InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers have revealed a new malware named MDifyLoader, linked to cyber attacks using security vulnerabilities in Ivanti Connect Secure (ICS) appliances.
A JPCERT/CC report reveals that cybercriminals exploited CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which facilitates Cobalt Strike attacks in memory.
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
CVE-2025-0282 is a critical security vulnerability in ICS that allows remote code execution without authentication. Ivanti fixed it in early January 2025. CVE-2025-22457, which was patched in April 2025, involves a stack-based buffer overflow that could lead to arbitrary code execution.
Both vulnerabilities have been used in the wild as zero-days. JPCERT/CC’s findings from April show that the first issue was exploited to spread malware like SPAWNCHIMERA and DslogdRAT.
Recent analysis of ICS attacks revealed that DLL side-loading was used to deploy MDifyLoader, which contains an encoded Cobalt Strike beacon (version 4.5) released in December 2021.
“MDifyLoader is a loader created based on the open-source project libPeConv,” JPCERT/CC researcher Yuma Masubuchi said. “MDifyLoader then loads an encrypted data file, decodes Cobalt Strike Beacon, and runs it on memory.”
A Go-based remote access tool called VShell and an open-source network scanner named Fscan have been used by several Chinese hacking groups recently.
The execution flow of Fscan:
Fscan is executed via a loader that uses DLL side-loading. This rogue DLL loader uses the open-source tool FilelessRemotePE.
“The used VShell has a function to check whether the system language is set to Chinese,” JPCERT/CC said. “The attackers repeatedly failed to execute VShell, and it was confirmed that each time they had installed a new version and attempted execution again. This behavior suggests that the language-checking function, likely intended for internal testing, was left enabled during deployment.”
After accessing the internal network, the attackers reportedly conducted brute-force attacks on FTP, MS-SQL, and SSH servers and used the EternalBlue SMB exploit (MS17-010) to steal credentials and move laterally within the network.
“The attackers created new domain accounts and added them to existing groups, allowing them to retain access even if previously acquired credentials were revoked,” Masubuchi said.
“These accounts blend in with normal operations, enabling long-term access to the internal network. Additionally, the attackers registered their malware as a service or a task scheduler to maintain persistence, ensuring it would run at system startup or upon specific event triggers.”
