Threat Advisories:

Lazarus Targets Europe’s UAV Innovation October 2025 Linux Patch Roundup MuddyWater Deploys Phoenix Backdoor in Targeted Espionage Campaign Critical Cloud Threat: Azure Blob Storage Under Active Attack Operation Silk Lure Scam: When Job Hunts Leads to Malware Storm-1175’s Masterstroke Exploits CVE-2025-10035 in GoAnywhere MFT F5 BIG-IP Breach: Nation-State Hackers Expose Source Code and Undisclosed Flaws Microsoft’s October 2025 Patch Tuesday TA585 Leverages ClickFix Technique and MonsterV2 Malware Astaroth Targets Brazil Using GitHub Infrastructure CVE-2025-11371: Unpatched Gladinet Flaw Actively Exploited in the Wild Stealit’s New Trick: Packing Malware Inside Node.js Single Executables Hidden in Plain Sight: The Abuse of Nezha and the Ghost RAT That Followed UTA0388: AI-Powered Targeted Operations Leveraging GOVERSHELL Zimbra Zero-Day Hidden in “Harmless” ICS File Targets Military Service Finder Plugin Flaw Opens Door to Full Site Compromise Redis Under Siege: RediShell Flaw Opens Door to Remote Code Execution CVE-2025-61882: Oracle EBS Zero-Day Actively Exploited in the Wild Water Saci: Brazil’s WhatsApp-Borne Malware Storm Confucius Hackers Spy on Critical Sectors Using AnonDoor

Highlights of Our CISO Dinner

Upgrading struggling vulnerability management programs to Threat Exposure Management, with Host, CISO Al Lindseth formerly from Plains All American Pipeline and PWC - 6 minute podcast

0:00

Play Count: Loading...

Partner Program

Book a Demo Threat Digest - Subscribe

AnyDesk Installer Targeted by Malvertising Campaign

Threat Level – Green | Vulnerability Report

Download PDF

For a detailed advisory, download the pdf file here.

A malvertising campaign, which was active since April 21, was established by hackers for a popular remote desktop application, AnyDesk. A fake app ad was pushed via Google ads when searching for “AnyDesk”. The App contained trojan malware that could control the victim’s computer. That ad redirected users to a URL: https://domohop.com/anydesk-download/ which then downloads the trojan file with link: https://anydesk.s3-us-west-1.amazonaws.com/AnydeskSetup.exe

40% of these ads lead to downloading and installing this trojan file. And 20% of these installations lead to getting a follow-on hands-on-keyboard activity. Hackers have reportedly paid Google $1.75 per click.

Indicators of Compromise

TYPE	VALUE
IP Address	176.111.174.126 176.111.174.125
Domains	Domohop.com Anydesk.s3-us-west-1.amazonaws.com zoomstatistic.com anydeskstat.com Turismoelsalto.cl Rockministry.org curaduria3.com
User Agents	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100111 Firefox/78.0
Hashers	357e165be7a54e49f04cccc6d79678364394e33f10a6b3b73705823f549894b5 5fe992b5a823b6200a1babe28db109a3aae1639f0a8b5248403ee1266088eac4 0c1ec49bf46f000e8310ec04ff9f5a820cbb18524acf8e39482ae3ffca14fb59 780a02755873350ceef387fd9ea8c9614d847d5ba7ae3f89d32777b6ec7ee601

References

https://www.crowdstrike.com/blog/falcon-complete-disrupts-malvertising-campaign-targeting-anydesk/

https://cybersecuritynews-com.cdn.ampproject.org/c/s/cybersecuritynews.com/weaponized-anydesk-installer/?amp

TYPEVALUEIP Address176.111.174.126176.111.174.125DomainsDomohop.comAnydesk.s3-us-west-1.amazonaws.comzoomstatistic.comanydeskstat.comTurismoelsalto.clRockministry.orgcuraduria3.comUser AgentsMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100111 Firefox/78.0Hashers357e165be7a54e49f04cccc6d79678364394e33f10a6b3b73705823f549894b55fe992b5a823b6200a1babe28db109a3aae1639f0a8b5248403ee1266088eac40c1ec49bf46f000e8310ec04ff9f5a820cbb18524acf8e39482ae3ffca14fb59780a02755873350ceef387fd9ea8c9614d847d5ba7ae3f89d32777b6ec7ee601

References

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox