A serious security flaw in Cisco Catalyst Center Virtual Appliance has been discovered that allows attackers with low-level access to gain full administrator control over affected systems.

The vulnerability, tracked as CVE-2025-20341, impacts virtual appliances running on VMware ESXi and carries a high severity rating with a CVSS score of 8.8.

This flaw poses a major risk to organizations using these systems for network management and monitoring.

The vulnerability stems from poor input validation within the system. When users submit data through web requests, the software fails to properly check and verify the information.

This oversight creates an opportunity for attackers to send specially designed HTTP requests that trick the system into granting them higher privileges.

The attack can be carried out remotely over the network, making it particularly dangerous for exposed systems.

What makes this vulnerability concerning is that an attacker only needs basic access credentials to exploit it.

Someone with Observer role permissions, which are typically given to users who need to view system information, can use this flaw to elevate their privileges to Administrator level.

Once they gain administrator access, attackers can create new user accounts, modify system settings, and perform other unauthorized actions that compromise the security of the entire network infrastructure.

Cisco security researchers identified this vulnerability during work on a support case with the Technical Assistance Center.

The company has confirmed that no public exploits have been observed yet, which gives organizations a window to patch their systems before widespread attacks begin.

Technical Details and Mitigation

The vulnerability affects Cisco Catalyst Center Virtual Appliance versions 2.3.7.3-VA and later releases.

The security flaw is rooted in insufficient validation mechanisms that process user-supplied input through HTTP requests.

When the system receives these crafted requests, it fails to properly sanitize the data before processing privilege escalation operations.

Cisco has released version 2.3.7.10-VA as the fixed release that addresses this security issue. Organizations running affected versions should upgrade immediately to this patched version.

The company has stated that no workarounds are available, making the software update the only effective way to protect against this vulnerability.

Hardware appliances and AWS-based virtual appliances are not affected by this issue.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Cisco Catalyst Center Vulnerability Let Attackers Escalate Priveleges appeared first on Cyber Security News.

A new threat targeting Chinese users has appeared with a dangerous ability to shut down security tools.

RONINGLOADER, a multi-stage loader spreading a modified version of the gh0st RAT, uses clever tricks to bypass antivirus protection.

The malware arrives through fake software installers that pretend to be legitimate programs like Google Chrome and Microsoft Teams.

Once inside a system, it works through several layers of infection to disable Windows Defender and popular Chinese security products like Qihoo 360 Total Security and Huorong.

This campaign shows how attackers are getting better at breaking through security defenses. The malware brings its own signed driver that looks legitimate to Windows but actually helps it kill security processes.

What makes it dangerous is how many backup plans it has. If one method to disable security fails, it tries several other approaches.

This shows the Dragon Breath APT group behind it has learned from earlier campaigns and improved their methods.

After tracking detection systems, Elastic security analysts identified this campaign using a behavioral rule designed to spot Protected Process Light abuse.

The research team found RONINGLOADER using a technique that was publicly documented just months earlier. The malware takes advantage of a Windows feature meant to protect important system processes but turns it against Defender itself.

Attack Method and Infection Chain

The infection starts with a trojanized NSIS installer that drops multiple components onto the victim system. When someone runs what they think is a normal software installer, they actually activate two separate installers.

One installs the real software to avoid raising suspicion, while the second quietly deploys the attack chain.

The malware creates a directory at C:\Program Files\Snieoatwtregoable\ and drops two files: Snieoatwtregoable.dll and an encrypted file called tp.png.

The DLL file decrypts tp.png using a simple but effective algorithm that combines XOR encryption with a rotate operation:-

*encrypted_file_content = _ROR1_(*encrypted_file_content ^ xor_key[indx), 4);

After decryption, the malware loads fresh system libraries to remove any security hooks that might catch its behavior. It then elevates its privileges using the runas command and scans for running security software.

The malware looks explicitly for Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, and Qihoo 360 Total Security by checking their process names.

To kill these processes, RONINGLOADER uses a signed driver called ollama.sys that was digitally signed by Kunming Wuqi E-commerce Co., Ltd.

The driver registers a single function that accepts a process ID and terminates it using kernel-level APIs that normal security tools cannot block.

The malware writes this driver to disk, creates a temporary service to load it, sends the termination command, and immediately deletes the service.

For Qihoo 360, the malware takes extra steps by blocking all network connections through firewall rules before injecting code into the Volume Shadow Copy service process.

This injection uses Windows thread pools with file write triggers, a technique that helps it avoid detection.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post RONINGLOADER Weaponizes Signed Drivers to Disable Defender and Evade EDR Tools appeared first on Cyber Security News.

Attackers are using fake invoice emails to spread XWorm, a remote-access trojan that quietly steals login credentials, passwords, and sensitive files from infected computers.

When a user opens the attached Visual Basic Script file, the malware begins working silently in the background without any visible warnings or alerts.

This makes it extremely dangerous because victims never know their system is compromised until it’s too late.

Once active, XWorm gives attackers complete control over the infected machine, allowing them to record keystrokes, spy on users, steal personal data, and even install additional threats like ransomware.

