InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers have revealed a new malware named MDifyLoader, linked to cyber attacks using security vulnerabilities in Ivanti Connect Secure (ICS) appliances.
A JPCERT/CC report reveals that cybercriminals exploited CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which facilitates Cobalt Strike attacks in memory.
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
CVE-2025-0282 is a critical security vulnerability in ICS that allows remote code execution without authentication. Ivanti fixed it in early January 2025. CVE-2025-22457, which was patched in April 2025, involves a stack-based buffer overflow that could lead to arbitrary code execution.
Both vulnerabilities have been used in the wild as zero-days. JPCERT/CC’s findings from April show that the first issue was exploited to spread malware like SPAWNCHIMERA and DslogdRAT.
Recent analysis of ICS attacks revealed that DLL side-loading was used to deploy MDifyLoader, which contains an encoded Cobalt Strike beacon (version 4.5) released in December 2021.
“MDifyLoader is a loader created based on the open-source project libPeConv,” JPCERT/CC researcher Yuma Masubuchi said. “MDifyLoader then loads an encrypted data file, decodes Cobalt Strike Beacon, and runs it on memory.”
A Go-based remote access tool called VShell and an open-source network scanner named Fscan have been used by several Chinese hacking groups recently.
The execution flow of Fscan:
Fscan is executed via a loader that uses DLL side-loading. This rogue DLL loader uses the open-source tool FilelessRemotePE.
“The used VShell has a function to check whether the system language is set to Chinese,” JPCERT/CC said. “The attackers repeatedly failed to execute VShell, and it was confirmed that each time they had installed a new version and attempted execution again. This behavior suggests that the language-checking function, likely intended for internal testing, was left enabled during deployment.”
After accessing the internal network, the attackers reportedly conducted brute-force attacks on FTP, MS-SQL, and SSH servers and used the EternalBlue SMB exploit (MS17-010) to steal credentials and move laterally within the network.
“The attackers created new domain accounts and added them to existing groups, allowing them to retain access even if previously acquired credentials were revoked,” Masubuchi said.
“These accounts blend in with normal operations, enabling long-term access to the internal network. Additionally, the attackers registered their malware as a service or a task scheduler to maintain persistence, ensuring it would run at system startup or upon specific event triggers.”
