access to compromised networks.

Initial incidents surfaced in May 2025, when analysts observed anomalous ScreenConnect installers hosted on exposed file servers.

These installers contained ClickOnce loaders that, upon execution, fetched malicious components at runtime rather than embedding payloads directly.

In one instance, a compromised installer silently launched a VBS script that executed a weaponized shortcut, triggering PowerShell with execution-policy bypass to run a loader script.

Hunt.io Cyber Team researchers identified this tactic after correlating telemetry from multiple exposed hosts and correlating IOCs across open directories.

Subsequent analysis revealed a repeatable infrastructure pattern. Infected installers pivoted to repositories hosting .zip archives named logs.ldk, logs.idk, and logs.idr, which unpacked into dropper scripts (Ab.vbs or Ab.js), the PowerShell loader (Skype.ps1), a native injector DLL (libPK.dll), and a shortcut file (Microsoft.lnk).

The VBS launcher uses WScript.Shell to invoke the shortcut, which in turn runs PowerShell with hidden windows to launch Skype.ps1.

This script reconstructs an embedded payload blob, invokes the DLL’s exported Execute function for in-memory native staging, and creates a scheduled task named SystemInstallTask for persistence.

Infection Mechanism

The infection chain begins with a seemingly benign ScreenConnect client installer.

Once executed, it drops the VBS loader (Ab.vbs) into a public folder and registers a Windows shortcut. The shortcut’s target is crafted to launch PowerShell with -ExecutionPolicy Bypass -WindowStyle Hidden, calling a small script file named Skype.ps1.

Skype.ps1 contains base64-encoded payload segments that it decodes into a .NET assembly or native shellcode, depending on detected security products.

If the script detects antivirus like TotalAV or Avast, it performs in-memory assembly loading via System.Reflection.Assembly.Load; otherwise it dynamically imports libPK.dll using PowerShell’s Add-Type and calls Execute to inject payloads into legitimate host processes.

To maintain resilience, the loader also schedules recurring tasks (every 2–10 minutes) ensuring rapid re-execution if terminated.

Additionally, the use of open directories for initial staging allows attackers to rotate files and domains frequently, complicating detection.

The combination of modular scripts, scheduled tasks, and dual execution paths exemplifies a sophisticated multi-stage delivery framework that blends legitimate RMM software abuse with bespoke RAT payloads.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Beware of Weaponized ScreenConnect App That Delivers AsyncRAT and PowerShell RAT appeared first on Cyber Security News.

Cybersecurity researchers have identified a potential connection between two Yemen-based cybercriminal organizations, the Belsen Group and ZeroSevenGroup, following an extensive investigation into their operational patterns and attack methodologies.

The discovery comes amid growing concerns about sophisticated network intrusion campaigns targeting critical infrastructure and enterprise systems across multiple continents.

The Belsen Group first emerged in January 2025, making headlines with the leak of 1.6 GB of sensitive data from over 15,000 vulnerable Fortinet FortiGate devices.

The compromised information included IP addresses, system configurations, and VPN credentials, which the group initially shared freely on BreachForums and their dedicated TOR-based blog to establish credibility within cybercriminal communities.

The group’s attack vector centered on exploiting CVE-2022-40684, a critical authentication bypass vulnerability in FortiGate firewalls, suggesting they maintained access to victim systems for over two years before the public disclosure.

ZeroSevenGroup, the more established of the two entities, has been active since July 2024, initially operating on platforms including NulledTo before expanding to BreachForums, CrackedTo, and Leakbase.

The group specialized in data monetization strategies, targeting organizations across Poland, Israel, the United States, UAE, Russia, and Brazil.

Their most notable breach involved Toyota’s US operations in August 2024, where they claimed responsibility for exfiltrating 240GB of sensitive corporate data.

KELA Cyber Team analysts noted significant operational similarities between the groups through forensic analysis of their posting patterns and communication styles.

The investigation revealed that both organizations employed identical title formatting conventions, specifically using “[ Access ]” with square brackets and spaces in their forum posts and victim announcements.

This distinctive formatting pattern was unique to these two actors within KELA’s comprehensive threat intelligence database.

Tactical Convergence and Attribution Analysis

The technical analysis revealed deeper connections through OSINT investigation of the groups’ digital footprints. Researchers identified matching stylistic patterns in their social media presence, particularly consistent hashtag usage including #hack across their Twitter profiles.

Both groups demonstrated similar operational security practices, maintaining multiple communication channels including Tox, XMPP, Telegram, and X for victim negotiations and data sales.

