The FCC has banned foreign-made drones and key components due to national security concerns, highlighting risks associated with supply chain and hardware backdoors. While this is a regulatory action rather than a direct technical vulnerability, it reflects significant concerns about potential espionage or sabotage via drone technology. European organizations using similar foreign-made drones or components may face increased scrutiny or supply chain risks. The ban underscores the importance of securing hardware supply chains and verifying the integrity of drone components. Mitigation involves adopting trusted suppliers, conducting thorough hardware security assessments, and monitoring regulatory developments. Countries with high drone usage in critical infrastructure or defense sectors, such as Germany, France, and the UK, are most likely to be affected. The threat severity is assessed as medium due to indirect impact and lack of direct exploitation evidence. Defenders should prioritize supply chain risk management and maintain awareness of geopolitical developments affecting drone technology security.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting the Digiever DS-2105 Pro device to its Known Exploited Vulnerabilities catalog. This inclusion indicates that the flaw is recognized as actively targeted or exploited in the wild, although no confirmed exploits have been reported yet. The vulnerability is categorized with medium severity and relates to a network-connected device commonly used in video surveillance systems. There are no specific affected versions or patches currently detailed, and technical information is limited. European organizations using Digiever DS-2105 Pro devices, especially in critical infrastructure or surveillance roles, could face risks to confidentiality, integrity, or availability if exploited. Mitigation requires proactive monitoring, network segmentation, and vendor engagement for patches. Countries with higher adoption of Digiever products and strategic surveillance deployments, such as Germany, France, and the UK, are more likely to be impacted. Given the medium severity and lack of detailed exploit information, the threat should be taken seriously but is not currently critical.
Authorities in Senegal, Ghana, Benin, and Cameroon dismantled BEC, ransomware, and other cyber-fraud networks. The post 574 Arrested, $3 Million Seized in Crackdown on African Cybercrime Rings appeared first on SecurityWeek .
A cyberattack knocked France’s national postal service offline, blocking and delaying package deliveries and online payments. The post Cyberattack Disrupts France’s Postal Service and Banking During Christmas Rush appeared first on SecurityWeek .
Interpol has led a coordinated international law enforcement operation resulting in the decryption of six ransomware strains and the arrest of hundreds of individuals involved in ransomware activities. This action disrupts multiple ransomware campaigns, providing victims with decryption tools and reducing the operational capabilities of cybercriminal groups. The operation highlights the ongoing global effort to combat ransomware threats through collaboration and intelligence sharing. European organizations may benefit from the availability of new decryption tools and reduced ransomware activity. However, the threat of ransomware remains significant, requiring continued vigilance and proactive defense measures. The arrests may temporarily disrupt ransomware operations but do not eliminate the risk entirely. Organizations should leverage threat intelligence updates and apply specific mitigations to reduce ransomware impact. Countries with high ransomware targeting and critical infrastructure are particularly relevant in this context. Overall, this development is a positive step but not a resolution to the ransomware problem.
Urban VPN Proxy has been reported to spy on users' conversations with AI chatbots, potentially capturing sensitive and private information transmitted during these interactions. This threat involves the interception and logging of chatbot communication data by the VPN service, which users may trust to secure their internet traffic. The spying activity raises significant privacy concerns, especially as AI chatbots are increasingly used for sensitive queries and business communications. There is no evidence of active exploitation beyond data collection, and no specific affected software versions are identified. The threat is categorized as medium severity due to the privacy impact and potential data exposure, but it does not involve direct system compromise or malware. European organizations using Urban VPN Proxy or similar services for AI chatbot access may be at risk of confidential data leakage. Mitigation involves avoiding untrusted VPN providers, using end-to-end encrypted chatbot services, and monitoring network traffic for suspicious activity. Countries with higher VPN usage and significant AI adoption, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the nature of data interception without system exploitation, the suggested severity is medium. Defenders should prioritize verifying VPN trustworthiness and educating users on privacy risks when using third-party proxies for AI services.
Frogblight is a medium-severity Android malware campaign distributing fake court and aid-related applications to deceive users. It targets Android users by masquerading as legitimate legal or aid service apps, aiming to trick victims into installing malicious software. The malware's primary goal is likely to steal sensitive information or gain unauthorized access to devices. There are no known exploits in the wild yet, and technical details are limited, with minimal discussion and indicators available. European organizations and users could be impacted due to the widespread use of Android devices and the relevance of legal and aid services. Mitigation requires targeted user awareness campaigns, strict app vetting, and enhanced mobile security controls. Countries with high Android usage and significant legal or social aid infrastructure, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the medium severity, the malware poses a moderate risk, primarily impacting confidentiality and potentially device integrity without requiring user interaction beyond installation. Defenders should focus on detecting fake apps, monitoring unusual app behaviors, and educating users about verifying app authenticity.
For the latest discoveries in cyber research for the week of 22nd December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An adult content platform PornHub has disclosed a data breach linked to analytics provider Mixpanel. The breach exposed more than 200 million records related to Premium users, including email addresses, search, watch, […] The post 22nd December – Threat Intelligence Report appeared first on Check Point Research .
Artem Stryzhak pleaded guilty to conspiracy to commit computer fraud after he was extradited earlier this year. The post Ukrainian Nefilim Ransomware Affiliate Pleads Guilty in US appeared first on SecurityWeek .
The British government is investigating a “cyber incident” following news reports that hackers linked to China have gained access to thousands of confidential documents. The post UK Government Acknowledges It Is Investigating Cyber Incident After Media Reports appeared first on SecurityWeek .
RansomHouse, a ransomware group, has enhanced its encryption capabilities by implementing multi-layered data processing techniques. This upgrade likely increases the complexity and robustness of their encryption, making data recovery without paying ransom more difficult. Although no specific vulnerabilities or exploits are detailed, the evolution signals a higher threat level for organizations targeted by this group. European organizations, especially those with critical infrastructure or valuable data, may face increased risk due to the harder-to-defeat encryption methods. No known exploits are currently reported in the wild, but the upgrade suggests a potential rise in attack sophistication. Mitigation requires proactive defense strategies including advanced detection, robust backup solutions, and incident response readiness. Countries with significant digital economies and critical infrastructure are more likely to be targeted. Given the enhanced encryption and potential impact on confidentiality and availability, the threat severity is assessed as high. Defenders should prioritize monitoring for RansomHouse activity and prepare for complex ransomware incidents.
The FBI has seized domains operating from Bangladesh that were distributing fake ID templates, a medium-severity phishing-related threat. These domains facilitated the creation and distribution of counterfeit identification documents, which can be used for identity fraud and social engineering attacks. Although no direct exploits or vulnerabilities are reported, the availability of such templates increases the risk of phishing and fraud campaigns targeting organizations and individuals. European organizations could face increased risks of identity-based fraud, unauthorized access, and compliance violations. Mitigation requires enhanced identity verification processes, employee training on phishing and social engineering, and monitoring for fraudulent documents. Countries with significant financial sectors and high digital identity usage, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. The threat is medium severity due to its indirect impact on confidentiality and integrity, the lack of direct exploitation, and the requirement for attackers to leverage the fake IDs in subsequent attacks. Defenders should focus on strengthening identity validation and awareness to reduce the threat's effectiveness.
A medium-severity vulnerability in WatchGuard Fireware OS has been added by the U. S. CISA to its Known Exploited Vulnerabilities catalog. Although no specific technical details or affected versions are provided, this inclusion indicates active exploitation or significant risk. WatchGuard Fireware OS is widely used in network security appliances, making this flaw potentially impactful for organizations relying on these devices. No patches or known exploits in the wild have been reported yet, but the threat is considered newsworthy and warrants attention. European organizations using WatchGuard products should prioritize monitoring and mitigation efforts. The vulnerability could affect confidentiality, integrity, and availability of network security infrastructure if exploited. Countries with higher adoption of WatchGuard solutions and critical infrastructure reliance on these devices are at greater risk. Immediate mitigation steps include enhanced network monitoring, segmentation, and vendor communication for updates.
