24th November · Threat Intelligence Report
Source Check Point Research
Mentions 2 CVEs
Mentioned vulnerabilities
Description
For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. […] The post 24th November – Threat Intelligence Report appeared first on Check Point Research .
Impact
European organizations are at significant risk due to the widespread use of Salesforce and its integrations like Gainsight, which are common in many sectors including finance, telecommunications, and IT services. The compromise of 300 organizations globally implies potential exposure of sensitive corporate and customer data, intellectual property, and operational information. The Eurofiber France breach directly impacts French telecommunications infrastructure and customer privacy, while the Almaviva attack threatens critical national infrastructure in Italy, including railway operations and defense contracts, potentially affecting public safety and national security. The ransomware attack on LG Energy Solution’s overseas facility, although limited geographically, signals risks to European supply chains and manufacturing continuity. The massive DDoS attack on Microsoft Azure highlights vulnerabilities in cloud service availability, which European businesses heavily rely on for digital operations. Active exploitation of Fortinet and Chrome vulnerabilities threatens enterprise network security and endpoint integrity, increasing the risk of unauthorized code execution and lateral movement within networks. The surge in phishing and scam campaigns exploiting regional events like Black Friday and health crises can lead to credential theft, financial fraud, and erosion of public trust. Collectively, these threats can cause data breaches, operational disruptions, financial losses, reputational damage, and regulatory penalties under GDPR and other European data protection laws.
Defensive guidance
European organizations should immediately audit and restrict third-party integrations, especially those involving Salesforce and Gainsight, enforcing strict access controls and continuous monitoring of API and token usage. Implement zero-trust principles around supply-chain partners, including multi-factor authentication (MFA) and least privilege access. For telecommunications and critical infrastructure providers like Eurofiber and Almaviva, enhance network segmentation, deploy advanced endpoint detection and response (EDR) solutions, and conduct regular incident response drills focused on ransomware and data exfiltration scenarios. Patch management must be prioritized to address actively exploited vulnerabilities such as Fortinet FortiWeb (CVE-2025-58034) and Chrome V8 engine flaws (CVE-2025-13223), ensuring timely updates across all endpoints and network devices. Deploy DDoS mitigation services and anomaly detection to defend against volumetric attacks like those targeting Azure. Increase user awareness campaigns tailored to regional phishing and scam trends, emphasizing verification of domain authenticity and caution with unsolicited communications, especially during high-risk periods like Black Friday. Utilize threat intelligence feeds to identify and block malicious domains and IPs associated with ongoing campaigns. For advanced persistent threats, implement network traffic analysis, behavioral analytics, and endpoint hardening to detect and disrupt stealthy C2 communications and lateral movement. Finally, maintain comprehensive data backup strategies with offline copies to enable recovery from ransomware attacks without paying ransoms.
Summary
The primary threat detailed is a sophisticated supply-chain attack executed by the 'Scattered LAPSUS$ Hunters' group targeting Gainsight, a platform integrated with Salesforce. This attack resulted in unauthorized access and data compromise from approximately 300 organizations, including major enterprises such as Verizon, GitLab, and Atlassian. Salesforce itself reported no inherent vulnerability in its core platform but took precautionary measures by revoking all active Gainsight access tokens to mitigate further risk. The attack exemplifies the increasing risk posed by third-party integrations and supply-chain vectors, where attackers exploit less-secure partners to infiltrate larger ecosystems. Additional breaches reported include Eurofiber France SAS, where attackers accessed customer data via a ticket management system, and Almaviva in Italy, which suffered a massive data leak including sensitive passenger and defense-related information. LG Energy Solution experienced a ransomware attack localized to an overseas facility, with the Akira ransomware gang claiming responsibility. Microsoft Azure was subjected to a record-breaking 15.72 Tbps DDoS attack leveraging a Mirai-class IoT botnet, demonstrating the scale and sophistication of current volumetric attacks. The report also highlights active exploitation of vulnerabilities such as Fortinet FortiWeb command injection (CVE-2025-58034) and a high-severity Chrome V8 engine flaw (CVE-2025-13223), both actively exploited in the wild. Furthermore, phishing and scam campaigns exploiting Black Friday shopping and health product shortages are widespread, with criminals using generative AI to impersonate health regulators and create localized fraudulent ads. Advanced persistent threats like APT24 continue to evolve, employing encrypted C2 channels, browser fingerprinting, and supply-chain compromises to maintain long-term access and deploy payloads such as Cobalt Strike and ransomware. This multifaceted threat environment underscores the need for vigilance across supply chains, cloud integrations, endpoint defenses, and user awareness.
References
Community reviews
Related threats
- CVE-2025-58034: Fortinet FortiWeb · Execute Unauthorized Code or CommandsMediumVulnerability
- CVE-2025-13223: Google Chrome · Type ConfusionHighVulnerability
- ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution VulnerabilityHighVulnerability
- 26th October · Threat Intelligence ReportBreach
- Langflow 1.8.4 · Path Traversal to Remote Code ExecutionCriticalVulnerability