eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
YiBackdoor: A New Malware Family with Links to IcedID and Latrodectus
Bottom Line: Details have emerged on a newly identified malware, dubbed YiBackdoor, which is believed to have ties to the IcedID and Latrodectus malware. Although infections are currently limited and the backdoor appears to be in a development stage, it nevertheless poses a threat due to its capabilities.
Researchers at Zscaler have identified a new malware family named YiBackdoor, which was first observed in June 2025. This backdoor demonstrates strong similarities in code structure and functionality with the established malware families IcedID and Latrodectus. Observations of the threat are limited but, YiBackdoor’s modular, plugin-based architecture indicates that it has the potential to expand its capabilities rapidly.
YiBackdoor ensures that only one instance of the malware runs on a system by creating a mutual exclusion (mutex). The malware injects its code into the Service Host (svchost.exe) process and hooks the RtlExitUserProcess function to maintain persistence within the target process. To achieve long-term persistence, YiBackdoor copies itself into a hidden directory and registers itself in the Windows registry. After installation, the original executable may self-delete to hinder forensic investigation.
YiBackdoor employs multiple techniques to evade analysis and detection. It detects virtualization environments using the CPUID instruction, targeting platforms such as VMware, Xen, KVM, VirtualBox, and Hyper-V. It also performs timing checks using the rdtsc instruction to identify potential sandbox environments. The malware dynamically resolves Windows API functions via hashing, which complicates static analysis. Additionally, strings and components are decrypted only at runtime, making signature-based detection less effective.
YiBackdoor stores its configuration in an encrypted blob, which contains information about Command-and-Control (C2) servers, encryption keys, URIs, and botnet identifiers. YiBackdoor communicates with its C2 server by sending encrypted metadata in custom HTTP headers, such as X-tag, and receives encrypted responses using TripleDES and Base64 encoding. The malware supports commands that include gathering system information, taking screenshots, executing shell commands, executing PowerShell scripts, executing commands via plugins, and loading new plugins.
eSentire Threat Intelligence Analysis:
YiBackdoor represents an emerging threat due to its advanced anti-analysis techniques and evasion strategies. Features such as CPUID-based virtualization detection, timing checks, runtime decryption of strings, and API hashing indicate that YiBackdoor is built with reverse engineering resistance in mind. These methods complicate both automated sandbox analysis and manual investigations, giving attackers more time to operate undetected. Additionally, its modular plugin framework enables rapid deployment of new capabilities, and its code reuse with established malware families such as IcedID and Latrodectus suggests that it is developed by experienced threat actors.
Zscaler states that YiBackdoor is likely in a testing or early deployment phase. The limited number of observed infections does not reduce the potential threat. The similarities with IcedID and Latrodectus suggest that the operators already have established infrastructure and networks to scale up distribution quickly once the malware proves stable. Malware families like IcedID also started in limited campaigns before becoming widespread. The presence of a plugin system means adversaries can expand functionality quickly, enabling YiBackdoor to adapt to different attack scenarios such as banking fraud, ransomware delivery, or corporate espionage. Proactive defenses are critical to get ahead of potential mass exploitation.
Organizations are advised to implement multiple layers of defense to detect and mitigate such infections. Endpoint monitoring should include alerts for anomalous process creation, code injection, and changes to registry Run keys. Network monitoring should focus on blocking connections to known C2 servers and inspecting outbound HTTP requests for unusual network traffic. Indicators of Compromise (IoCs), including file hashes and C2 domains, should be integrated into Security Information and Event Management (SIEM) and endpoint detection and response platforms. Additionally, organizations should implement least-privilege policies, network segmentation, and be prepared to analyze malicious files during incident response.
In response, the eSentire Threat Intelligence team is actively tracking this topic for new details and detection opportunities.
Cisco Discloses Two Zero-Day Vulnerabilities Impacting Cisco ASA and FTD Products
Bottom Line: Two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362 in Cisco ASA and FTD software are being actively exploited, with links to the 2024 ArcaneDoor espionage campaign. Given the risk of exploitation organizations are strongly advised to apply patches immediately.
On September 25th, 2025, Cisco disclosed two zero-day vulnerabilities, CVE-2025-20333 (CVSS: 9.9) and CVE-2025-20362 (CVSS: 6.5), in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The disclosure confirmed that the vulnerabilities are being actively exploited in the wild; CVE-2025-20333 allows authenticated, remote attackers to execute arbitrary code on vulnerable ASA and FTD instances, while CVE-2025-20362 enables remote attackers to access restricted URL endpoints without authentication.
In May 2025, Cisco, in coordination with the Australian Signals Directorate Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the United Kingdom's National Cyber Security Centre (NCSC) and the United States’ Cybersecurity and Infrastructure Security Agency (CISA), conducted an investigation into incidents affecting specific Cisco ASA 5500-X Series devices equipped with Cisco Secure Firewall ASA Software, particularly those with the VPN web service enabled. The attackers successfully exploited these vulnerable devices to deploy malware, execute remote commands, and potentially exfiltrate data. The investigation uncovered the two zero-day vulnerabilities which were leveraged in the attacks.
CVE-2025-20333 and CVE-2025-20362 both exist due to improper validation of user-supplied input in HTTP(S) requests. An attacker possessing valid VPN user credentials could exploit CVE-2025-20333 by sending specially crafted HTTP requests to a vulnerable device, thereby enabling the execution of arbitrary code with root privileges, which could potentially lead to the complete compromise of the affected device. Similarly, an attacker could exploit CVE-2025-20362 by sending crafted HTTP requests to a targeted web server on the device, allowing them to access a restricted URL without requiring authentication.
Cisco's investigation uncovered a sophisticated attack that employed advanced evasion techniques, including disabling logging, intercepting Command Line Interface (CLI) commands, and deliberately crashing devices to thwart diagnostic analysis. The threat actor was observed modifying the ROMMON to maintain persistence through reboots and software upgrades on Cisco ASA 5500-X Series devices that do not have secure boot capabilities. Based on these findings, Cisco assessed with high confidence that this new activity is associated with the same threat actor, tracked as UAT4356 (aka Storm-1849), who was behind the ArcaneDoor cyber espionage campaign reported by Cisco in early 2024.
Technical details and Proof-of-Concept (PoC) exploit code are not publicly available at the time of writing. Following Cisco's security advisory release, CISA published an emergency directive mandating federal agency to identify and mitigate the vulnerabilities by September 26th, 2025.
eSentire Threat Intelligence Analysis:
The active exploitation of CVE-2025-20333 and CVE-2025-20362 poses a critical threat to unpatched systems, with the potential for full system compromise if the vulnerabilities are not addressed promptly. The severity is underscored by the involvement of several government agencies in the investigation, CISA’s tight remediation timeline, and connections to the threat actor associated with the ArcaneDoor campaign.
Cisco’s investigation into the ArcaneDoor campaign in April 2024, led to the identification of two vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco ASA and FTD Software. The campaign was reportedly highly sophisticated, targeting multiple governments and critical infrastructure networks. Cisco's assessment that the same threat actor may be involved in the current exploitation of CVE-2025-20333 and CVE-2025-20362 significantly raises concern, given the actor's demonstrated deep understanding in exploiting Cisco ASA and FTD appliances. The eSentire Threat Intelligence team addressed the ArcaneDoor campaign in a security advisory dated April 25th, 2024. Based on the campaign’s strong focus on espionage and the highly sophisticated nature of the attacks, Cisco has assessed the activity to be associated with a state-sponsored threat actor. A report from Censys suggests the potential involvement of a China-based threat actor, based on its analysis of Indicators of Compromise (IoCs) shared by Cisco.
On September 25th, 2025, UK’s NCSC published a detailed malware analysis report on payloads observed in the exploitation of CVE-2025-20333 and CVE-2025-20362. The report provides insights on RayInitiator, a persistent multi-stage bootkit, and LINE VIPER, a user-mode shellcode loader. Both RayInitiator and LINE VIPER use victim-specific tokens, a method previously seen in ArcaneDoor campaign.
Cisco has released a detection guide to help organizations identify potentially malicious traffic targeting devices running Cisco ASA or FTD Software. Additionally, Cisco offers a Software Checker tool that administrators should use to determine whether their devices are affected by the vulnerabilities, enabling timely patching and mitigation efforts. While patching remains the ultimate mitigation, organizations can mitigate the risk by disabling all SSL/TLS-based VPN web services including IKEv2 client services. For compromised devices that do not support secure boot, Cisco recommends booting into a fixed software release. This action will remove the persistence mechanism established during exploitation.
eSentire Managed Vulnerability Service (MVS) will has plugins in place to identify devices vulnerable to CVE-2025-20333, while plugins for CVE-2025-20362 are listed as coming soon. eSentire MDR for Log has detections in place to identify Cisco ASA anomalous sign-in activity and MDR for Network has detections in place to identify LINE VIPER related activity. The eSentire Threat Intelligence team issued a security advisory on September 25th, 2025, addressing the Cisco vulnerabilities.
DeceptiveDevelopment: From Primitive Crypto Theft to Sophisticated AI-based Deception
Bottom Line: DeceptiveDevelopment, linked to North Korea, is a financially motivated threat group with ties to the Remote IT Workers campaign. The group targets software developers, using social engineering tactics to deploy malware. Stolen data from the group is used to enable further attacks by other North Korean-linked threat actors.
On September 25th, 2025, researchers at ESET published a report on the North Korean-aligned threat group, DeceptiveDevelopment, believed to have been in operation since 2023. The DeceptiveDevelopment group has ties to the North Korean Remote IT Workers campaign, tracked as the WageMole activity cluster, with ESET claiming that they are “two tightly connected North Korea-aligned entities”. ESET notes that while both DeceptiveDevelopment and Remote IT Workers have different objectives, they are both driven by financial motivations, with each campaign playing a “distinct and complementary role” in relation to the other.
DeceptiveDevelopment threat actors target software developers, specifically those associated with cryptocurrency and Web3 projects. ESET states that “initial access is achieved exclusively via various social engineering techniques”, including ClickFix and fake job recruiter profiles to deliver trojanized codebases during interviews. DeceptiveDevelopment is known to pose as recruiters on various social networking and freelance job market websites, offering lucrative job opportunities to attract interest. One technique used by the group involves providing candidates with a coding challenge or pre-interview task, which entails the user downloading a trojanized project from a private repository hosted on GitHub, GitLab, or BitBucket. Execution of the malicious code leads to the deployment of malware. Another technique used is ClickFix, which begins by sending the victim to a fake job interview site. After having the user invest time by completing a lengthy application, DeceptiveDevelopment requires a video recording for the final question. Webcam access is requested, but a pop-up appears stating that access is blocked and provides the user with a URL to a page stating how to fix the issue. This URL leads to the ClickFix webpage, which provides the user with a command to execute, under the guise of enabling webcam access.
Both the trojanized code and ClickFix methods are used to deploy a variety of malware on a victim’s machine, including the BeaverTail and OtterCookie malware. These information stealers are used to collect sensitive data from infected hosts, including cryptocurrency wallet data, keychains, and saved browser credentials. The malware is also used to deliver additional payloads, including the Remote Access Trojan (RAT) InvisibleFerret, WeaselStore (aka GolangGhost, PylangGhost, FlexibleFerret), Tropidoor, AkdoorTea, and TsunamiKit. ESET notes that the information stolen by DeceptiveDevelopment is then used by North Korean Remote IT workers to pose as job seekers, employing “several tactics, including proxy interviewing, using stolen identities, and fabricating synthetic identities with AI-driven tools” to secure a legitimate employment opportunity.
eSentire Threat Intelligence Analysis:
The usage of data stolen by DeceptiveDevelopment by other North Korean threat actors is notable, as it shows close inner-workings between different groups. However, the relationship identified between these campaigns is not new, evidenced by a Zscaler report from 2024, claiming that actions from the Contagious Interview campaign, which enabled theft of personal data, were used to create fake identities to secure remote jobs in the WageMole campaign. ESET indicates that Remote IT Worker campaigns have been ongoing since April 2017, likely hinting at a deep relationship between the Remote IT Workers campaign and operations like Contagious Interview and the one performed by DeceptiveDevelopment. The duration that these campaigns have been operating underscores their effectiveness, which is reportedly used as a critical stream of revenue to fund the Democratic People's Republic of Korea (DPRK) regime.
During their investigation into this campaign, ESET was able to link DeceptiveDevelopment to other North Korean threat actors through the usage of similar tools. BeaverTail, OtterCookie, WeaselStore, and InvisibleFerret are malware strains that are commonly used by North Korean threat actors, and ESET also claims that the Tropidoor malware “shares large portions of code with PostNapTea”, a RAT used by the Lazarus group in 2022. The techniques used by DeceptiveDevelopment have also been seen in use within other campaigns attributed to North Korean threat actors, including similar targets within the DEV#POPPER and Void Dokkaebi campaigns, and similar usage of ClickFix to the ClickFake Interview campaign. This high overlap of tools and Tactics, Techniques, and Procedures (TTPs) between various North Korean-linked groups and campaigns could suggest collaboration, aligned strategic goals, and a tightly connected state-directed ecosystem.
To protect against threats relating to DeceptiveDevelopment, organizations should instruct users to never download and execute code retrieved from untrusted sources. Organizations should also ensure that a strong vetting process is implemented for new hires, require the usage of corporate hardware, and implementing strict access controls following the Principle of Least Privilege. For additional reading on the malware commonly used by North Korean threat actors, please see the blogs published by eSentire's Threat Response Unit (TRU) on BeaverTail and InvisibleFerret. The TRU team spoke to the North Korean Remote IT Workers campaign in the May 2025 TRU Intelligence Briefing. eSentire's Threat Intelligence team continues to track campaigns linked to North Korean threat actors for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
