Threats affecting Belgium

Askul, a company presumably operating in Japan, has confirmed a ransomware attack resulting in the theft of approximately 740,000 customer records. The attack involved unauthorized access and data exfiltration, typical of ransomware incidents where attackers encrypt data and demand ransom while threatening or executing data leaks. Although no specific technical details about the ransomware variant or exploitation vectors are provided, the breach's scale and data sensitivity classify this as a high-severity incident. European organizations should be aware of similar ransomware threats targeting customer data, as such attacks can disrupt operations and lead to regulatory penalties under GDPR. Mitigation should focus on robust backup strategies, network segmentation, continuous monitoring for unusual activity, and incident response preparedness. Countries with significant business ties to Japan or with large multinational corporations using similar supply chains may be more exposed. Given the data theft and ransomware nature, the suggested severity is high due to the impact on confidentiality and availability, ease of exploitation by ransomware actors, and the broad scope of affected data.

Malware#infosecnews#redditGermany+6

The French Interior Ministry has publicly disclosed that hackers breached its email servers, potentially compromising sensitive government communications. While detailed technical information about the breach is not available, the incident highlights a significant security failure within a critical government infrastructure. No known exploits or vulnerabilities have been reported in the wild related to this breach. The attack likely targeted confidential information, risking exposure of sensitive data and undermining trust in government cybersecurity. European organizations, especially governmental bodies, should be alert to similar threats. Mitigation requires enhanced email security protocols, continuous monitoring, and incident response readiness. Given the strategic importance of France and its government institutions, this breach may have wider geopolitical implications. Countries with close ties or similar infrastructure may also be at increased risk. The severity is assessed as medium due to the breach of confidentiality and potential for further exploitation, despite limited public technical details and no evidence of widespread exploitation.

News#infosecnews#redditFrance+6

DDoSia, a participatory DDoS tool created by Russian hacktivists in 2022, is operated by the pro-Russian group NoName057(16). It relies on volunteers to contribute network resources for attacks, primarily targeting Ukraine, European allies, and NATO states. Censys has monitored DDoSia since mid-2025, observing an average of 6 control servers with short lifespans. The tool uses a multi-layered control infrastructure, with systems typically hosted on VPS providers. Despite law enforcement disruption in July 2025, DDoSia quickly reconstituted and resumed operations. The infrastructure is characterized by rapid changes, with most servers active for less than 24 hours. Attacks focus on government, military, transportation, public utilities, financial, and tourism sectors.

Malware#ddosia#ddosUkraine+9

This case study demonstrates an autonomous application security (AppSec) workflow using Chrome DevTools via the MCP protocol against the OWASP Juice Shop vulnerable web application. The findings include stack-trace exposure due to improper error handling and a directory traversal vulnerability that allows retrieval of confidential files. The workflow significantly reduces testing time from 600 minutes to 3.5 minutes, highlighting the efficiency of agent-based and browser-level tooling in AppSec. Although the vulnerabilities are well-known classes, their presence in Juice Shop serves as a proof of concept for automated detection. No known exploits are currently in the wild. The threat primarily illustrates the potential for automated tools to uncover critical web application flaws quickly. European organizations running web applications with similar misconfigurations or using Chrome DevTools-based automation should be aware of these risks. Mitigation involves improving error handling, validating and sanitizing user inputs to prevent directory traversal, and integrating automated security testing into development pipelines. Countries with strong web application development sectors and high adoption of Chrome-based tooling, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted.

News#netsec#redditGermany+5

A detailed guide on detecting and responding to forgotten and outdated servers, API endpoints, user accounts, websites, and other IT assets.

Analysis#webGermany+7

Google has linked multiple Chinese hacking groups to attacks leveraging the React2Shell vulnerability, a critical security flaw affecting systems that use the React2Shell component. These attacks are part of a broader campaign targeting organizations globally, with a high severity rating due to the potential for remote code execution and system compromise. Although no known exploits are currently in the wild, the association with state-sponsored groups increases the threat's credibility and urgency. European organizations using affected systems are at risk of espionage, data theft, and operational disruption. Mitigation requires immediate patching of vulnerable components, enhanced network monitoring for suspicious activity, and restricting exposure of vulnerable services. Countries with significant technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are likely to be primary targets. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize detection and response capabilities to mitigate potential intrusions linked to this campaign.

News#infosecnews#redditGermany+7

AI can be used by extremist groups to pump out propaganda or deepfakes at scale, widening their reach and expanding their influence. The post Militant Groups Are Experimenting With AI, and the Risks Are Expected to Grow appeared first on SecurityWeek .

