Scope and Execution of Operation Endgame

Between May 19 and 22, 2025, Operation Endgame mobilized law enforcement agencies from Germany, France, the Netherlands, Denmark, the United Kingdom, the United States, and Canada. The coordinated effort focused on disrupting services and infrastructures that facilitate initial access for ransomware attacks. This phase of the operation targeted malware variants and successor groups that had re-emerged following previous takedowns, including Bumblebee, Lactrodectus, QakBot, HijackLoader, DanaBot, TrickBot, and WARMCOOKIE.

The operation’s achievements are substantial:

• 300 servers dismantled worldwide
• 650 domains neutralized
• €3.5 million in cryptocurrency seized during the action week
• 20 international arrest warrants issued against key individuals involved in providing or operating initial access services to ransomware groups

These actions bring the total amount seized during Operation Endgame to over €21.2 million, underscoring the operation’s ongoing impact since its inception in May 2024.

Targeted Malware and Criminal Networks

Operation Endgame specifically targeted “initial access malware,” which cybercriminals use to infiltrate systems and deploy additional malicious software, including ransomware. The malware variants addressed in this operation are often offered as services to other threat actors, facilitating large-scale ransomware attacks.

Among the individuals targeted, several have been added to the EU Most Wanted list, including:

• Roman Mikhailovich Prokop (aka carterj), 36, associated with the QakBot group
• Danil Raisowitsch Khalitov (aka dancho), 37, associated with the QakBot group
• Iskander Rifkatovich Sharafetdinov (aka alik, gucci), 32, associated with the TrickBot group
• Mikhail Mikhailovich Tsarev (aka mango), 36, associated with the TrickBot group
• Maksim Sergeevich Galochkin (aka bentley, manuel, Max17, volhvb, crypt), 43, associated with the TrickBot group
• Vitalii Nikolaevich Kovalev (aka stern, ben, Grave, Vincent, Bentley, Bergen, Alex Konor), 36, associated with the TrickBot group

These individuals are believed to play significant roles in providing or operating services that grant ransomware groups access to victim systems.

International Collaboration and Future Actions

The success of Operation Endgame highlights the importance of international cooperation in combating cybercrime. Europol and Eurojust provided essential support, including coordination, operational and analytical assistance, cryptocurrency tracing, and facilitating real-time information exchange among participating agencies.

The operation is ongoing, with follow-up actions planned. Several key suspects remain at large, and efforts to apprehend them continue. German authorities have announced that 18 of these suspects will be added to the EU Most Wanted list, emphasizing the commitment to bringing all perpetrators to justice.

Impact on the Cybercrime Landscape

Operation Endgame represents a strategic effort to disrupt the ransomware kill chain at its source by targeting the infrastructure and services that enable these attacks. By dismantling servers, neutralizing domains, and apprehending key individuals, law enforcement agencies aim to significantly hinder the operations of ransomware groups.

Europol Executive Director Catherine De Bolle stated, “This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganize. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source.”

Conclusion

The dismantling of over 300 servers and the seizure of €3.5 million in cryptocurrency during Operation Endgame marks a significant milestone in the global effort to combat ransomware and cybercrime. The operation’s success underscores the effectiveness of international collaboration and the importance of targeting the foundational elements of cybercriminal operations.

As Operation Endgame continues, law enforcement agencies remain vigilant, adapting their strategies to counter the evolving tactics of cybercriminals. The ongoing efforts serve as a reminder that, through coordinated action and determination, the global community can make substantial strides in securing the digital landscape against malicious actors.

The post Europol’s Operation Endgame Dismantles Global Ransomware Infrastructure appeared first on CyberHood Sentinel.

The ClickFix technique is particularly insidious because it allows malware to execute directly in memory, bypassing traditional security measures that monitor disk activity. This method reduces the likelihood of detection by antivirus programs and other security tools. The campaign has seen significant reach, with some videos amassing nearly 500,000 views, indicating a high potential for widespread impact.

