Global Malware Threats: Latest Cybersecurity Attacks, APT Campaigns, and Emerging Risks – September 2025 Roundup

Stored notes, separate from the original source; may contain errors. Verify claims and remediation against the original publisher.

## **TL;DR**
The **September 2025 Malware Newsletter** highlights the most critical cybersecurity threats and research findings from around the world. Key insights include:
- **North Korean APT37** targeting South Korea in **Operation HanKook Phantom**.
- **Lazarus Group** deploying **three new Remote Access Trojans (RATs)** to infiltrate systems.
- **AI-driven malware campaigns**, including exploits of **X’s Grok AI** to bypass ad protections.
- **Emerging threats** like **Android droppers**, **Ethereum smart contract exploits**, and **ransomware recovery methods**.

---

## **Introduction**
The cybersecurity landscape continues to evolve at an unprecedented pace, with **state-sponsored Advanced Persistent Threat (APT) groups**, **cybercriminal syndicates**, and **AI-driven attack vectors** posing significant risks to individuals, organizations, and governments. This **September 2025 Malware Newsletter** curates the most impactful research, attacks, and defensive strategies to keep you informed about the latest threats and mitigation techniques.

---

## **🔍 Key Malware Threats and Campaigns**

### **1️⃣ State-Sponsored APT Attacks**
State-sponsored threat actors remain among the most sophisticated and persistent cyber adversaries. Recent campaigns highlight their evolving tactics:

- **[Operation HanKook Phantom](https://www.seqrite.com/blog/operation-hankook-phantom-north-korean-apt37-targeting-south-korea/)**:
  North Korea’s **APT37** group has launched a targeted campaign against **South Korean entities**, leveraging **custom malware** and **social engineering** techniques to infiltrate high-value targets. The operation underscores the geopolitical tensions in the region and the increasing sophistication of APT groups.

- **[Lazarus Group’s Triple RAT Threat](https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/)**:
  The infamous **Lazarus Group**, linked to North Korea, has been observed deploying **three new Remote Access Trojans (RATs)**. These RATs are designed to **evade detection**, **exfiltrate sensitive data**, and **maintain persistence** within compromised networks.

- **[APT28’s NotDoor Backdoor](https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/)**:
  Russia’s **APT28** (also known as Fancy Bear) has expanded its arsenal with **NotDoor**, a **covert backdoor** used to infiltrate systems and conduct espionage. This tool demonstrates the group’s ability to adapt and innovate in response to defensive measures.

- **[Gamaredon (APT-C-53) Targets Ukraine](https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247507351&idx=1&sn=0b8c9e5b3ff9d7b6551b3a69c151f7e0&chksm=f9c1ee9eceb66788c94178eec69e10142c58dc7721874f9e4d3120d7ea952faa230221a6e2cc)**:
  The **Gamaredon** group, attributed to Russian intelligence, has intensified its attacks against **Ukrainian government departments**. These campaigns leverage **phishing emails** and **custom malware** to compromise critical infrastructure.

---

### **2️⃣ AI and Malvertising Exploits**
Artificial Intelligence (AI) is increasingly being weaponized by cybercriminals to bypass security measures and automate attacks:

- **[X’s Grok AI Exploited for Malware Distribution](https://thehackernews.com/2025/09/cybercriminals-exploit-xs-grok-ai-to.html)**:
  Cybercriminals are exploiting **X’s Grok AI** to **bypass ad protections** and distribute malware to millions of users. This tactic highlights the risks of **AI-driven platforms** being manipulated for malicious purposes.

- **[Meta’s Malvertising Campaign](https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide)**:
  A **malvertising campaign** on **Meta’s platforms** has expanded to **Android devices**, pushing **advanced crypto-stealing malware**. Users worldwide are at risk of **financial theft** and **data compromise**.

---

### **3️⃣ Mobile and macOS Threats**
Mobile devices and macOS systems are increasingly targeted by cybercriminals:

- **[Android Droppers: Silent Gatekeepers of Malware](https://www.threatfabric.com/blogs/android-droppers-the-silent-gatekeepers-of-malware)**:
  **Android droppers** act as **gatekeepers** for malware, silently installing malicious payloads on devices. These tools are designed to **evade detection** and **compromise user privacy**.

- **[AMOS Stealer Campaign](https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html)**:
  A **macOS stealer campaign** is targeting users through **"cracked" apps**. The **AMOS stealer** exfiltrates sensitive data, including **credentials** and **financial information**.