The attack begins with a simple email that appears to be a routine payment notification. These emails typically include a polite message from someone claiming to be an account officer, asking recipients to review processed invoices.

The message looks harmless enough, but the attachment contains a .vbs file that immediately executes malicious code when opened.

What makes this tactic clever is that the attackers rely on outdated technology that most people no longer expect to see in business communications.

Malwarebytes security analysts identified the malicious attachment as Backdoor.XWorm during their investigation.

XWorm operates as malware-as-a-service, meaning cybercriminals can rent or purchase access to the infrastructure that maintains backdoor connections and collects stolen data.

This business model has made it easier for less technically skilled attackers to launch sophisticated campaigns, increasing the overall threat landscape for both individuals and organizations.

The Visual Basic Script attachment stands out because modern businesses rarely use this file type anymore. Most email security systems block .vbs files automatically since they can run code directly on a computer without any additional steps.

However, when these attachments manage to slip through email filters, they can cause serious damage.

The script immediately drops a batch file named IrisBud.bat into the Windows temporary folder and uses Windows Management Instrumentation to execute it invisibly.

Infection Mechanism and Execution Flow

The infection chain starts simple but quickly becomes complex through multiple stages of obfuscation.

The initial .vbs file contains 429 lines of heavily disguised code that writes another file to the system. This batch file then copies itself to the user profile directory under the name aoc.bat, ensuring persistence even if the temporary files get cleaned up.

The batch file includes a clever technique to hide its execution by checking if a specific variable exists. If not, it restarts itself in a minimized window that runs completely invisible to the user while the original process exits immediately.

Inside the batch file, attackers use padding techniques with repeated variables that serve no purpose except to confuse analysis tools and security researchers.

These dummy variables make the code appear longer and more complicated than it actually is. After removing this padding, the real commands become visible, including instructions to copy files, read encoded data, and launch PowerShell scripts.

The batch file contains two hidden payload sections that look like ordinary comments starting with double colons, but these actually hold encrypted malware data.

The PowerShell script performs the final stage of the attack by reading the hidden payloads from aoc.bat, decrypting them using AES encryption with a hardcoded key, and decompressing the data with GZip.

This produces two executable files that load directly into memory without ever being saved to disk, a technique called fileless execution that helps avoid detection by traditional antivirus software.

The sandbox analysis revealed a mutex identifier 5wyy00gGpG6LF3m6 that security researchers recognize as belonging to the XWorm malware family, confirming the threat and allowing for proper classification and response.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers are Weaponizing Invoices to Deliver XWorm That Steals Login Credentials appeared first on Cyber Security News.

A new malware family targeting macOS systems has emerged with advanced detection evasion techniques and multi-stage attack chains.

Named DigitStealer, this information stealer uses multiple payloads to steal sensitive data while leaving minimal traces on infected machines.

The malware disguises itself as legitimate software and uses clever methods to bypass Apple’s security protections.

DigitStealer spreads through fake versions of popular macOS applications. The malware was discovered in an unsigned disk image file called DynamicLake.dmg, pretending to be a legitimate utility.

Users are tricked into running a file labeled “Drag Into Terminal.msi” which starts the infection process.

At the time of discovery, no antivirus engines on VirusTotal detected this threat, making it extremely dangerous.

What makes this malware stand out is its use of advanced hardware checks to avoid running on virtual machines or older Mac computers.

Jamf security researchers identified that DigitStealer specifically targets newer Apple Silicon systems, particularly M2 chips and above, while avoiding Intel-based Macs and even M1 devices.

The malware performs extensive system checks before executing its main payload.

The infection starts with a simple bash command that downloads an encoded script from a remote server. Once decoded, this script performs multiple verification steps to ensure it runs only on physical Mac computers with specific hardware features.

The malware checks the system locale and exits if it detects certain countries, potentially to avoid prosecution.

Detection Evasion Through Advanced Hardware Checks

DigitStealer uses sophisticated techniques to detect virtual machines and analysis environments. The malware queries hardware information using system commands and searches for keywords like “Virtual” or “VM” in the output.

If detected, the malware immediately stops execution. The most interesting aspect involves checking for specific Apple Silicon features using the following commands:-

sysctl -n hw.optional.arm.FEAT_BTI
sysctl -n hw.optional.arm.FEAT_SSBS
sysctl -n hw.optional.arm.FEAT_ECV

These commands verify whether advanced ARM processor features exist on the target system. Only M2 or newer chips have these capabilities, effectively limiting infections to the latest Mac computers.

This approach helps the malware avoid detection by security researchers who often use virtual machines or older hardware for analysis.

After passing all verification checks, DigitStealer downloads four separate payloads from remote servers.

Each payload has a specific purpose, from stealing browser credentials and cryptocurrency wallets to modifying legitimate applications like Ledger Live.

The malware uses legitimate Cloudflare services to host payloads, making detection and blocking more difficult.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Highly Sophisticated macOS DigitStealer Employs Multi-Stage Attacks to Evade detection appeared first on Cyber Security News.