Microsoft has revoked 200 fraudulent digital certificates that were used in the Rhysida ransomware campaign. These certificates were exploited by attackers to sign malicious payloads, helping them evade detection and appear legitimate. The revocation disrupts the attackers' ability to use these certificates for code signing, thereby mitigating part of the threat. The Rhysida ransomware campaign remains a high-severity threat due to its use of trusted certificates to facilitate malware distribution. European organizations, especially those with high reliance on Microsoft ecosystems and critical infrastructure, could be targeted. The campaign highlights the ongoing risk of certificate-based trust abuse in ransomware operations. Defenders should prioritize monitoring for suspicious signed binaries and ensure robust certificate validation processes. Countries with significant Microsoft product usage and critical infrastructure sectors are at elevated risk. Immediate mitigation includes updating certificate revocation lists and enhancing endpoint detection capabilities to identify signed malware. The threat is assessed as high severity given the impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted certificates and no need for user interaction once infection vectors are triggered.
This threat report highlights ransomware attacks disproportionately impacting small businesses, emphasizing both financial and psychological damage. It details a new malware campaign by the North Korean group Famous Chollima, which targets job seekers with trojanized applications to steal credentials and cryptocurrency. The campaign employs multiple tactics including credential dumping, phishing, and malware execution techniques. The report stresses the importance of empathetic leadership and comprehensive incident response plans that address technical and human factors. Indicators include multiple malware hashes linked to this campaign. The threat is medium severity due to its targeted nature, impact on confidentiality and availability, and the exploitation complexity. European small businesses, especially those with limited cybersecurity resources, are at heightened risk. Mitigation requires tailored incident response, user awareness focused on job seeker scams, and credential protection strategies. Countries with significant small business sectors and exposure to North Korean threat activity are most likely affected.
Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in Windows. We promptly reported this issue to Microsoft and they fixed the vulnerability starting with OS Build 26100.4202 in the KB5058499 update preview released on May 28th 2025. In the following sections, we […] The post Denial of Fuzzing: Rust in the Windows kernel appeared first on Check Point Research .
Microsoft's October 2025 Patch Tuesday addresses 175 vulnerabilities, including three zero-day flaws. While no known exploits are currently reported in the wild, these zero-days represent significant security risks if left unpatched. The update covers a broad range of Microsoft products, potentially affecting many organizations globally. European entities relying on Microsoft technologies should prioritize timely patching to mitigate risks of exploitation. The medium severity rating reflects the broad impact but currently limited exploitation evidence. Attackers could leverage these vulnerabilities to compromise confidentiality, integrity, or availability of systems. No detailed technical specifics or affected versions are provided, limiting precise risk assessment. Organizations should monitor for further technical disclosures and threat intelligence updates. Proactive patch management and vulnerability scanning remain critical defenses. Countries with high Microsoft usage and strategic digital infrastructure are most at risk.
Users can continue receiving important security updates for Windows 10 by enrolling in the ESU program. The post Windows 10 Still on Over 40% of Devices as It Reaches End of Support appeared first on SecurityWeek .
The botnet packs over 50 exploits targeting unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices. The post RondoDox Botnet Takes ‘Exploit Shotgun’ Approach appeared first on SecurityWeek .
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.
New Study Warns Several Free iOS and Android VPN Apps Use Outdated Software and Leak User Data
Source: https://hackread.com/studyfree-ios-android-vpn-apps-leak-data/
New Android Banking Trojan “Klopatra” Uses Hidden VNC to Control Infected Smartphones
Source: https://thehackernews.com/2025/10/new-android-banking-trojan-klopatra.html
Ohio’s Union County suffers ransomware attack impacting 45,000 people
Source: https://securityaffairs.com/182689/uncategorized/ohios-union-county-suffers-ransomware-attack-impacting-45000-people.html
BadIIS Malware Spreads via SEO Poisoning — Redirects Traffic, Plants Web Shells
Source: https://thehackernews.com/2025/09/badiis-malware-spreads-via-seo.html
Microsoft Office 2016/2019 End of Life
Source: https://www.lansweeper.com/blog/eol/microsoft-office-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=microsoft-office
40% of Corporate Client Devices Still Run Windows 10
Source: https://www.lansweeper.com/blog/eol/are-you-prepared-for-windows-10-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=windows10
New Raven Stealer Malware Hits Browsers for Cookies, Passwords and Payment Data
Source: https://hackread.com/raven-stealer-malware-browsers-passwords-payment-data/
Google confirms fraudulent account created in law enforcement portal
Source: https://www.bleepingcomputer.com/news/security/google-confirms-hackers-gained-access-to-law-enforcement-portal/
*Today, we have intuitively adapted to Quick Response (QR) codes in the tapestry of our day-to-day life.*
Whether we are scanning the menu at a restaurant or checking in to our flight, they have seamlessly integrated into the consumption of products and information.
Yet, with its widespread adoption, it has also acquired an accompanying security challenge. Bad actors have capitalized on QR codes to perpetrate phishing attacks, deliver malware, and exfiltrate data without the user’s knowledge.
Oftentimes, this is caught after the attack occurs. This is why you should [use a safe online QR code scanner](https://www.qrstuff.com/scan) that authenticates the link before you click on it is so critical.
