Daily Threat Intelligence Report — 2025-07-14
Today's threat landscape is dominated by active QakBot and Emotet command-and-control infrastructure confirmed across four IPs by Feodotracker, alongside newly surfaced AsyncRAT and AgentTesla malware samples confirmed by MalwareBazaar. CISA has added five critical vulnerabilities to its Known Exploited Vulnerabilities catalogue, including a Palo Alto Networks PAN-OS out-of-bounds write enabling unauthenticated root-level RCE and an Ivanti EPMM authenticated RCE, both requiring immediate patching. Cryptocurrency and social media phishing infrastructure has expanded significantly, with 15 active phishing URLs confirmed by OpenPhish targeting Ledger, Trezor, Exodus, Amazon, and Instagram users. SOC teams should immediately block all five Feodotracker C2 IPs, apply CISA KEV patches on an emergency basis, and deploy the KQL hunting queries provided in this report.
Active QakBot and Emotet C2 Infrastructure Across Multi-Nation Nodes — Imminent Enterprise Compromise Risk
CRITICAL TA505Feodotracker has confirmed four active QakBot C2 servers (50.16.16.211 — US, 34.204.119.63 — US, 178.62.3.223 — GB, 27.133.154.218 — JP) and one active Emotet C2 server (162.243.103.246 — US) within the last 24 hours. TA505, a prolific financially motivated threat actor historically associated with both QakBot distribution and large-scale Emotet campaigns, leverages this infrastructure for initial payload delivery, credential harvesting, and ransomware pre-positioning. MalwareBazaar has simultaneously confirmed a fresh AgentTesla sample (hash 07b3056794ce85fb607a38d1a0856c3ad7886c2903d0ff7d72a0f172ef8fa7c6) and an AsyncRAT sample (hash 270887cd3939ea9eb91d47ce5eeedd4141cb112501d42844020e496c76384608) tagged as botnet and C2-capable, consistent with TA505's multi-stage payload deployment pattern. The geographic spread of QakBot C2 across US, UK, and Japan nodes indicates an active, high-tempo campaign targeting organisations in multiple jurisdictions simultaneously, and any internal host beaconing to these IPs should be treated as a confirmed compromise requiring immediate incident response.
Lazarus Group and Kimsuky Infrastructure Updates Detected — Nation-State Tooling Refresh in Progress
HIGH Lazarus GroupGitHub repository stamparm/maltrail recorded active commits updating both apt_lazarus.txt and apt_kimsuky.txt trail files within the last 24 hours, indicating that security researchers have identified new or updated infrastructure, domains, or IPs associated with Lazarus Group (DPRK-linked, attributed to APT38 for financial operations) and Kimsuky (DPRK-linked espionage). Simultaneous updates to hvncrat.txt in the same repository suggest that HVNC RAT — a remote access tool used for covert desktop control without triggering standard VPN or RDP telemetry — is being actively updated in conjunction with nation-state actor tooling, a pattern consistent with Lazarus Group's post-compromise operational tradecraft. The RustyStealer sample confirmed by MalwareBazaar (hash c3a4fc8559ecb13d5d004629fb5a01c0101250c9a27bc151e570dbabdd6967b1), tagged with Backdoor, Kryptik, and Rust, aligns with the recent trend of DPRK-affiliated actors adopting Rust-based tooling for stealth and cross-platform capability. Organisations in financial services, cryptocurrency, defence, and government sectors should treat this intelligence as high-priority given Lazarus Group's documented history of targeting these verticals for both espionage and financial theft.
Five CISA KEV Vulnerabilities Require Emergency Patching — PAN-OS RCE and Ivanti EPMM Pose Critical Risk
MEDIUM Unknown Threat ActorCISA has added five vulnerabilities to its Known Exploited Vulnerabilities catalogue, all requiring immediate remediation per BOD 22-01: CVE-2026-0300 (Palo Alto Networks PAN-OS unauthenticated root RCE via out-of-bounds write in the User-ID Authentication Portal), CVE-2026-6973 (Ivanti EPMM authenticated RCE), CVE-2026-41940 (WebPros cPanel and WHM authentication bypass enabling full control panel access), CVE-2026-42208 (BerriAI LiteLLM SQL injection enabling database read and write access), and CVE-2026-31431 (Linux Kernel privilege escalation via incorrect resource transfer). The PAN-OS vulnerability (CVE-2026-0300) is particularly severe as it allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets to the Captive Portal service on PA-Series and VM-Series firewalls — a direct path to network perimeter compromise. Concurrent phishing infrastructure activity targeting cryptocurrency wallets (Ledger via leddgger--wallet.webflow.io, Trezor via authstart-terezor.github.io, Exodus via update-exodus-helpcentre.vercel.app) confirmed by OpenPhish suggests that threat actors are combining credential harvesting with exploitation of patching gaps to maximise impact on organisations with cryptocurrency holdings or hosting environments using cPanel.