NewsFranceGermany+7

The Fragile Lock research reveals novel bypass techniques targeting SAML authentication mechanisms, which are widely used for single sign-on (SSO) in enterprise environments. These bypasses exploit weaknesses in the SAML protocol implementation or configuration, potentially allowing attackers to impersonate users without proper authentication. Although no known exploits are currently in the wild, the medium severity rating reflects the risk posed by these bypasses if leveraged. European organizations relying on SAML-based SSO for identity federation and access control could face unauthorized access risks, impacting confidentiality and integrity. Mitigation requires careful validation of SAML assertions, strict adherence to protocol specifications, and deployment of updated security controls. Countries with high adoption of cloud services and SAML-based identity providers, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the complexity of exploitation and the absence of active attacks, the suggested severity is medium. Defenders should prioritize reviewing their SAML implementations and monitoring for anomalous authentication activities.

Tool#netsec#redditGermany+5

For the latest discoveries in cyber research for the week of 15th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Indian government confirmed cyber incidents involving GPS spoofing at seven major airports, including Delhi, Mumbai, Kolkata, and Bengaluru. The attack affected aircrafts using GPS-based landing procedures. Despite signal disruption to navigation […] The post 15th December – Threat Intelligence Report appeared first on Check Point Research .

AnalysisFranceGermany+10

Frogblight is a medium-severity Android banking Trojan primarily targeting users in Turkey. It masquerades as legitimate apps, initially as a court case file viewer and later as common apps like Chrome, to trick victims into installation. The malware steals banking credentials via official government websites and has extensive spyware capabilities, including SMS interception, app enumeration, device info collection, and sending arbitrary SMS messages. It employs advanced persistence and anti-deletion techniques and is distributed mainly through smishing campaigns exploiting legal concerns. Although currently focused on Turkey, its sophisticated remote control features and ongoing development pose risks if it spreads. No CVSS score exists, but the threat impacts confidentiality and integrity significantly with moderate ease of exploitation and no user interaction beyond initial install. European organizations with Turkish-speaking users or business ties should monitor for potential spillover. Mitigations include user education on smishing, app installation restrictions, SMS monitoring, and enhanced mobile endpoint protection.

Malware#android#smishingGermany+5

Hamas-linked threat actors have been reported to deploy AshTag malware targeting diplomatic offices. The malware campaign appears focused on espionage activities against diplomatic entities, aiming to compromise sensitive communications and data. The threat is currently assessed as medium severity, with no known exploits in the wild or detailed technical indicators publicly available. The attack vector and infection methods remain unclear, limiting immediate detection and response capabilities. European diplomatic missions and foreign affairs offices could be potential targets due to their strategic importance. Mitigation requires enhanced monitoring of diplomatic networks, threat intelligence sharing, and strict access controls. Countries with significant diplomatic presence and geopolitical relevance in Middle East affairs are at higher risk. Given the limited technical details and absence of widespread exploitation, the overall risk is medium but warrants vigilance. Defenders should prioritize intelligence gathering and network segmentation to reduce exposure.

Malware#infosecnews#redditFrance+8

CERT-FR has issued a recommendation to completely deactivate Wi-Fi whenever it is not in use to reduce attack surfaces and prevent potential unauthorized access. This advisory highlights the risks associated with leaving Wi-Fi enabled unnecessarily, which can expose devices and networks to various wireless attacks such as unauthorized access, man-in-the-middle, and exploitation of Wi-Fi protocol vulnerabilities. Although no specific vulnerability or exploit is detailed, the guidance aims to mitigate risks by minimizing wireless exposure. European organizations, especially those with sensitive data or critical infrastructure, should consider this practice to enhance their security posture. The recommendation is particularly relevant for environments where Wi-Fi is not continuously needed, such as offices after hours or industrial settings. Countries with high adoption of Wi-Fi-enabled devices and critical infrastructure reliant on wireless connectivity are more likely to benefit from this advice. Given the medium severity rating and lack of known exploits, the threat is more about reducing risk exposure than responding to an active exploit. Practical mitigation includes disabling Wi-Fi radios when idle, enforcing strict network access controls, and monitoring for unauthorized wireless activity. This advisory serves as a reminder that wireless interfaces represent a persistent attack vector and should be managed proactively to reduce potential compromise.

News#infosecnews#redditFrance+7

Germany has summoned the Russian Ambassador following claims of a cyberattack targeting German air traffic control systems. The incident, reported via a Reddit InfoSec news post linking to securityaffairs.com, suggests a possible state-sponsored campaign but lacks detailed technical evidence or confirmed exploits. No specific affected systems or vulnerabilities have been disclosed, and there is no indication of active exploitation in the wild. The severity is assessed as medium due to the critical nature of air traffic control infrastructure and potential geopolitical implications. European organizations, especially those involved in aviation and critical infrastructure, should remain vigilant. Mitigation should focus on enhanced monitoring, incident response readiness, and collaboration with national cybersecurity agencies. Germany and neighboring European countries with significant aviation sectors are most likely to be affected. Given the limited technical details, the threat is rated medium severity based on potential impact and uncertainty. Defenders should prioritize situational awareness and verify the integrity of air traffic control networks.

