ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

ThreatsDay’s latest bulletin surveys a wide range of cyber threats, from patched Windows GDI flaws that enable remote code execution and information disclosure to the ongoing use of AI to speed up malware triage, while human expertise remains essential for deeper analysis. It notes three patched Windows GDI vulnerabilities (CVE-2025-30388, CVE-2025-53766, and CVE-2025-47984) exploited via malformed EMF/EMF+ records rooted in gdiplus.dll and gdi32full.dll, addressed in May, July, and August 2025 updates.

The piece also covers a Singapore case where three Chinese nationals were convicted and sentenced for hacking overseas gambling sites and exfiltrating data, and it highlights RondoDox increasing its exploitation vectors and seeking to eliminate competition on compromised hosts. Cloudflare’s disclosure on AISURU botnet shows the group leveraging the botnet to boost malicious domains while targeting Cloudflare’s DNS service, with FIN7 cited for deploying a Windows SSH backdoor for persistence.

Additional items include a large DDoS surge around Moldova’s election day, and widespread financial crime operations described in European reports, underscoring the blend of digital and physical extortion in the evolving threat landscape, according to Channel News Asia and CrowdStrike analyses.