Over 25,000 FortiCloud Single Sign-On (SSO) devices have been reported as exposed to remote attacks, potentially allowing unauthorized access or control. The exposure stems from these devices being reachable over the internet without adequate protections, increasing the risk of exploitation. Although no known exploits are currently active in the wild, the scale of exposure and the critical role of SSO in authentication make this a high-priority threat. European organizations using FortiCloud SSO services could face significant risks including unauthorized access to internal systems, data breaches, and disruption of authentication services. Mitigation requires immediate network segmentation, access restriction, and monitoring of exposed devices. Countries with high adoption of Fortinet products and critical infrastructure relying on FortiCloud SSO are most at risk. Given the ease of remote exploitation and the potential impact on confidentiality and availability, this threat is assessed as high severity. Defenders must prioritize identifying exposed devices, applying access controls, and monitoring for suspicious activity to reduce risk.
A newly discovered China-aligned APT group named LongNosedGoblin has been targeting governmental entities in Southeast Asia and Japan for cyberespionage purposes. The group employs a varied custom toolset consisting mainly of C#/.NET applications and notably uses Group Policy to deploy malware and move laterally across compromised networks. Their main tools include NosyHistorian for collecting browser history, NosyDoor backdoor using cloud services as C&C, and NosyStealer for exfiltrating browser data. The group has been active since at least September 2023 and uses techniques like AMSI bypassing and living-off-the-land tactics. LongNosedGoblin's campaigns involve multiple stages of execution and various malware components, showcasing a sophisticated approach to cyber espionage operations.
The hacking group has been using Group Policy to deploy cyberespionage tools on governmental networks. The post Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments appeared first on SecurityWeek .
Certain ASRock, ASUS, GIGABYTE, and MSI motherboard models are vulnerable to pre-boot memory attacks that can compromise system integrity before the operating system loads. These attacks exploit weaknesses in the early boot process, potentially allowing attackers to access or manipulate sensitive data stored in memory. While no known exploits are currently active in the wild, the vulnerability poses a medium-level risk due to the complexity of exploitation and the critical nature of pre-boot environments. European organizations using affected motherboards in critical infrastructure or enterprise environments could face confidentiality and integrity risks. Mitigation requires firmware updates from vendors and enhanced physical security controls to prevent unauthorized access. Countries with high adoption of these motherboard brands and significant industrial or governmental IT infrastructure are more likely to be impacted. Given the attack complexity and potential impact on system trustworthiness, the threat severity is assessed as medium. Defenders should prioritize monitoring for firmware updates and restrict physical access to systems to reduce risk.
Xavier&#;x26;#;39;s diary entry "Abusing DLLs EntryPoint for the Fun" inspired me to do some tests with TLS Callbacks and DLLs.
A China-aligned threat group has been observed leveraging Windows Group Policy to deploy espionage malware. This technique allows the attacker to distribute malicious payloads across multiple systems within a network efficiently. The malware is designed for espionage, targeting sensitive information and potentially compromising confidentiality and integrity. The attack does not currently have known exploits in the wild but is considered high severity due to the sophistication and potential impact. European organizations using Windows Active Directory environments are at risk, especially those in sectors with strategic importance or geopolitical interest to China. Mitigation requires strict Group Policy management, enhanced monitoring of policy changes, and network segmentation. Countries with significant Windows enterprise deployments and geopolitical relevance, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the potential for widespread impact, ease of exploitation within compromised networks, and the critical nature of the targeted data. Defenders should prioritize detection of unauthorized Group Policy modifications and implement robust endpoint security controls.
DIG AI is an uncensored AI assistant available on the darknet that facilitates criminal and terrorist activities by providing unrestricted guidance and support. It operates without typical content restrictions, enabling malicious actors to obtain advice on illegal operations, hacking, and other harmful actions. While not a direct software vulnerability, DIG AI represents a significant threat by lowering the barrier for criminals to access sophisticated AI-driven assistance. European organizations could face increased risks from more effective cyberattacks and coordinated criminal campaigns empowered by such AI tools. Mitigation requires enhanced monitoring of darknet activities, improved threat intelligence sharing, and targeted law enforcement actions. Countries with high digital infrastructure, active darknet markets, and strategic geopolitical importance in Europe are more likely to be affected. Given its facilitation of criminal activities and potential to amplify cyber threats, the severity is assessed as high. Defenders should focus on proactive darknet intelligence, AI misuse awareness, and strengthening cyber defenses against AI-augmented threats.
