Malware Activity
Advanced Malware Campaigns Raise Risks for Crypto Users and Enterprise Organizations
Cybersecurity researchers have uncovered two (2) highly sophisticated malware operations that are making detection much more difficult for traditional security tools. The first, known as SourTrade, uses fake cryptocurrency and trading websites that mimic trusted platforms such as Solana, Luno, and TradingView to lure victims into downloading malicious software. Instead of delivering a complete malware file, the attackers secretly assemble the malware inside the victim’s browser using advanced JavaScript and browser features, creating a unique version for each target and helping it evade signature-based defenses. Meanwhile, researchers identified Cruciferra, a powerful malware delivery service used in phishing attacks to deploy remote access trojans and information stealers across industries including finance, healthcare, government, education, and manufacturing. It uses advanced evasion techniques such as vulnerable drivers, privilege escalation, API unhooking, and memory-based execution to bypass security products and leave minimal forensic evidence. Together, these campaigns highlight a growing trend toward stealthier, highly customized malware that focuses on credential theft, financial fraud, long-term persistence, and security-tool evasion. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: Malicious Sites Use JavaScript to Build Malware in Browser Memory article
- TheHackerNews: Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware article
Threat Actor Activity
Hackers Use Telegram-Based Malware to Target Middle Eastern Governments
Zscaler ThreatLabz has uncovered a new East Asia–linked campaign targeting Middle Eastern government entities using three (3) previously unseen malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The attack starts with an ISO containing a legitimate executable that DLL-sideloads TELESHIM, a 32-bit backdoor that uses the Telegram API for command-and-control to pull next-stage payloads. TELESHIM then helps launch a second DLL sideloading chain, where MIXEDKEY acts as a reflective loader to decrypt and run a heavily obfuscated payload. Both TELESHIM and MIXEDKEY use string encryption, control-flow flattening, mixed boolean arithmetic, and VM checks to evade analysis. TELESHIM supports control messages (host registration, command execution, chunked exfiltration) and download/execute messages for scheduled secondary payloads. The final stage, BINDCLOAK, is a 64-bit C++ implant that contacts cert.hypersnet[.]com and supports post-compromise reconnaissance and follow-on payload delivery. The final payload is protected by two layers of XOR encryption, including environmental keying tied to the victim’s volume serial number, ensuring it runs only on intended systems.
Vulnerabilities
Public Exploit Released for Patched vBulletin RCE, Exposing Unpatched Self-Hosted Forums
Public exploit details for CVE-2026-61511, an unauthenticated remote code execution (RCE) vulnerability in vBulletin’s template engine, were released on July 27, demonstrating how attackers can execute arbitrary PHP code without authentication or user interaction by exploiting the ajax/render/pagenav endpoint and the application’s unsafe use of PHP’s eval() function. Although the proof-of-concept (PoC) contains a minor typo, the flaw is easily corrected and successfully enables command execution. The vulnerability affects vBulletin versions 6.2.1 and earlier and 6.1.6 and earlier, but was patched in late June, with vBulletin 6.2.2 released on July 1; the vendor also confirmed that all cloud-hosted instances have already been secured. There is currently no evidence of active exploitation, and the flaw has not been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, though the publication of a working exploit significantly increases the risk to organizations running unpatched, internet-facing self-hosted forums. Affected FLASH Update readers should prioritize applying available patches or upgrading to version 6.2.2 and monitor for suspicious POST requests targeting ajax/render/pagenav with unusually complex pagenav[pagenumber] values, as public exploit availability has historically led to rapid targeting of vulnerable vBulletin deployments.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
