SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 61

Security Affairs’ Malware Newsletter Round 61, authored by Pierluigi Paganini, was published on 7 September 2025 and presents a curated collection of malware-focused articles and research from across the international landscape. The piece opens with a description of the newsletter as “a collection of the best articles and research on malware,” followed by a list of highlighted items.

Included are reports on Operation Hankook Phantom, North Korea’s APT37 targeting South Korea, and analyses such as NotDoor inside APT28’s expanding Arsenal. Other features cover a malvertising campaign on Meta expanding to Android, Android droppers as gatekeepers of malware, and the MystRodX covert dual‑mode backdoor threat.

Additional items examine Ethereum smart contracts used to push malicious code on npm, and broader assessments like three Lazarus RATs coming for your cheese, as well as insights into RapperBot’s infection-to-DDoS sequence and Gamaredon’s attacks against Ukrainian government departments. The round also references related coverage including analyses of AI-enabled threat techniques and other malware research.