Emerging Malware Threats Exploiting New Delivery Methods

First seen 30 Nov 2025, 04:37 UTC • Securityaffairs.Co

•97% similarity •15

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Recent malware campaigns have been identified utilizing innovative techniques for delivery and execution. Notable threats include the use of JSON storage services for malware delivery and the resurgence of Gootloader, which is spreading malicious payloads through compromised infrastructure. These attacks are impacting various sectors, including defense and software development environments.

ThreatCluster AI

Attack Flow

23 entities, 53 inferred relationships (STIX 2.1).

Technique (3)

Malware
Ransomware
Supply Chain Attack

Campaign (2)

GPT Trade
Water Saci Campaign

Vulnerability (1)

CVE-2025-59287

Malware (7)

Glassworm
Gootloader
Roningloader
Sesameop
ShadowPad
Shai-hulud 2.0
SSH-Tor Backdoor

Affected Platform (4)

Google Play Store
Linux
Windows
WSUS

Threat Actor (2)

Qilin
Ransomvibing

Tool (4)

Npm
VS Code
Adspect Cloaking
OpenAI Assistants API

Relationships

Qilin uses Glassworm
Qilin uses Gootloader
Qilin uses Roningloader
Qilin uses Sesameop
Qilin uses ShadowPad
Ransomvibing uses Glassworm
Ransomvibing uses Gootloader
Ransomvibing uses Roningloader
Ransomvibing uses Sesameop
Ransomvibing uses ShadowPad
Qilin uses Npm
Qilin uses VS Code
Qilin uses Adspect Cloaking
Qilin uses OpenAI Assistants API
Ransomvibing uses Npm
Ransomvibing uses VS Code
Ransomvibing uses Adspect Cloaking
Ransomvibing uses OpenAI Assistants API
Qilin uses Malware
Qilin uses Ransomware
Qilin uses Supply Chain Attack
Ransomvibing uses Malware
Ransomvibing uses Ransomware
Ransomvibing uses Supply Chain Attack
Glassworm exploits CVE-2025-59287
Gootloader exploits CVE-2025-59287
Roningloader exploits CVE-2025-59287
Sesameop exploits CVE-2025-59287
ShadowPad exploits CVE-2025-59287
Shai-hulud 2.0 exploits CVE-2025-59287
SSH-Tor Backdoor exploits CVE-2025-59287
Npm exploits CVE-2025-59287
VS Code exploits CVE-2025-59287
Adspect Cloaking exploits CVE-2025-59287
OpenAI Assistants API exploits CVE-2025-59287
GPT Trade attributed to Qilin
GPT Trade attributed to Ransomvibing
Water Saci Campaign attributed to Qilin
Water Saci Campaign attributed to Ransomvibing
GPT Trade uses Glassworm
GPT Trade uses Gootloader
GPT Trade uses Roningloader
GPT Trade uses Sesameop
GPT Trade uses ShadowPad
Water Saci Campaign uses Glassworm
Water Saci Campaign uses Gootloader
Water Saci Campaign uses Roningloader
Water Saci Campaign uses Sesameop
Water Saci Campaign uses ShadowPad
CVE-2025-59287 targets Google Play Store
CVE-2025-59287 targets Linux
CVE-2025-59287 targets Windows
CVE-2025-59287 targets WSUS

Community

Browse all →

Emerging Malware Threats Exploiting New Delivery Methods

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading