InfoSecBulletin Cybersecurity for mankind
There has been a sharp rise in malware linked to the Nymaim / Avalanche loader in Bangladesh. CIRT BD observed over 27,000 malware events, which means bad actors are trying to infect systems and there is ongoing contact with the botnet.
Threat Overview
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Nymaim (also known as Gozi ISFB Loader) is a multi-stage malware loader used to deploy additional malicious payloads, including:
Banking trojans
Credential stealers
Ransomware
Remote access tools (RATs)
The malware is highly adaptive, allowing attackers to update capabilities post-infection through command-and-control (C2) servers.
Key Findings in Bangladesh
27,000+ malware events detected
Activity across 20+ network providers (ASNs)
Multiple compromised hosts communicating with botnet servers
C2 communication captured via sinkhole monitoring
These signs show that there are infected devices in Bangladesh networks that are trying to reconnect with known harmful servers.
Targeted Data
Nymaim infections aim to steal sensitive information such as:
Banking credentials
Payment card data
System configuration details
This data is commonly used for
Financial fraud
Account takeovers
Identity theft
Secondary cyberattacks
Malware File Names Observed
Suspicious File Names:
update.exe
flashplayer_update.exe
svchost.exe
java_update.exe
Malicious Domains (examples):
g-update[.]net
secure-update[.]biz
update-service[.]org
Known Malicious IPs:
184.105.192[.]2
185.82.202[.]132
91.220.131[.]37
Behavioral Indicators:
Outbound HTTP/HTTPS traffic to unknown domains
Encrypted payload downloads
Activity in AppData/Temp directories
Organizations in Bangladesh are strongly advised to:
Block known malicious IPs and domains
Implement DNS sinkholing
Deploy Endpoint Detection & Response (EDR)
Monitor unusual DNS and HTTP traffic
Sandbox suspicious files and attachments
Continuously monitor networks for anomalies
Incident Response Guidance
If compromise is suspected:
Isolate affected systems immediately
Conduct full malware scans and forensic analysis
Reset all compromised credentials
Remove persistence mechanisms
Restore from secure backups
CIRT encourages to send reports of unusual behavior to: [email protected]