---

### **4️⃣ Cryptocurrency and Blockchain Exploits**
Cryptocurrency platforms and blockchain technologies are prime targets for cybercriminals:

- **[Ethereum Smart Contract Exploits](https://www.reversinglabs.com/blog/ethereum-contracts-malicious-code)**:
  Threat actors are using **Ethereum smart contracts** to distribute **malicious code** via **npm packages**. This tactic targets **developers** and **cryptocurrency users**, putting their assets at risk.

- **[Malicious npm Packages](https://socket.dev/blog/malicious-npm-packages-impersonate-flashbots-sdks-targeting-ethereum-wallet-credentials)**:
  **Fake npm packages** impersonating **Flashbots SDKs** are being used to **steal Ethereum wallet credentials**. Developers and users must exercise caution when installing third-party packages.

---

### **5️⃣ Ransomware and DDoS Attacks**
Ransomware and Distributed Denial of Service (DDoS) attacks continue to disrupt organizations globally:

- **[RapperBot: Instant DDoS Attacks](https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second)**:
  The **RapperBot malware** can **infect systems** and launch **DDoS attacks** in a matter of seconds. Its rapid execution makes it a formidable threat to **network stability**.

- **[Real-Time Ransomware Detection](https://www.mdpi.com/2078-2489/16/9/739)**:
  Researchers have developed a **real-time ransomware detection method** based on **simple format analysis**. This approach aims to **minimize damage** and **recover encrypted files** efficiently.

---

### **6️⃣ IoT and Wireless Network Threats**
The Internet of Things (IoT) and wireless networks are vulnerable to sophisticated malware propagation techniques:

- **[Malware Propagation in Wireless Networks](https://www.mdpi.com/2079-9292/14/17/3528)**:
  A new **modeling technique** analyzes how malware spreads in **wireless mobile networks with hotspots**. This research considers **user movement patterns** to predict and mitigate outbreaks.

- **[BIDO: Image-Based Malware Detection](https://arxiv.org/abs/2509.03807)**:
  The **BIDO framework** addresses **obfuscation** and **concept drift** challenges in **image-based malware detection**, improving the accuracy of threat identification.

---

### **7️⃣ Supply Chain and AI-Driven Attacks**
Supply chain attacks and AI-driven threats are reshaping the cybersecurity landscape:

- **[s1ngularity’s Nx Supply Chain Attack](https://www.wiz.io/blog/s1ngularitys-aftermath)**:
  The **s1ngularity attack** targeted the **Nx supply chain**, leveraging **AI and advanced Tactics, Techniques, and Procedures (TTPs)**. This incident underscores the **growing risk of supply chain compromises**.

- **[Colombian Malware Campaign](https://blog.virustotal.com/2025/09/uncovering-colombian-malware-campaign.html)**:
  A **Colombian malware campaign** was uncovered using **AI code analysis**. This discovery highlights the role of **AI in threat detection** and **malware reverse engineering**.

---

## **🔮 Future Implications**
The cybersecurity threats outlined in this newsletter demonstrate the **evolving tactics** of threat actors, from **state-sponsored APT groups** to **cybercriminal syndicates**. Key takeaways include:
- **AI-driven attacks** are becoming more prevalent, requiring **advanced detection methods**.
- **Mobile and macOS threats** are on the rise, necessitating **robust security measures**.
- **Supply chain attacks** and **cryptocurrency exploits** demand **proactive defense strategies**.

Organizations and individuals must **stay vigilant**, **adopt multi-layered security approaches**, and **leverage threat intelligence** to mitigate risks effectively.

---

## **📌 Additional Resources**
For further insights, explore these authoritative sources:
- **[MITRE ATT&CK Framework](https://attack.mitre.org/)**
- **[CISA Cybersecurity Resources](https://www.cisa.gov/)**
- **[Krebs on Security](https://krebsonsecurity.com/)**

---
Follow **Security Affairs** for the latest updates:
- **Twitter**: [@securityaffairs](https://twitter.com/securityaffairs)
- **Facebook**: [Security Affairs](https://www.facebook.com/sec.affairs)
- **Mastodon**: [@securityaffairs](https://infosec.exchange/@securityaffairs)

**Author**: [Pierluigi Paganini](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559) – [Security Affairs](http://securityaffairs.co/wordpress/)