Campaign#infosecnews#redditGermany+6

Offline Decryption Messaging is a proposed security model designed to protect communications even when online devices are compromised by spyware. It uses two devices per user: an online device for transmitting encrypted messages and an air-gapped offline device for writing, encrypting, decrypting, and displaying messages. This separation ensures that spyware on the online device cannot access plaintext messages or cryptographic keys, while spyware on the offline device cannot exfiltrate data due to lack of network connectivity. The concept aims to address the limitations of traditional end-to-end encrypted messengers like Signal, which become ineffective if the device itself is compromised. The project, called HelioSphere, is in early prototype stages and seeks community feedback on security, usability, and cryptographic improvements. While promising for high-risk users such as activists, the approach introduces operational complexity and usability challenges. No known exploits exist yet, and the threat is currently a conceptual proposal rather than an active attack vector. The suggested severity is medium due to the potential to mitigate spyware risks but also the practical challenges in deployment.

Breach#netsec#redditGermany+8

The UK Information Commissioner's Office (ICO) has fined LastPass £1.2 million due to a security breach that occurred in 2022. This breach involved unauthorized access to LastPass systems, potentially exposing sensitive customer data. Although no known exploits are currently active in the wild, the incident highlights significant risks related to password management services. European organizations relying on LastPass could face confidentiality and integrity risks if their stored credentials were compromised. The fine underscores regulatory scrutiny on data protection compliance within the EU and UK. Mitigation requires organizations to review their password management practices, enforce multi-factor authentication, and monitor for suspicious activity. Countries with high adoption of LastPass and stringent data protection laws, such as the UK, Germany, and France, are most likely to be affected. Given the breach's impact on sensitive data confidentiality and the ease of exploitation through compromised credentials, the severity is assessed as high. Defenders should prioritize incident response readiness and vendor risk management related to password managers.

Breach#infosecnews#redditGermany+5

BRICKSTORM Backdoor - MAR-251165.c1.v1

Unknown#misp-galaxy:producer="geminiproduction_cma"#acs-marking:privilege_action="cisauses"Germany+7

The Akira ransomware group took credit for the Fieldtex Products hack in November, claiming to have stolen 14 Gb of data. The post Fieldtex Data Breach Impacts 238,000 appeared first on SecurityWeek .

BreachGermanyFrance+4

We break down what happens to stolen data after a phishing attack: how it ends up on the shadow market and gets used in new phishing schemes, and what risks this poses. We also offer tips on how to protect your accounts, and minimize any impact.

PhishingGermanyFrance+9

CISA has issued an urgent directive for federal agencies to patch a high-severity vulnerability in GeoServer that is actively being exploited. GeoServer is an open-source server for sharing geospatial data, widely used in government and enterprise environments. Although specific technical details and affected versions are not provided, the active exploitation and CISA's involvement indicate a significant risk to confidentiality, integrity, and availability of affected systems. No known public exploits have been confirmed yet, but the threat is considered high priority. European organizations using GeoServer, especially in government, urban planning, and critical infrastructure sectors, face potential risks from this flaw. Immediate patching and monitoring are essential to mitigate potential impacts. Countries with strong adoption of geospatial technologies and critical infrastructure reliance on GeoServer are most at risk. The threat severity is assessed as high due to active exploitation, potential for broad impact, and critical nature of affected data. Defenders should prioritize patch deployment, enhance network monitoring for suspicious activity, and review access controls to GeoServer instances.

News#infosecnews#redditGermany+7

A sophisticated Android malware campaign distributes a malicious 'RTO Challan / e-Challan' APK via WhatsApp, targeting users with a fraudulent payment app. The malware employs advanced obfuscation and hidden installation techniques to maintain persistence and control over infected devices. It establishes a custom VPN tunnel to conceal network traffic and harvests extensive personal, device, and financial data. Key capabilities include OTP interception, call behavior manipulation, and presenting fake payment interfaces to steal banking credentials. The command-and-control infrastructure uses obfuscated Base64-encoded URLs linked to malicious domains. This campaign combines social engineering, mobile malware, and financial fraud, posing a significant risk of monetary loss and identity theft. Although no CVSS score is assigned, the threat severity is assessed as high due to the impact and exploitation ease. European organizations with Android users, especially those using WhatsApp and mobile banking, should be vigilant. Mitigation requires targeted user awareness, mobile security hygiene, and network monitoring for suspicious VPN tunnels and domain connections.

Malware#social engineering#apkGermany+9