Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Kaspersky Security Blog

Reddit NetSec

Check Point Research

AlienVault OTX General

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Akira ransomware group took credit for the Fieldtex Products hack in November, claiming to have stolen 14 Gb of data. The post Fieldtex Data Breach Impacts 238,000 appeared first on SecurityWeek .

In November, the Akira ransomware group claimed responsibility for a cyberattack on Fieldtex Products, a company presumably involved in manufacturing or industrial products. The attackers reportedly exfiltrated approximately 14 GB of data, impacting around 238,000 individuals, which suggests the breach involved sensitive personal or corporate information. While the exact attack vector or exploited vulnerability has not been disclosed, the involvement of a ransomware group indicates a likely combination of initial access through phishing, credential compromise, or exploitation of unpatched systems, followed by data exfiltration and potential ransomware deployment. The absence of known exploits or patch information suggests the attack leveraged either zero-day vulnerabilities or social engineering tactics. The medium severity rating reflects the significant data loss and potential privacy violations but does not indicate widespread operational disruption or destruction of systems. This incident underscores the persistent risk ransomware groups pose to industrial sector organizations, emphasizing the need for comprehensive cybersecurity strategies. The breach also raises concerns about compliance with data protection regulations such as GDPR, given the large number of affected individuals. European organizations connected to Fieldtex, either as partners or customers, may face indirect consequences including reputational damage and regulatory penalties. The attack highlights the importance of proactive threat detection, network segmentation, and incident response readiness to mitigate ransomware threats effectively.

Detailed information about Fieldtex Data Breach Impacts 238,000. Get real-time updates, technical details, and mitigation strategies.

Fieldtex Data Breach Impacts 238,000 - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

Fieldtex Data Breach Impacts 238,000

We break down what happens to stolen data after a phishing attack: how it ends up on the shadow market and gets used in new phishing schemes, and what risks this poses. We also offer tips on how to protect your accounts, and minimize any impact.

Phishing attacks remain a prevalent and evolving threat vector where attackers create convincing fake websites or abuse legitimate platforms to trick users into submitting sensitive data such as login credentials, payment card details, personal identification documents, and biometric data. Once harvested, this data is transmitted to cybercriminals via various channels including email, Telegram bots, or specialized admin panels that facilitate data sorting, verification, and management. The stolen data typically enters a shadow market ecosystem where it is bundled into large datasets and sold cheaply in bulk. Subsequent buyers, often analysts or hackers, verify the data's validity by testing credentials against multiple services and compiling comprehensive digital dossiers for targeted attacks. Verified data is then resold at higher prices on dark web forums and Telegram channels, with prices influenced by factors such as account age, presence of 2FA, linked financial accounts, and service type. The most valuable data includes access to bank accounts, cryptocurrency wallets, and e-government portals. This cyclical process enables repeat phishing and social engineering attacks, including business email compromise and extortion scams. The article highlights that 88.5% of phishing attacks in early 2025 targeted online credentials, 9.5% targeted personal data, and 2% targeted bank card details. Mitigation advice includes immediate password changes, blocking compromised payment cards, enabling strong 2FA (preferably via authenticator apps rather than SMS), monitoring active sessions, and employing password managers. Preventative measures emphasize cautious email handling, verifying sender authenticity, and using security solutions to scan links. The threat landscape is complicated by the reuse of stolen data for multiple attack campaigns over extended periods, increasing the risk to individuals and organizations alike.

Detailed information about Where does the data stolen in a phishing attack go? | Kaspersky official blog. Get real-time updates, technical details, and mitigati

Where does the data stolen in a phishing attack go? | Kaspersky official blog - Live Threat Intelligence - Threat Radar | OffSeq.com

Where does the data stolen in a phishing attack go? | Kaspersky official blog

A critical zero-day vulnerability has been discovered in the Windows RasMan (Remote Access Connection Manager) service. Although no official patches have been released by Microsoft yet, unofficial patches are circulating to mitigate the risk. The flaw could allow attackers to execute arbitrary code or escalate privileges remotely, potentially compromising affected systems. No known exploits are currently observed in the wild, but the vulnerability's critical nature and the absence of official fixes increase the urgency for organizations to take protective measures. European organizations relying on Windows infrastructure with RasMan enabled are at risk, especially those with remote access services exposed. Mitigation requires applying unofficial patches cautiously, restricting RasMan service exposure, and monitoring for suspicious activity. Countries with high Windows usage in critical infrastructure and enterprises, such as Germany, France, and the UK, are likely to be most impacted. Given the potential for remote exploitation without authentication, the severity is assessed as critical. Defenders should prioritize immediate risk assessment and containment strategies while awaiting official patches.

