InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers have revealed a new malware named MDifyLoader, linked to cyber attacks using security vulnerabilities in Ivanti Connect Secure (ICS) appliances.
A JPCERT/CC report reveals that cybercriminals exploited CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which facilitates Cobalt Strike attacks in memory.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CVE-2025-0282 is a critical security vulnerability in ICS that allows remote code execution without authentication. Ivanti fixed it in early January 2025. CVE-2025-22457, which was patched in April 2025, involves a stack-based buffer overflow that could lead to arbitrary code execution.
Both vulnerabilities have been used in the wild as zero-days. JPCERT/CC’s findings from April show that the first issue was exploited to spread malware like SPAWNCHIMERA and DslogdRAT.
Recent analysis of ICS attacks revealed that DLL side-loading was used to deploy MDifyLoader, which contains an encoded Cobalt Strike beacon (version 4.5) released in December 2021.
“MDifyLoader is a loader created based on the open-source project libPeConv,” JPCERT/CC researcher Yuma Masubuchi said. “MDifyLoader then loads an encrypted data file, decodes Cobalt Strike Beacon, and runs it on memory.”
A Go-based remote access tool called VShell and an open-source network scanner named Fscan have been used by several Chinese hacking groups recently.
The execution flow of Fscan:
Fscan is executed via a loader that uses DLL side-loading. This rogue DLL loader uses the open-source tool FilelessRemotePE.
“The used VShell has a function to check whether the system language is set to Chinese,” JPCERT/CC said. “The attackers repeatedly failed to execute VShell, and it was confirmed that each time they had installed a new version and attempted execution again. This behavior suggests that the language-checking function, likely intended for internal testing, was left enabled during deployment.”
After accessing the internal network, the attackers reportedly conducted brute-force attacks on FTP, MS-SQL, and SSH servers and used the EternalBlue SMB exploit (MS17-010) to steal credentials and move laterally within the network.
“The attackers created new domain accounts and added them to existing groups, allowing them to retain access even if previously acquired credentials were revoked,” Masubuchi said.
“These accounts blend in with normal operations, enabling long-term access to the internal network. Additionally, the attackers registered their malware as a service or a task scheduler to maintain persistence, ensuring it would run at system startup or upon specific event triggers.”
