AnalysisPublished 8 Dec 2025

8th December · Threat Intelligence Report

Source Check Point Research

Mentions 1 CVE : update to 0.23.0

Mentioned vulnerabilities

CVE-2025-55182

Description

For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .

Impact

European organizations face substantial risks from these threats due to widespread use of Oracle E-Business Suite in enterprise resource planning and financial operations, as well as the growing adoption of React-based web applications across industries. Data breaches involving personal, financial, and operational information can lead to regulatory penalties under GDPR, reputational damage, and operational disruptions. The ransomware campaigns threaten availability by encrypting critical data and demanding ransom payments, potentially crippling essential services such as healthcare, education, and logistics. The React2Shell vulnerability enables attackers to execute arbitrary code remotely without authentication, increasing the risk of full system compromise and lateral movement within networks. Supply chain attacks, such as the compromise of developer signing keys in the SmartTube incident, highlight risks to software integrity and trust. The presence of advanced persistent threat campaigns targeting telecom and government sectors indicates a heightened espionage risk, which could impact national security and critical infrastructure in Europe. Financial institutions are particularly vulnerable to banking trojans like Albiriox, which use sophisticated evasion and fraud techniques to steal credentials and funds. Overall, these threats can disrupt business continuity, expose sensitive data, and undermine trust in digital services across European markets.

Defensive guidance

European organizations should prioritize immediate patching of Oracle E-Business Suite servers and React framework components to remediate zero-day vulnerabilities such as those exploited in the reported attacks. Deploy advanced intrusion prevention systems (IPS) and endpoint detection and response (EDR) solutions like Check Point Threat Emulation and Harmony Endpoint to detect and block ransomware payloads and exploit attempts. Implement strict network segmentation to limit lateral movement in case of compromise, especially isolating critical financial and operational systems. Enhance monitoring of firewall and VPN logs to detect anomalous access patterns indicative of exploitation attempts, particularly for SonicWall and similar devices. Conduct regular threat hunting exercises focused on indicators of compromise related to Cl0p, Akira, Qilin, and TridentLocker ransomware groups. Strengthen supply chain security by validating software signing keys and monitoring for unauthorized updates or code changes. Educate employees on phishing and smishing tactics used to distribute banking trojans like Albiriox, and enforce multi-factor authentication (MFA) on all critical systems. Collaborate with national cybersecurity agencies and share threat intelligence to stay informed about emerging campaigns such as Salt Typhoon and BRICKSTORM. Finally, perform comprehensive backups with offline storage to ensure data recovery capabilities in ransomware scenarios.

References

research.checkpoint.com/2025/8th-december-threat-intelligence-report/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jan 2026, 16:18 UTC

References

Community reviews

Related threats