The Windows Remote Access Connection Manager (RasMan) service has been identified to contain a zero-day vulnerability that is currently unpatched by Microsoft. RasMan is responsible for managing dial-up and VPN connections, and a flaw in this service could allow attackers to execute arbitrary code remotely or escalate privileges, potentially leading to full system compromise. The vulnerability was publicly disclosed via a Reddit post linking to a trusted cybersecurity news source, BleepingComputer, which reported the availability of unofficial patches created by third parties to mitigate the issue. Although no confirmed exploits have been detected in the wild, the critical severity rating and the nature of the vulnerability suggest a high risk of exploitation, especially in environments where RasMan is exposed to untrusted networks. The lack of official patches means organizations must rely on unofficial mitigations or implement network-level protections to reduce attack surface. The minimal discussion and low Reddit score indicate limited community awareness so far, but the urgency is underscored by the zero-day status and critical impact. The vulnerability affects all Windows versions running RasMan, but specific affected versions were not detailed. The flaw's exploitation could compromise confidentiality, integrity, and availability of systems, making it a high-priority threat for Windows-dependent organizations.

Detailed information about New Windows RasMan zero-day flaw gets free, unofficial patches. Get real-time updates, technical details, and mitigation strategies.

New Windows RasMan zero-day flaw gets free, unofficial patches - Live Threat Intelligence - Threat Radar | OffSeq.com

New Windows RasMan zero-day flaw gets free, unofficial patches

Reddit Discussion: New Windows RasMan zero-day flaw gets free, unofficial patches

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database.This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1.

CVE-2025-13506 is a vulnerability classified under CWE-250 (Execution with Unnecessary Privileges) and CWE-269 (Improper Privilege Management) affecting Nebim Neyir Computer Industry and Services Inc.'s Nebim V3 ERP software versions starting from 2.0.59 up to but not including 3.0.1. The flaw arises from the ERP system executing certain operations with elevated privileges unnecessarily, which can be exploited by an attacker who has limited database access privileges. By leveraging this vulnerability, the attacker can escalate their privileges beyond the intended scope, gaining expanded control over the operating system hosting the ERP. This could allow unauthorized access to sensitive business data, modification or deletion of critical information, and potentially full system compromise. The vulnerability is remotely exploitable over the network (AV:N), requires low attack complexity (AC:L), and only requires privileges at a limited level (PR:L) but no user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component but with high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The lack of available patches at the time of publication increases the urgency for organizations to implement compensating controls. The vulnerability was reserved on 2025-11-21 and published on 2025-12-12 by TR-CERT, indicating a recent disclosure. No known exploits have been reported in the wild yet, but the high CVSS score suggests that exploitation could lead to severe consequences.

Detailed information about CVE-2025-13506: CWE-250 Execution with Unnecessary Privileges in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP affecti

CVE-2025-13506: CWE-250 Execution with Unnecessary Privileges in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-13506: CWE-250 Execution with Unnecessary Privileges in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP

Because user input is not sufficiently sanitized, attackers could exploit the flaw to define external entities within an XML request. The post Recent GeoServer Vulnerability Exploited in Attacks appeared first on SecurityWeek .

The identified security threat concerns a vulnerability in GeoServer, an open-source server for sharing geospatial data, which arises from insufficient sanitization of user-supplied XML input. Specifically, the flaw allows attackers to define external entities within XML requests, a classic vector for XML External Entity (XXE) attacks. XXE vulnerabilities can enable attackers to read arbitrary files on the server, perform server-side request forgery (SSRF), or cause denial of service by exhausting resources. The vulnerability stems from the XML parser's failure to properly restrict or disable external entity processing, allowing maliciously crafted XML payloads to manipulate server behavior. Although no specific affected versions or patches are listed, the vulnerability's presence indicates that GeoServer instances processing XML without hardened configurations are at risk. The exploit does not require authentication, increasing the attack surface, and does not depend on user interaction, facilitating automated exploitation attempts. The medium severity rating reflects the moderate impact potential, balancing the risk of data exposure and service disruption against the complexity of exploitation and current lack of active exploitation reports. This vulnerability underscores the importance of secure XML parsing practices and input validation in geospatial data services.

Detailed information about Recent GeoServer Vulnerability Exploited in Attacks. Get real-time updates, technical details, and mitigation strategies.

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

Fieldtex Data Breach Impacts 238,000

Where does the data stolen in a phishing attack go? | Kasper...

New Windows RasMan zero-day flaw gets free, unofficial patch...

CVE-2025-13506: CWE-250 Execution with Unnecessary Privilege...

Recent GeoServer Vulnerability Exploited in Attacks

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility