Threats affecting Belgium

In the Microsoft Windows ecosystem, DLLs (Dynamic Load Libraries) are PE files like regular programs. One of the main differences is that they export functions that can be called by programs that load them. By example, to call RegOpenKeyExA(), the program must first load the ADVAPI32.dll. A PE files has a lot of headers (metadata) that contain useful information used by the loader to prepare the execution in memory. One of them is the EntryPoint, it contains the (relative virtual) address where the program will start to execute.

News#windowsGermany+9

In 2022, LastPass experienced a significant data breach impacting approximately 1.6 million users, leading to a regulatory fine by UK authorities. The breach exposed sensitive user data, raising concerns about confidentiality and user trust. Although no known exploits are currently active in the wild, the incident highlights vulnerabilities in password management services. European organizations relying on LastPass for credential management face potential risks of credential theft and subsequent unauthorized access. The breach underscores the importance of robust security controls around password vaults and multi-factor authentication. UK regulators' enforcement actions signal increased scrutiny on data protection compliance. Organizations should review their use of password managers, enforce strict access controls, and monitor for suspicious activities. The breach severity is assessed as high due to the sensitivity of compromised data and potential for widespread impact. Countries with high LastPass adoption and stringent data protection laws are most likely to be affected.

Breach#infosecnews#redditGermany+6

The hack of 120 000 IP cameras across South Korea led to the production and sale of sexually explicit footage. We break down how IP cameras work — and how to secure them.

BreachGermanyFrance+9

DroidLock is a newly identified Android malware that locks users out of their devices while covertly spying on them using the front camera. It represents a dual-threat by combining ransomware-like device lockdown with privacy invasion through unauthorized camera access. Although no known exploits are currently active in the wild, the malware's capabilities pose significant risks to user confidentiality and device availability. The malware's infection vector and affected Android versions remain unspecified, complicating detection and mitigation efforts. European organizations with Android-dependent mobile workforces could face operational disruptions and privacy breaches if targeted. Mitigation requires enhanced mobile security hygiene, including restricting app permissions, deploying mobile threat defense solutions, and educating users about suspicious apps. Countries with high Android adoption and significant mobile workforce reliance, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the malware’s ability to lock devices and spy without user consent, and the lack of authentication or user interaction barriers, the threat severity is assessed as high. Defenders should prioritize monitoring for unusual device lock behavior and unauthorized camera usage to detect potential infections early.

Malware#infosecnews#redditGermany+7

WIRTE is a malware campaign that uses AshenLoader sideloading techniques to deploy the AshTag espionage backdoor. This attack vector involves abusing AshenLoader, a known malware loader, to stealthily install AshTag, which is designed for espionage activities. The threat is considered high severity due to its potential for covert data exfiltration and persistence within targeted environments. Although no known exploits in the wild have been reported yet, the combination of loader sideloading and a backdoor indicates a sophisticated threat. European organizations, especially those in critical infrastructure and government sectors, could face significant risks from espionage and data breaches. Mitigation requires advanced detection of loader sideloading behaviors and thorough endpoint monitoring. Countries with high adoption of Windows environments and strategic geopolitical importance are most at risk. The threat is assessed as high severity given its espionage nature, ease of sideloading exploitation, and potential impact on confidentiality and integrity without requiring user interaction. Defenders should prioritize monitoring for AshenLoader activity and implement strict application control policies to prevent unauthorized DLL sideloading.

Malware#infosecnews#redditGermany+7

Ashen Lepus, a Hamas-affiliated threat group, has developed a new malware suite named AshTag targeting governmental and diplomatic entities primarily in the Middle East, with recent expansion to Oman and Morocco. The malware employs a sophisticated multi-stage infection chain using decoy PDFs and RAR archives to deliver payloads. AshTag features enhanced custom payload encryption, infrastructure obfuscation, and in-memory execution to evade detection. The group updated its command and control (C2) infrastructure to blend with legitimate traffic, complicating network defense efforts. This espionage campaign focuses on intelligence gathering from diplomatic and governmental targets. Although no known exploits are reported in the wild, the malware leverages multiple advanced techniques including process injection, persistence mechanisms, and credential harvesting. The threat poses a medium severity risk due to its targeted nature, complexity, and potential impact on confidentiality and integrity of sensitive information. European organizations with diplomatic ties or interests in the Middle East should be vigilant, especially in countries with strategic geopolitical connections to the region. Mitigation requires tailored detection of multi-stage infection vectors, enhanced network traffic analysis for C2 anomalies, and strict email attachment policies. Countries like France, Germany, and the UK are more likely to be affected due to their diplomatic presence and intelligence interests in the Middle East.

Malware#espionage#ashenorchestratorFrance+6

GOLD SALEM is a financially motivated cybercrime group deploying Warlock ransomware through sophisticated tradecraft, including exploiting SharePoint vulnerabilities for initial access. Over six months and 11 incidents, they targeted IT, industrial, and technology sectors using ransomware variants such as Warlock, LockBit, and Babuk. Their operations involve advanced techniques like zero-day exploitation and repurposing legitimate tools (Velociraptor, VMTools AV killer, Cloudflared) to evade detection and maintain persistence. Executables are often named after victim organizations, indicating targeted attacks. While evidence suggests possible Chinese origins, the group primarily pursues financial gain. The threat poses a medium severity risk but demonstrates capabilities that could escalate impact if defenses are weak. European organizations in critical infrastructure and technology sectors should be vigilant against these tactics.

Malware#lockbit#cybercrimeGermany+9

DroidLock is a newly identified Android malware that locks infected devices and demands a ransom to restore access. It operates by taking control of the device's lock screen, effectively denying user access until payment is made. Although no specific affected Android versions are listed, the malware targets mobile users broadly. There are currently no known exploits in the wild beyond initial reports, and technical details remain limited. The malware represents a high-severity threat due to its potential to disrupt device availability and extort users. European organizations with employees using Android devices for business risk operational disruption and data access issues. Mitigation requires proactive mobile device management, user education on avoiding suspicious apps, and rapid incident response capabilities. Countries with high Android adoption and significant mobile workforce presence, such as Germany, France, the UK, Italy, and Spain, are most likely to be impacted. Given the ransomware nature, ease of exploitation via social engineering or malicious apps, and significant impact on availability and confidentiality, the threat severity is assessed as high. Defenders should prioritize detection of suspicious lock screen behavior and ensure robust backup and recovery procedures for mobile endpoints.

Malware#infosecnews#redditGermany+7

Over 10,000 Docker Hub container images have been discovered to contain embedded credentials and authentication keys, posing a significant security risk. These leaked secrets can enable attackers to gain unauthorized access to cloud services, internal systems, or other sensitive resources. The exposure stems from developers inadvertently including sensitive information within container images pushed to public repositories. European organizations using Docker containers from public registries are at risk of compromise if they deploy or use these vulnerable images. The threat is particularly relevant to industries with heavy container adoption and cloud reliance. Mitigation requires scanning container images for secrets before deployment, enforcing strict secret management policies, and using private registries with access controls. Countries with large cloud and container ecosystems, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation and potential for significant confidentiality and integrity breaches, this threat is assessed as high severity. Defenders must prioritize secret scanning and credential rotation to reduce exposure.

News#infosecnews#redditGermany+5

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

A sophisticated adversary-in-the-middle phishing campaign targets Microsoft 365 and Okta users by exploiting single sign-on (SSO) flows. Attackers use lookalike domains and malicious JavaScript injections to steal credentials and session tokens, bypassing multi-factor authentication. Initial access is gained through phishing emails themed around compensation and benefits, sent via compromised mailboxes and Amazon SES. The phishing infrastructure is hosted on Cloudflare, enhancing resilience and evasion. This campaign specifically targets organizations relying on Okta as an identity provider for Microsoft 365, enabling session hijacking and credential theft. The threat poses a medium severity risk due to its complexity and potential impact on confidentiality and integrity. European organizations using these platforms are at risk, especially in countries with high adoption of Microsoft 365 and Okta. Mitigation requires targeted user training, domain monitoring, and enhanced detection of anomalous authentication flows. No CVSS score is available; however, the threat is assessed as high severity given the bypass of MFA and session hijacking capabilities.

