InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers have revealed a new malware named MDifyLoader, linked to cyber attacks using security vulnerabilities in Ivanti Connect Secure (ICS) appliances.
A JPCERT/CC report reveals that cybercriminals exploited CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which facilitates Cobalt Strike attacks in memory.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
CVE-2025-0282 is a critical security vulnerability in ICS that allows remote code execution without authentication. Ivanti fixed it in early January 2025. CVE-2025-22457, which was patched in April 2025, involves a stack-based buffer overflow that could lead to arbitrary code execution.
Both vulnerabilities have been used in the wild as zero-days. JPCERT/CC’s findings from April show that the first issue was exploited to spread malware like SPAWNCHIMERA and DslogdRAT.
Recent analysis of ICS attacks revealed that DLL side-loading was used to deploy MDifyLoader, which contains an encoded Cobalt Strike beacon (version 4.5) released in December 2021.
“MDifyLoader is a loader created based on the open-source project libPeConv,” JPCERT/CC researcher Yuma Masubuchi said. “MDifyLoader then loads an encrypted data file, decodes Cobalt Strike Beacon, and runs it on memory.”
A Go-based remote access tool called VShell and an open-source network scanner named Fscan have been used by several Chinese hacking groups recently.
The execution flow of Fscan:
Fscan is executed via a loader that uses DLL side-loading. This rogue DLL loader uses the open-source tool FilelessRemotePE.
“The used VShell has a function to check whether the system language is set to Chinese,” JPCERT/CC said. “The attackers repeatedly failed to execute VShell, and it was confirmed that each time they had installed a new version and attempted execution again. This behavior suggests that the language-checking function, likely intended for internal testing, was left enabled during deployment.”
After accessing the internal network, the attackers reportedly conducted brute-force attacks on FTP, MS-SQL, and SSH servers and used the EternalBlue SMB exploit (MS17-010) to steal credentials and move laterally within the network.
“The attackers created new domain accounts and added them to existing groups, allowing them to retain access even if previously acquired credentials were revoked,” Masubuchi said.
“These accounts blend in with normal operations, enabling long-term access to the internal network. Additionally, the attackers registered their malware as a service or a task scheduler to maintain persistence, ensuring it would run at system startup or upon specific event triggers.”
