December Threat Intelligence Roundup Covers Exploits, Malware Campaigns and Cyberattacks
Summary
Darkowl’s roundup highlights reported campaigns targeting Central Asia, React2Shell exploitation, attacks on radio equipment and VMware servers, malicious developer packages, and a fake-browser-update campaign.
Key points
- Bloody Wolf reportedly used spoofed documents and emails to deliver NetSupport RAT against government targets in Kyrgyzstan and Uzbekistan.
- Polish police arrested three Ukrainians and seized equipment that authorities said could be used to interfere with strategic IT and telecommunications systems.
- AWS observed Chinese groups Earth Lamia and Jackpot Panda exploiting React2Shell, CVE-2025-55182, shortly after disclosure; the flaw enables unauthenticated remote code execution in React Server Components.
- The FCC reported that attackers hijacked Barix network audio devices at radio stations in Texas and Virginia to broadcast false emergency signals and other material.
- CISA warned of Chinese hackers deploying BrickStorm malware on VMware vSphere environments; one reported intrusion involved lateral movement from a compromised DMZ web server to VMware vCenter.
- A new Glassworm wave reportedly distributed 24 malicious developer packages that could steal developer accounts and cryptocurrency wallet data, and provide SOCKS proxy access.
- RomCom reportedly used SocGholish fake browser-update alerts to deliver Mythic Agent malware and a Python backdoor to a U.S. civil engineering company.
Article Details
- Event Type
- Weekly threat intelligence roundup covering cyberattacks, vulnerability exploitation, malware, and arrests.
- Impact
- Reported activity includes government targeting in Central Asia; alleged preparation to interfere with Polish IT and telecommunications networks; exploitation of React2Shell, with researchers estimating 30 organizations compromised and more than 77,000 internet-exposed IP addresses vulnerable; disruptions to radio broadcasts in Texas and Virginia; malware affecting VMware environments and developer extensions; and malware delivery targeting a U.S. civil engineering company.
MITRE ATT&CK
CVE
CVE-2025-1338Using automated scanning tools, these threat actors have been observed exploiting additional vulnerabilities including CVE-2025-1338.CVE-2025-55182Hours after CVE-2025-55182 was made public, Amazon Web Services (AWS) observed two different Chinese hacking groups, Earth Lamia and Jackpot Panda, beginning to weaponize the vulnerability.
Threat Actors
Bloody WolfReportedly used remote-access software and counterfeit documents to target government organizations in Kyrgyzstan and Uzbekistan.Earth LamiaOne of two groups AWS observed beginning to exploit CVE-2025-55182 shortly after its disclosure.Jackpot PandaOne of two groups AWS observed beginning to exploit CVE-2025-55182 shortly after its disclosure.ROMCOMReportedly used SocGholish fake-update attacks to deliver malware to a U.S. civil engineering company.
Malware
BRICKSTORM5. CISA warns of Chinese “BrickStorm” malware attacks on VMware servers – Bleeping ComputerGlassWorm6. Glassworm malware returns in third wave of malicious VS Code packages – Bleeping ComputerMythic Agent8. RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware – The Hacker NewsNetSupport RATOnce a victim opens the downloaded JAR file, the loader retrieves additional components and installs NetSupport RAT for remote control.SocGholish8. RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware – The Hacker NewsVIPERTUNNELenabling activities such as system reconnaissance and deployment of a custom Python backdoor known as VIPERTUNNEL.
Vendors
Products
BarixThe threat actors targeted Barix network audio devices and reconfigured them to capture attacker-controlled streams.Next.jsIt can be triggered with just one HTTP request and affects any framework that uses React Server Components, including Next.js.OpenVSXFirst emerging in October, the Glassworm campaign, has released 24 new packages distributing malware to OpenVSX and Microsoft Visual Studio.ReactCVE-2025-55182, aka React2Shell, allows unauthenticated remote code execution in React Server Components (RSC).React Server ComponentsCVE-2025-55182, aka React2Shell, allows unauthenticated remote code execution in React Server Components (RSC).VMware vCenterOne of the incidents showed the threat actors compromising a web server in an organization’s demilitarized zone (DMZ) in April 2024, then moved laterally to an internal VMware vCenter server and deployed malware.VMware vSphereCybersecurity and Infrastructure Security Agency (CISA) warn of Chinese hackers backdooring VMware vSphere servers with BrickStorm.
Tools
Countries
KyrgyzstanReports claim the group has been operating a sustained campaign in Kyrgyzstan since June 2025 and recently began targeting Uzbekistan.Poland2. Poland arrests Ukrainians utilizing ‘advanced’ hacking equipment – Bleeping ComputerUzbekistanReports claim the group has been operating a sustained campaign in Kyrgyzstan since June 2025 and recently began targeting Uzbekistan.
Industries
Civil engineeringbased civil engineering company. By targeting poorly secured websites, the group injects fake Google Chrome or Mozilla Firefox update alerts into otherwise legitimate but compromised pages.GovernmentThe threat actor group, Bloody Wolf, has been observed using remote-access software to infiltrate government targets throughout Central Asia.