eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Counterfeit Notepad++ Used to Deliver Remote Control Backdoors by Black Cat
Bottom Line: The Black Cat cybercriminal group has been observed targeting Chinese users in a large-scale malware distribution campaign, leveraging trojanized versions of Notepad++ delivered through SEO-driven phishing websites.
On January 5th, 2026, the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT), in collaboration with Beijing Microstep Online Technology Co., Ltd. (Microstep Online), released a joint report detailing a malware deployment campaign orchestrated by the BlackCat cybercrime group. The group employed Search Engine Optimization (SEO) strategies to distribute malicious payloads through attacker-controlled phishing websites.
The BlackCat gang’s campaign is believed to have been designed to exfiltrate sensitive data through backdoor malware delivered via trojanized software installers, such as Notepad++. The attackers created phishing websites that enticed victims into downloading the malicious installers. These sites employed SEO techniques to appear among the top search results when victims searched for the legitimate applications. To enhance credibility, the phishing websites presented download links alongside tutorial-style articles. Selecting a download link redirected victims to another phishing page, where they were prompted to choose an installer based on their operating system; all options ultimately pointed to the same malicious download URL. Following the link, victims were directed to a GitHub-like site, where the software installer was embedded with backdoor malware.
The execution of the malicious Notepad++ installer results in the creation of a Windows shortcut (LNK) file on the victim’s system. This LNK file launches the backdoor component, followed by the execution of a malicious Dynamic Link Library (DLL) file. Subsequently, a Portable Executable (PE) payload is decrypted and reflectively loaded into memory. The malware performs registry checks, creates a directory to store exfiltrated data, establishes persistence through startup registry modifications, and connects to a hard-coded command-and-control (C2) domain. The backdoor is designed to steal browser data, perform keystroke logging, and capture clipboard contents.
The eSentire Threat Intelligence Team has identified an incident consistent with the activity described in the report, in which attackers used a trojanized version of Notepad++ to deploy the Winos4.0 post-exploitation framework.
eSentire Threat Intelligence Analysis:
The reported campaign impacted approximately 277,800 servers in China between December 7th and 20th, 2025. This scale indicates extensive use of SEO-optimized phishing websites designed to maximize traffic and successfully lure users into downloading the malicious payloads. These phishing sites impersonated legitimate software download pages for widely used applications such as Notepad++, WinSCP, and Obsidian, suggesting a broad targeting strategy rather than a focus on a specific user group, which further supports the reported high success rate of the campaign. The success of this operation enabled the attackers to build large botnets and/or exfiltrate significant volumes of sensitive user data for subsequent sale or extortion.
The campaign’s use of popular open-source software such as Notepad++ and WinSCP is noteworthy, as these applications are typically distributed via GitHub. In this operation, the attackers deliberately redirected victims to fraudulent GitHub-like websites hosting malicious installer packages, thereby reducing suspicion and increasing the likelihood of successful compromise. Although the malware deployment methods were not particularly advanced and relied on commonly used techniques such as DLL side-loading, the campaign demonstrates the attackers’ effectiveness in deceiving users through well-executed phishing tactics.
The report examines the Black Cat gang’s historical activities and indicates that the group has been leveraging phishing websites to distribute malware and exfiltrate sensitive data from compromised systems since at least 2022. Despite the apparent success of these operations, it is important to note that this group is not affiliated with the BlackCat Ransomware-as-a-Service (RaaS) operation. To defend against threats posed by the Black Cat gang, organizations are recommended to restrict downloads from untrusted sources. Deploying robust Endpoint Detection and Response (EDR) solutions will help in containing malicious payloads. Regular Phishing and Security Awareness Trainings (PSATs) will educate users to identify and report phishing attacks.
The eSentire MDR Suite is capable of detecting the phishing-related activity and deployment of the malicious payloads. The eSentire Threat Intelligence team is tracking this topic for additional detection opportunities.
CISA Adds Two Vulnerabilities to KEV Catalog (CVE-2009-0556, CVE-2025-37164)
Bottom Line: CISA announced the addition of two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog due to observations of active exploitation. These vulnerabilities impact Microsoft Office PowerPoint and Hewlett Packard Enterprise (HPE) OneView.
On January 7th, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The added vulnerabilities include CVE-2025-37164, a Remote Code Execution (RCE) vulnerability impacting Hewlett Packard Enterprise (HPE) OneView, and CVE-2009-0556, a code injection vulnerability within Microsoft Office PowerPoint. Although the additions signal that exploitation has been identified, CISA did not provide any information regarding their observed exploitation. Along with their addition to the KEV, CISA is providing federal agencies with the standard three-week timeframe to ensure that relevant security patches are applied.
CVE-2025-37164 (CVSS: 10) is an RCE vulnerability within the HPE OneView software, impacting all versions through 10.20. Successful exploitation of the vulnerability can enable threat actors to execute arbitrary code on impacted systems, leading to network compromise, data theft, or malware deployment. HPE disclosed the vulnerability on December 16th, 2025, confirming that patches were available. Days after its disclosure, Rapid7 published Proof-of-Concept (PoC) exploit code for CVE-2025-37164, along with confirming that a module for the vulnerability was available within the Metasploit penetration testing framework.
CVE-2009-0556 (CVSS: 9.3) is a code injection vulnerability that impacts Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac. The vulnerability is caused by memory corruption when PowerPoint reads an invalid index in a specially crafted PowerPoint file and can lead to RCE. The vulnerability was disclosed by Microsoft in May 2009 and was addressed in the MS09-017 security update. At the time of disclosure, Microsoft had confirmed that CVE-2009-0556 was “known to be publicly-exploited” based on their telemetry, but provided no additional details.
eSentire Threat Intelligence Analysis:
With CISA's addition of CVE-2025-37164 to the KEV catalog, no details were provided on the context in which exploitation was observed. At the time of writing, there are currently no public reports of exploitation, despite the availability of PoC exploit code and a Metasploit module, which are both items that could potentially signal widespread exploitation. However, as HPE OneView instances are not typically accessible to the Internet, attackers would likely already need access to a network to conduct attacks. Similarly, no information regarding exploitation of CVE-2009-0556 was provided. CVE-2009-0556 is a 16-year-old vulnerability impacting out-of-date versions of PowerPoint. Microsoft initially indicated that exploitation of CVE-2009-0556 had been observed when it disclosed the vulnerability, and it is unclear if its recent addition to the KEV catalog indicates that unpatched versions of PowerPoint are still being targeted.
The addition of CVE-2009-0556 to the KEV catalog is notable, but threat actors targeting old vulnerabilities within Microsoft Office products is not a novel technique. Although not as old, threat actors have been known to continue to target CVE-2017-11882, a memory corruption vulnerability within Microsoft Office, that can lead to RCE. Despite being patched since 2017, threat actors continue to deliver malicious documents via email that attempt to exploit this vulnerability, with the goal of delivering malware. eSentire has also observed recent attacks involving CVE-2017-11882. The Microsoft Office suite is commonly used in organizations around the globe, making vulnerabilities in these applications, even those that have been patched for many years, attractive targets for threat actors.
Due to these trends, it is crucial that organizations ensure that all internally used software is fully up to date on security patches, especially in externally facing applications. To protect against CVE-2025-37164, organizations should restrict access to management interfaces, limiting access to only those that require it, along with applying relevant patches. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to both CVE-2025-37164 and CVE-2009-0556. eSentire MDR for Network has detections in place to identify exploitation of CVE-2025-37164. eSentire published an advisory for CVE-2025-37164 on December 16th, 2025; for additional reading, the vulnerability was also covered in the December 24th Weekly Threat Briefing. eSentire’s Threat Intelligence team continues to track this topic for additional information and detection opportunities.
North Korean Kimsuky Actors Leverage Malicious QR Codes in Spear Phishing Campaigns Targeting U.S. Entities
Bottom Line: The FBI is warning that North Korean threat actors are using QR codes delivered via spear-phishing emails to steal credentials from US-based organizations.
The Federal Bureau of Investigation (FBI), through the Internet Crime Complaint Center (IC3), has issued a warning of ongoing spear phishing campaigns conducted by the North Korean state-sponsored cyber threat group Kimsuky. These campaigns leverage malicious Quick Response (QR) codes, a technique commonly referred to as Quishing, to target U.S. and foreign entities with a nexus to North Korea, including non-governmental organizations, think tanks, academic institutions, and government-affiliated personnel.
As of 2025, Kimsuky actors have increasingly embedded malicious QR codes within phishing emails to redirect victims from managed corporate endpoints to personal or unmanaged mobile devices. Once scanned, the QR codes route victims through attacker-controlled infrastructure designed to collect device and identity attributes.
The FBI has identified multiple real-world instances of this activity, including campaigns in which attackers impersonated foreign advisors, embassy personnel, and think tank employees to solicit policy insights or invite victims to fictitious conferences.
The attacks observed in May 2025 involved sophisticated social engineering, where the threat actors impersonated a foreign advisor and sent an email to a think tank leader, requesting insights into developments on the Korean Peninsula. The email included a QR code that directed the recipient to a questionnaire. Later that same month, the actors posed as an embassy employee and solicited input from a senior fellow at another think tank regarding North Korean human rights issues. They again provided a QR code, claiming it would grant access to a secure drive.
In June 2025, Kimsuky actors sent a spear phishing email to a strategic advisory firm, inviting recipients to register for a non-existent conference through a QR code. The QR code directed users to a registration landing page, which featured a button that redirected them to a fake Google account login page, where their credentials could be collected.
eSentire Threat Intelligence Analysis:
The Kimsuky campaign highlights a shift toward identity-centric intrusion that attempts to exploit user behavior and mobile device blind spots. This technique poses a threat because it shifts the attack surface from managed corporate endpoints to unmanaged mobile devices, which may come outside the purview of endpoint detection and response tools and network inspection. The use of malicious QR codes represents a low-noise initial access vector that is well-suited for long-term intelligence collection. The theft and replay of session tokens can result in the compromise of cloud identities, allowing the attackers to maintain access, exfiltrate data, and disseminate further spear phishing campaigns from trusted internal accounts. The North Korean threat actor Kimsuky has previously exploited email authentication weaknesses and distributed Android malware called DocSwap via QR codes. The operation impersonated a Seoul-based logistics company CJ Logistics, using fake delivery tracking applications to deceive victims.
Kimsuky’s Quishing attack lifecycle notably involved the impersonation of various high-profile entities. By masquerading as trusted invitation emails, the attackers significantly increased the likelihood of the phishing emails being opened, thereby increasing the success rate of the attack. While the phishing emails in this campaign seem to be more convincing, user-education remains an effective security measure. While not an end solution to the threat of phishing, Multi-Factor Authentication (MFA) will significantly reduce the value of compromised credentials. As attackers cannot log into an account without the secondary authentication method, there are still significant barriers to overcome for threat actors attempting to employ the compromised credentials. Organizations should also educate employees about the risks of scanning unsolicited QR codes, regardless of the source, and implement training programs that teach staff to recognize social engineering techniques involving QR codes, including urgent requests and impersonation of trusted entities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