Understanding the ClickFix Technique

The ClickFix method involves social engineering tactics where users are guided to open the Windows Run dialog, launch PowerShell, and execute commands that download and run malicious scripts. These scripts fetch additional payloads, including Vidar and StealC malware, which are designed to harvest sensitive information from the infected systems.

Vidar is known for its capability to collect data such as login credentials, credit card information, browser cookies, and cryptocurrency wallet details. Similarly, StealC targets a wide array of sensitive information, focusing on web browsers and cryptocurrency wallets. The malware ensures persistence by modifying system settings, such as adding registry keys that allow it to execute upon system startup.

The Role of AI-Generated Content

A notable aspect of this campaign is the use of AI-generated content to enhance the credibility and appeal of the malicious videos. The attackers employ AI tools to create faceless tutorial videos with consistent visual elements and AI-generated voiceovers, making the content appear legitimate and trustworthy. This level of automation not only streamlines the production of deceptive content but also enables the rapid dissemination of malware to a broad audience.

Mitigation and Prevention Strategies

To protect against such threats, users and organizations should consider the following measures:

• Exercise Caution with Online Tutorials: Be skeptical of videos that instruct you to execute system-level commands, especially those claiming to activate software or unlock premium features.
• Implement Security Policies: Organizations can disable the Windows Run program using Group Policy Objects (GPOs) or turn off the “Windows + R” hotkey via Windows Registry changes to prevent unauthorized execution of commands.
• Educate Users: Conduct regular training sessions to inform users about the risks associated with executing unsolicited commands and the importance of verifying the authenticity of online content.
• Deploy Advanced Security Solutions: Utilize security software that can detect and prevent memory-based malware execution and monitor for unusual system behaviors indicative of malware activity.

Conclusion

The exploitation of TikTok for malware distribution underscores the evolving tactics of cybercriminals who adapt to popular platforms to reach potential victims. By leveraging AI-generated content and sophisticated social engineering techniques, attackers can effectively deceive users into compromising their systems. It is imperative for users to remain vigilant and for organizations to implement robust security measures to counteract such threats.

The post TikTok Becomes a New Vector for Malware Distribution appeared first on CyberHood Sentinel.

The Threat Actor: “UnsolicitedBooker”

The attack was carried out by an elusive cyber espionage group tracked by researchers at cybersecurity firm Check Point under the name UnsolicitedBooker. The group appears to be aligned with Chinese interests and demonstrates TTPs (tactics, techniques, and procedures) consistent with other well-documented Chinese APT clusters such as Space Pirates and threat actors previously observed deploying the Zardoor backdoor.

This campaign’s targets include a Saudi-based international organization with sensitive geopolitical relevance. Although the exact nature of the organization has not been disclosed, its persistent targeting indicates a high level of strategic value.

Phishing as the Initial Attack Vector

The initial attack chain was rooted in spear-phishing, a favored technique among espionage actors. Emails purporting to be from Saudia Airlines carried malicious Microsoft Word documents containing embedded VBA macros. These lures were cleverly disguised as flight booking confirmations, enhancing their legitimacy and increasing the likelihood of user interaction.

Upon opening the malicious attachment, the embedded macro executed a file named smssdrvhost.exe, acting as a loader that deployed the MarsSnake backdoor onto the victim’s system. Once executed, MarsSnake established communication with a Command-and-Control (C2) server hosted at contact.decenttoy[.]top.

The Malware: MarsSnake

MarsSnake is a previously undocumented malware strain tailored for covert surveillance and persistence within targeted networks. Its capabilities include:

• Collecting system information
• Downloading and executing additional payloads
• Command execution
• Maintaining long-term stealth access

MarsSnake’s design appears to focus on operational longevity and minimal detection, indicating the attackers’ intent to maintain long-term access to sensitive internal communications and resources.

