DarkOwl’s October Threat Intelligence Roundup Covers Breaches, Malware and Exploits
Summary
DarkOwl’s roundup highlights ransomware and data-breach claims, a $15 billion crypto seizure, malware campaigns, Salesforce-related extortion, actively exploited vulnerabilities, and a breach affecting 17.6 million Prosper accounts.
Key points
- Medusa claimed it exfiltrated 834.4 GB of data connected to Comcast and demanded $1.2 million; the claim was not independently confirmed in this roundup.
- The U.S. Department of Justice seized $15 billion in Bitcoin tied to a Cambodian organization accused of operating large-scale cryptocurrency scams and forced-labor call centers.
- ChaosBot uses Discord for command and control and was reportedly delivered through phishing messages containing malicious Windows shortcut files.
- A group calling itself Scattered Lapsus$ Hunters reportedly sought to extort 39 companies over Salesforce-related data, while Salesforce disputed the connection to confirmed incidents.
- CISA added three vulnerabilities affecting Dassault Systèmes DELMIA Apriso and XWiki to its list of flaws under active exploitation.
- Have I Been Pwned reported that the Prosper breach affected 17.6 million email addresses; Prosper said personal information, including Social Security numbers, was obtained.
- The roundup also describes PassiveNeuron targeting organizations across several regions and BatShadow using job-themed lures to deliver Vampire Bot malware.
Article Details
- Event Type
- Threat intelligence roundup covering ransomware extortion, cryptocurrency-related law enforcement action, malware campaigns, data breaches, and actively exploited vulnerabilities.
- Impact
- Reported incidents include Medusa's claim of stealing 834.4 GB of Comcast data and demanding $1.2 million; a DOJ seizure of $15 billion in Bitcoin connected to the Cambodian Prince Group; malware campaigns targeting victims' systems; extortion demands against 39 companies affected by Salesforce breaches, involving approximately 1 billion records; active exploitation of vulnerabilities affecting DELMIA Apriso and XWiki; and a Prosper breach affecting 17.6 million email addresses. Some breach and data-theft details are claims or company statements, and Prosper had not disclosed how the data was obtained.
MITRE ATT&CK
T1059.001 · PowerShellA PowerShell command executes after a victim opens the malicious Windows shortcut used to deliver ChaosBot.T1102 · Web ServiceChaosBot is reported to abuse Discord channels for command and control.T1190 · Exploit Public-Facing ApplicationThe article reports possible exploitation of an application SQL injection flaw as one potential way PassiveNeuron gained access; the exact method is unknown.T1566 · PhishingThe article reports phishing messages used to deliver ChaosBot and phishing emails as a typical Medusa access method.
CVE
CVE-2025-24893The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.CVE-2025-6204The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.CVE-2025-6205The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.
Threat Actors
BatShadowVietnamese threat actor reported to have used social engineering to deliver Vampire Bot to job seekers and digital marketing professionals.Cambodian Prince GroupCriminal organization described as orchestrating large-scale cryptocurrency scams and operating companies involved in extortion.MedusaRansomware group that claimed responsibility for exfiltrating Comcast data and demanded payment.PassiveNeuron APTThreat actor group reported targeting government, financial, and industrial organizations in Asia, Africa, and Latin America.Scattered Lapsus$ HuntersGroup reported to have launched a data leak site extorting companies affected by Salesforce breaches.
Malware
ChaosBot3. New Rust-Based Malware “ChaosBot” Uses Discord Channels to Control Victims’ PCs – Bleeping ComputerNeuralExecutor7. Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware – The Hacker NewsNeursite7. Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware – The Hacker NewsVampire Bot8. BatShadow Group Uses New Go-Based ‘Vampire Bot’ Malware to Hunt Job Seekers – The Hacker News
Vendors
Products
DELMIA AprisoCybersecurity and Infrastructure Security Agency (CISA) listed three new vulnerabilities that have impacted Dassault Systèmes DELMIA Apriso and XWiki.Discord3. New Rust-Based Malware “ChaosBot” Uses Discord Channels to Control Victims’ PCs – Bleeping ComputerMicrosoft SQLOne incident showed that the threat actors were able to gain initial access through remote command on a compromised machine running Windows Servers through Microsoft SQL.Microsoft WindowsThe malware was observed using phishing messages that contained a malicious Windows shortcut file, after opening the file, a PowerShell command is executed to download and execute ChaosBot.Salesforce4. ShinyHunters launches Salesforce data leak site to extort 39 victims – Bleeping ComputerXWiki5. Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack – The Hacker News
Countries
Industries
financialThe malware campaign dubbed, PassiveNeuron, was first flagged using different methods in November 2024 for targeting government, financial, and industrial organizations located in Asia, Africa, and Latin America.GovernmentThe malware campaign dubbed, PassiveNeuron, was first flagged using different methods in November 2024 for targeting government, financial, and industrial organizations located in Asia, Africa, and Latin America.IndustrialThe malware campaign dubbed, PassiveNeuron, was first flagged using different methods in November 2024 for targeting government, financial, and industrial organizations located in Asia, Africa, and Latin America.