March 2025 Threat Intelligence Update: YARA, Snort Rules, and Emerging Ransomware Threats

Security teams worldwide must stay updated on the latest detection rules and emerging threats to defend against evolving attack vectors. AhnLab’s TIP service has released its weekly detection rule updates for March 2025, including new YARA and Snort rules targeting phishing kits, ransomware, and APT activity. This report synthesizes these findings with broader threat intelligence from Valhalla, Google Chronicle, and AhnLab ASEC to provide actionable insights.

Executive Summary for Security Leaders

The fourth week of March 2025 saw significant updates in detection capabilities and threat actor activity:

New YARA Rules: 10+ rules added, including detection for Frag ransomware (affecting 27 companies) and MirrorFace APT tools.
Snort Updates: Rules for Wazuh Server exploits (CVE-2025-24016) and cryptocurrency mining payloads.
Critical Vulnerabilities: Unpatched zero-days in Palo Alto GlobalProtect (CVE-2025-26794) and FortiOS RCE (CVE-2025-27218, CVSS 9.6).
Ransomware Surge: Frag ransomware attacks in the US, Netherlands, and Singapore; Arkana targeting telecoms.

Detailed Threat Analysis

1. YARA Rule Updates

AhnLab’s release includes phishing kit detection rules such as PK_Alibaba_whizkossy and PK_MBHBank_takare, sourced from GitHub repositories^1. Valhalla’s repository added high-priority rules:

Rule Name	Target	Source
`MAL_RANSOM_Frag_Mar25`	Frag ransomware	Valhalla
`SUSP_SVG_JS_Payload_Mar25`	Malicious SVG files	AhnLab ASEC

2. Snort Rule Highlights

New Snort rules focus on coinminers and Wazuh exploits. Example rule syntax for Wazuh detection:

alert tcp $EXTERNAL_NET any -> $HOME_NET 55000 (msg:"ET WEB_SPECIFIC_APPS Wazuh Server Exploit"; flow:to_server; content:"/manager/api/"; http_uri; content:"cmd="; nocase; reference:cve,2025-24016; sid:20250324; rev:1;)

3. YARA-L 2.0 Enhancements

Google Chronicle’s YARA-L 2.0 introduces sliding window correlations and outcome conditionals^2. Example rule detecting large file exfiltration:

rule OutcomeConditionalRule {
  events:
    $u.metadata.event_type = "FILE_COPY"
  outcome:
    $risk_score = if($file_size > 500*1024*1024, 2)
  condition: $risk_score >= 10
}

Actionable Recommendations

For SOC Teams: Integrate the provided YARA/Snort rules into SIEMs. Prioritize patching for FortiOS and Palo Alto vulnerabilities.

For Threat Hunters: Monitor for MAL_APT_MirrorFace_Injector_Mar25 in memory dumps, as it indicates APT activity.

Conclusion

The March 2025 updates underscore the need for continuous rule refinement against phishing, ransomware, and APT tools. Organizations should leverage the provided IOCs and rulesets to enhance detection capabilities.