The Iranian APT group known as 'Prince of Persia' has reemerged with new cyber tools and expanded global targeting. This campaign, reported recently, indicates an evolution in their tactics and capabilities, posing a medium-level threat. While specific affected software versions or exploits are not detailed, the group’s historical focus on espionage and disruption suggests risks to confidentiality and operational integrity. European organizations, especially those in critical infrastructure, government, and strategic industries, may be targeted due to geopolitical tensions. Mitigation requires enhanced threat intelligence sharing, network segmentation, and proactive monitoring for unusual activity linked to APT behaviors. Countries with significant Iranian geopolitical interest and advanced digital infrastructure, such as Germany, France, the UK, and Italy, are more likely to be affected. Given the medium severity, the threat demands vigilance but does not currently indicate widespread exploitation or critical vulnerabilities. Defenders should prioritize detection and response capabilities tailored to APT tactics and maintain updated incident response plans.
Cybercriminals are spreading the Stealka infostealer disguised as game cheats, mods, and pirated software. It targets sensitive information, cryptocurrency, and account credentials
Threat actors stole names, Social Security numbers, and financial and health information, and deployed ransomware on RBHA’s systems. The post 113,000 Impacted by Data Breach at Virginia Mental Health Authority appeared first on SecurityWeek .
A 22-year-old individual was arrested in France following a hack targeting the French Interior Ministry's systems. While specific technical details of the breach are not disclosed, the incident highlights a successful compromise of a critical government entity. No known exploits or vulnerabilities have been publicly identified in relation to this attack. The severity is assessed as medium, reflecting potential risks to confidentiality and integrity of sensitive governmental data. European organizations, especially governmental bodies, should be vigilant about similar threats. Mitigation should focus on strengthening access controls, monitoring for anomalous activity, and incident response readiness. France is the primary affected country, with potential implications for other European nations due to interconnected governmental and security operations. Given the lack of detailed technical information, the threat's severity is rated medium based on the impact on a high-value target and the apparent unauthorized access. Defenders should prioritize securing critical infrastructure and sharing threat intelligence across European security agencies.
Recent research by ActiveFence evaluated seven major large language models (LLMs) for vulnerabilities related to hate speech, disinformation, fraud, and child safety. The study found that 44% of LLM outputs were risky, with 68% of unsafe outputs related to hate speech, indicating significant weaknesses in content moderation and abuse prevention. Fraud-related outputs were comparatively better managed, but hate speech and child safety remain critical gaps. No tested model was fully safe, highlighting systemic risks in current LLM deployments. This threat is not a traditional software vulnerability but an exploitation of AI model behavior that can propagate harmful content. European organizations using or deploying LLMs should be aware of these risks, especially in sectors sensitive to hate speech and child protection. Mitigation requires tailored content filtering, continuous red-teaming, and collaboration with specialized threat intelligence providers. Countries with high AI adoption and strict regulatory environments around hate speech and child safety are most likely to be affected. Given the broad impact on confidentiality, integrity of information, and potential societal harm, and the ease of exploitation via user prompts, this threat is assessed as high severity.
A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.
The Kimwolf botnet has compromised approximately 1.8 million Android TV devices globally, leveraging them to conduct large-scale distributed denial-of-service (DDoS) attacks. This botnet exploits vulnerabilities in Android TV platforms to gain control without requiring user interaction or authentication. The hijacked devices are then orchestrated to flood targeted networks with traffic, disrupting services and causing outages. European organizations relying on Android TV infrastructure or connected smart devices may face increased risk of service disruption and collateral damage from these attacks. The botnet's scale and use of consumer IoT devices make mitigation challenging, requiring coordinated efforts between device manufacturers, network operators, and end users. Countries with high adoption rates of Android TV and significant digital infrastructure are particularly vulnerable. Immediate mitigation involves network-level traffic filtering, device firmware updates, and enhanced monitoring for unusual traffic patterns. Given the ease of exploitation and broad impact, this threat is assessed as high severity for affected entities in Europe.
A Chinese-nexus advanced persistent threat actor, UAT-9686, is actively targeting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The campaign, ongoing since late November 2025, exploits non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor called AquaShell. Additional tools observed include AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing. The attackers can execute encoded commands in the system shell and create reverse connections to attacker-controlled servers. This sophisticated attack aligns with tactics used by other Chinese APT groups, raising concerns about potential widespread impact on email security infrastructure.
The trucking industry group has released its 2026 Transportation Industry Cybersecurity Trends Report. The post NMFTA Warns of Surge and Sophistication of Cyber-Enabled Cargo Theft appeared first on SecurityWeek .
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting multiple Fortinet products to its Known Exploited Vulnerabilities catalog. Although no specific CVSS score or detailed technical information is provided, the flaw is considered medium severity and currently has no known exploits in the wild. This vulnerability impacts Fortinet devices, which are widely used for network security, including firewalls and VPNs, making it a relevant concern for organizations relying on these products. European organizations using Fortinet products should be aware of this addition to CISA's catalog and prioritize monitoring and patching once updates become available. The threat does not require user interaction but may allow unauthorized access or disruption if exploited. Countries with significant Fortinet deployments and critical infrastructure reliance on these devices are at higher risk. Immediate mitigation steps include reviewing Fortinet advisories, applying patches promptly, and enhancing network monitoring for suspicious activity. Given the medium severity and lack of known exploits, the threat should be taken seriously but does not currently represent an urgent crisis.