Multi-Year Persistence

Evidence points to repeated intrusion attempts in 2023, 2024, and continuing into 2025, signaling a sustained espionage operation. The attackers demonstrated adaptability, modifying lures and infrastructure as needed over time. This level of persistence is typical of state-sponsored cyber actors, particularly those focused on strategic intelligence gathering rather than financial gain.

Furthermore, the infrastructure, malware characteristics, and phishing themes bear strong resemblance to previously documented Chinese campaigns in the Middle East, especially those targeting Islamic NGOs and diplomatic organizations.

Attribution and Overlaps with Known APTs

While attribution in cybersecurity is inherently complex, Check Point’s analysis places UnsolicitedBooker squarely within the Chinese cyber-espionage ecosystem. Their behavior overlaps with activity from Space Pirates, a threat group previously implicated in Middle Eastern campaigns, as well as other unnamed Chinese-affiliated clusters operating in the region.

These overlaps include:

• The use of custom backdoors
• Thematically localized phishing lures
• Reuse of infrastructure patterns
• Connections to previously burned domains

Such patterns further bolster the assessment that MarsSnake is part of a coordinated Chinese intelligence effort.

Regional and Global Implications

This campaign underscores a continued and growing cyber risk to Middle Eastern organizations, especially those with political, economic, or religious influence. The involvement of a previously undocumented malware family suggests that Chinese cyber operations are becoming increasingly specialized, with targeted malware being developed for specific regions or organizations.

From a broader perspective, this incident serves as a reminder for all global enterprises—especially those operating in geopolitically sensitive regions—to enhance their email security, endpoint monitoring, and user awareness training.

Recommendations

Security experts advise organizations to:

• Disable macro execution by default in Office applications
• Monitor unusual outbound traffic patterns
• Implement robust phishing simulation and awareness training
• Employ behavior-based threat detection tools
• Regularly update security patches and endpoint protection

As nation-state adversaries refine their tradecraft, proactive defense strategies become essential in protecting critical infrastructure and sensitive information from persistent threats like MarsSnake.

The post Chinese Hackers Deploy ‘MarsSnake’ Backdoor in Multi-Year Espionage Campaign Targeting Saudi Organization appeared first on CyberHood Sentinel.

Nature of the Vulnerability

The vulnerability arises from a prototype pollution issue within Kibana. Prototype pollution is a type of security flaw that allows attackers to manipulate an application’s JavaScript objects and properties. This manipulation can lead to unauthorized data access, privilege escalation, denial-of-service, or, as in this case, remote code execution. Specifically, the flaw can be exploited through a crafted file upload combined with specially crafted HTTP requests. ​

Affected Versions

All Kibana versions from 8.15.0 up to, but not including, 8.17.3 are affected by this vulnerability. The exploitability varies depending on the version:​

• Versions 8.15.0 to 8.17.0: Exploitable by users with the ‘Viewer’ role.​
• Versions 8.17.1 and 8.17.2: Exploitable by users possessing all of the following privileges:​
  • fleet-all​
  • integrations-all​
  • actions:execute-advanced-connectors​

Recommended Actions

Users are strongly advised to upgrade to Kibana version 8.17.3 immediately to mitigate this vulnerability. For those who cannot apply the update promptly, a temporary workaround involves disabling the Integration Assistant feature by setting xpack.integration_assistant.enabled: false in the Kibana configuration file (kibana.yml).

Previous Similar Vulnerabilities

This is not the first time Kibana has faced critical security issues. In August 2024, Elastic addressed another critical prototype pollution flaw (CVE-2024-37287) that could lead to code execution. Subsequently, in September 2024, two severe deserialization vulnerabilities (CVE-2024-37288 and CVE-2024-37285) were also patched, both of which could permit arbitrary code execution. ​

Conclusion

Given the critical nature of CVE-2025-25012, it is imperative for organizations using affected versions of Kibana to apply the necessary updates or mitigations without delay to protect their systems from potential exploitation.​

The post Elastic Releases Urgent Patch for Critical Kibana Vulnerability Allowing Remote Code Execution appeared first on CyberHood Sentinel.