InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers have revealed a new malware named MDifyLoader, linked to cyber attacks using security vulnerabilities in Ivanti Connect Secure (ICS) appliances.
A JPCERT/CC report reveals that cybercriminals exploited CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which facilitates Cobalt Strike attacks in memory.
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
CVE-2025-0282 is a critical security vulnerability in ICS that allows remote code execution without authentication. Ivanti fixed it in early January 2025. CVE-2025-22457, which was patched in April 2025, involves a stack-based buffer overflow that could lead to arbitrary code execution.
Both vulnerabilities have been used in the wild as zero-days. JPCERT/CC’s findings from April show that the first issue was exploited to spread malware like SPAWNCHIMERA and DslogdRAT.
Recent analysis of ICS attacks revealed that DLL side-loading was used to deploy MDifyLoader, which contains an encoded Cobalt Strike beacon (version 4.5) released in December 2021.
“MDifyLoader is a loader created based on the open-source project libPeConv,” JPCERT/CC researcher Yuma Masubuchi said. “MDifyLoader then loads an encrypted data file, decodes Cobalt Strike Beacon, and runs it on memory.”
A Go-based remote access tool called VShell and an open-source network scanner named Fscan have been used by several Chinese hacking groups recently.
The execution flow of Fscan:
Fscan is executed via a loader that uses DLL side-loading. This rogue DLL loader uses the open-source tool FilelessRemotePE.
“The used VShell has a function to check whether the system language is set to Chinese,” JPCERT/CC said. “The attackers repeatedly failed to execute VShell, and it was confirmed that each time they had installed a new version and attempted execution again. This behavior suggests that the language-checking function, likely intended for internal testing, was left enabled during deployment.”
After accessing the internal network, the attackers reportedly conducted brute-force attacks on FTP, MS-SQL, and SSH servers and used the EternalBlue SMB exploit (MS17-010) to steal credentials and move laterally within the network.
“The attackers created new domain accounts and added them to existing groups, allowing them to retain access even if previously acquired credentials were revoked,” Masubuchi said.
“These accounts blend in with normal operations, enabling long-term access to the internal network. Additionally, the attackers registered their malware as a service or a task scheduler to maintain persistence, ensuring it would run at system startup or upon specific event triggers.”