The Belsen Group’s operational infrastructure included a sophisticated onion site for victim listings and contact information, registered under the partially redacted email address ad@gmail.com.

Their Telegram administrator account (@BelsenAdmin, ID 6161097506) revealed additional intelligence through subscription patterns to cybersecurity certification groups, regional Arabic-speaking communities in Yemen, and technical training channels.

The account’s previous usernames (@m_kyan0, @mmmkkk000000) provided additional attribution markers for ongoing investigations.

ZeroSevenGroup’s technical profile showed evolution from their earlier incarnation as “ZeroXGroup” on RaidForums under username zerox296.

The group’s password reuse patterns across leaked databases and infostealers provided crucial attribution links, connecting their operations to Yemen-based threat actors associated with the Yemen Shield hacking group.

Their transition to exclusive operations on Exploit Forum since January 2025 demonstrated tactical adaptation following exposure of their scamming activities against the Medusa Ransomware group.

While definitive attribution remains challenging, the convergence of operational patterns, geographic origins, and tactical preferences strongly suggests coordination or shared resources between these cybercriminal entities, representing an evolving threat landscape requiring enhanced defensive measures.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Researchers Uncover Link Between Belsen and ZeroSeven Cybercriminal Groups appeared first on Cyber Security News.

The emergence of the SystemBC botnet marks a significant evolution in proxy-based criminal infrastructure.

Rather than co-opt residential devices for proxying, SystemBC operators have shifted to compromising large commercial Virtual Private Servers (VPS), enabling high-volume proxy services with minimal disruption to end users.

In recent months, Lumen Technologies has observed an average of 1,500 newly compromised VPS systems daily, each enlisted to relay malicious traffic on behalf of criminal threat groups.

These compromised servers function as robust, high-bandwidth proxies, delivering an unprecedented level of throughput that traditional residential botnets cannot sustain.

Initially documented by Proofpoint in 2019, SystemBC functionality has expanded beyond simple proxy operations.

After successful infiltration, the loader decrypts a hard-coded configuration and establishes a connection to one of over 80 command-and-control (C2) servers.

The payload leverages a combination of XOR and RC4 encryption to secure its communication channel, ensuring that detection and analysis by defenders remains challenging.

Lumen analysts identified this encryption pipeline during dynamic analysis of a Linux variant sample, revealing a three-stage process for both outbound beaconing and C2 responses.

This constant cat-and-mouse game between evasion and detection has underscored the resilience of SystemBC over multiple years.

The impact of this botnet has been felt across the cybercrime ecosystem. In addition to supplying proxies for renting, SystemBC’s network has been integrated into larger offerings such as REM Proxy, a tiered commercial service catering to multiple criminal enterprises.

REM Proxy’s high-end “Mix-Speed” tier comprises numerous SystemBC-infected servers, prized for their volume and stability.

Meanwhile, lower-quality proxies are relegated to brute-force campaigns and credential harvesting. This dual-use of compromised VPS assets highlights how threat actors optimize distinct infection and exploitation stages under a single unified architecture.

Infection Mechanism and Decryption Workflow

The infection mechanism often begins with opportunistic scanning of internet-facing services on port 443. Once a vulnerable VPS is identified, the malware download is initiated via HTTP over port 80.

The retrieved shell script, annotated with Russian comments, automates the parallel download and execution of over 180 SystemBC samples.

Each sample shares a 40-byte XOR key embedded in its binary. Upon execution, the loader performs the following pseudocode to reconstruct its C2 configuration:-

# Pseudocode for SystemBC configuration decryption
key = read_bytes(offset=0x100, length=40)
encrypted_config = read_bytes(offset=0x200, length=config_length)
config = xor(rc4(xor(encrypted_config, key), key), key)

Once decrypted, the configuration yields a list of C2 endpoints and operational parameters. The loader then crafts an initial beacon packet—composed of the key, padding bytes, and a 0xFFFF header—encrypted in the same pipeline before transmission.

The response from the C2 server contains a four-byte header indicating commands: new proxy creation, proxy data injection, or termination.

Lumen researchers noted that this symmetric encryption approach effectively evades signature-based detection while maintaining low computational overhead on compromised servers.

Through its blend of scalable infection tactics, robust encryption, and integration into commercial proxy services, SystemBC exemplifies a modern malware-as-a-service model.

Continuous monitoring and rapid sharing of indicators of compromise remain critical to mitigate its widespread threat.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post SystemBC Botnet Hacked 1,500 VPS Servers Daily to Hire for DDoS Attack appeared first on Cyber Security News.