The Chinese Ink Dragon threat group has been identified as operating covertly within European government networks, engaging in a cyber espionage campaign. This activity involves persistent unauthorized access, likely aimed at intelligence gathering and strategic advantage. The campaign is considered high severity due to the sensitive nature of the targets and the potential impact on government confidentiality and operations. Although specific technical details and indicators of compromise are limited, the threat actor’s presence in critical government infrastructure poses significant risks. European organizations, especially government entities, face risks including data exfiltration, disruption of services, and compromise of sensitive information. Mitigation requires targeted network monitoring, enhanced threat hunting, and strict access controls tailored to government environments. Countries with high government digitalization and geopolitical relevance to China are most at risk. Given the stealth and persistence of the group, the threat is assessed as high severity, reflecting the potential for substantial confidentiality and integrity impacts without requiring user interaction. Defenders should prioritize detection and response capabilities focused on advanced persistent threat behaviors.
A spear phishing campaign targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism was discovered in September 2025. The attack, attributed to BlindEagle, utilized a compromised email account within the organization to bypass security controls. The campaign employed a sophisticated multi-layer attack chain, including a fake web portal, nested JavaScript and PowerShell scripts, steganography, and the deployment of Caminho as a downloader for DCRAT. The attack leveraged legal-themed lures, in-memory execution, and abuse of legitimate services like Discord. BlindEagle's evolution in tactics and use of new tools like Caminho demonstrates their ongoing threat to Colombian institutions.
Amazon Threat Intelligence has reported that Russian GRU-affiliated hackers are shifting their tactics from exploiting software vulnerabilities to targeting misconfigured devices. This change indicates a preference for leveraging security weaknesses caused by improper configurations rather than relying on zero-day or known software flaws. Such misconfigurations can include exposed management interfaces, default credentials, or improperly secured network services. The threat is assessed as medium severity due to the moderate impact and the relative ease of exploitation without requiring sophisticated zero-day vulnerabilities. European organizations, especially those with extensive networked infrastructure and IoT deployments, may be at increased risk if devices are not properly secured. Countries with significant critical infrastructure and technology sectors, such as Germany, France, and the UK, could be primary targets. Mitigation requires focused efforts on device configuration management, continuous monitoring, and strict access controls rather than solely patch management. This shift in attacker behavior underscores the importance of comprehensive security hygiene beyond patching software vulnerabilities. Defenders should prioritize auditing device configurations, enforcing strong authentication, and segmenting networks to reduce exposure.
Dangerzone is an open-source tool designed to sanitize untrusted documents using multiple containerization layers, including gVisor and Linux containers, targeting vulnerable users like journalists and activists. A new limited bug bounty program has been launched to test the robustness of Dangerzone's container isolation by challenging researchers to break out of these containers. Although Dangerzone underwent a favorable security audit in December 2023, this bounty program aims to proactively discover remote code execution (RCE) vulnerabilities or container escapes before malicious actors do. No known exploits are currently in the wild, and no affected versions or patches have been specified. The threat is assessed as medium severity due to the potential for container escape leading to code execution, but with limited evidence of active exploitation or widespread impact. European organizations relying on containerized document sanitization tools, especially those supporting press freedom and activism, could be impacted if vulnerabilities are found and exploited. Mitigation involves strict container hardening, continuous security testing beyond audits, and rapid patching once vulnerabilities are identified. Countries with strong media sectors and active civil society, such as Germany, France, the UK, and the Netherlands, are more likely to be affected due to higher adoption and strategic interest. The threat highlights the importance of layered container security and proactive vulnerability discovery in protecting sensitive user groups from advanced malware and APT threats.
new phishing scam is exploiting Telegram’s built-in Mini Apps: fraudsters are running fake giveaways to steal accounts. Here’s how to protect yourself.
Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.
A security flaw in JumpCloud Remote Assist allows users to gain full control over company devices, potentially compromising confidentiality, integrity, and availability. The vulnerability enables privilege escalation or unauthorized access, posing risks to enterprise environments that use this remote assistance tool. Although no known exploits are currently active in the wild and technical details are limited, the medium severity rating suggests moderate risk. European organizations relying on JumpCloud for device management should prioritize identifying affected systems and applying mitigations. Countries with higher adoption of cloud-based device management and remote support tools, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Immediate mitigation steps include restricting access to JumpCloud Remote Assist, monitoring for unusual activity, and preparing for patch deployment once available. The threat underscores the importance of securing remote management tools to prevent lateral movement and full device compromise. Organizations should also review internal access controls and audit logs to detect potential misuse. Given the lack of detailed technical data and absence of exploits in the wild, the threat is assessed as medium severity but requires vigilance due to the potential for full device control.
A high-severity authentication bypass vulnerability affecting Fortinet FortiGate devices using SAML SSO has been reported and is under active attack. The flaw allows attackers to bypass SAML-based authentication, potentially gaining unauthorized access without valid credentials. Although no CVE or patch information is currently available, the threat is considered high priority due to the critical role FortiGate devices play in network security. European organizations relying on FortiGate for perimeter defense and VPN access are at risk of compromise, data breaches, and network infiltration. Mitigation requires immediate review of SAML configurations, monitoring for suspicious authentication attempts, and applying any forthcoming vendor advisories. Countries with high Fortinet market penetration and strategic infrastructure are most vulnerable. The ease of exploitation and impact on confidentiality and integrity justify a high severity rating. Defenders must prioritize detection and containment while awaiting official patches.
Key Findings Introduction Check Point Research tracks a sustained, highly capable espionage cluster, which we refer to as Ink Dragon, and is referenced in other reports as CL-STA-0049, Earth Alux, or REF7707. This cluster is assessed by several vendors to be PRC-aligned. Since at least early 2023, Ink Dragon has repeatedly targeted government, telecom, and […] The post Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation appeared first on Check Point Research .