Campaign#phishing#adversary-in-the-middleGermany+6

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

North Korean threat actors have been observed deploying EtherRAT malware through exploits targeting the React2Shell vulnerability. EtherRAT is a remote access trojan capable of data exfiltration and system control. The React2Shell vulnerability allows attackers to execute arbitrary code on affected systems, facilitating malware deployment without user interaction. Although no confirmed exploits in the wild have been reported yet, the combination of a known exploit vector and a sophisticated RAT indicates a credible medium-level threat. European organizations using vulnerable software stacks could face risks to confidentiality and integrity if targeted. Mitigation requires proactive patching of React2Shell vulnerabilities and enhanced network monitoring for unusual RAT activity. Countries with high adoption of affected technologies and strategic importance in geopolitical contexts are more likely to be targeted. Given the ease of exploitation and potential impact, the threat severity is assessed as medium. Defenders should prioritize vulnerability management and incident detection to reduce exposure.

Malware#infosecnews#redditGermany+7

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

MalwareGermanyFrance+8

A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy AMOS, a multi-stage malware that harvests credentials, escalates privileges, and establishes persistence. The attack bypasses traditional security measures by leveraging legitimate platforms and user behavior, making it particularly insidious. AMOS targets cryptocurrency wallets, browser data, and system information, exfiltrating sensitive data to attacker-controlled servers. This campaign represents a significant evolution in social engineering techniques, exploiting the growing reliance on AI assistants for technical guidance.

Malware#chatgpt#persistenceGermany+9

The DeadLock ransomware campaign employs a new Bring Your Own Vulnerable Driver (BYOVD) loader exploiting CVE-2024-51324, a vulnerability in Baidu Antivirus driver, to evade endpoint detection and response (EDR) tools. Attackers use PowerShell scripts to bypass User Account Control (UAC), disable Windows Defender, terminate security services, and delete volume shadow copies, facilitating ransomware deployment. DeadLock ransomware targets Windows systems with a custom stream cipher encryption using time-based cryptographic keys, employing advanced techniques such as recursive directory traversal, memory-mapped file I/O, and multi-threaded processing. Initial access is gained through compromised accounts, followed by system registry modifications, remote access establishment, reconnaissance, lateral movement, and defense impairment. Although no known exploits are currently in the wild, the sophisticated use of BYOVD and defense evasion techniques poses a significant threat to organizations. The attack complexity and multi-stage process highlight the need for targeted mitigation strategies. This threat is particularly relevant to European organizations using Baidu Antivirus or similar vulnerable drivers and those with Windows-based infrastructure. The suggested severity is high due to the potential for widespread impact, ease of defense evasion, and the ransomware’s destructive capabilities.

EPSS 0.5%Malware#deadlock#edr evasionGermany+9

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.

Campaign#domain spoofing#fileless executionGermany+9

This offering provides free honey tokens such as AWS access keys, SSH private keys, and S3 bucket tokens designed to detect unauthorized access and breaches by alerting defenders when these tokens are used. The tokens are intended to be planted in locations where attackers might find them, such as hardcoded credentials in code repositories or backup folders. When an adversary uses these tokens, the platform sends alerts with detailed metadata including source IP, geolocation, and VPN/proxy detection. This approach leverages deception technology to identify attackers early in their reconnaissance or exploitation phases. While the service is free with limited tokens, it uses the same detection pipeline as the paid version, aiming to provide effective breach detection without signup friction. The threat is not a direct vulnerability or malware but a detection mechanism to expose attacker activity. European organizations can benefit from deploying such tokens to detect lateral movement or credential theft, especially in cloud environments. Countries with high cloud adoption and significant AWS usage are most likely to benefit. The severity is assessed as high due to the potential to detect critical breaches early, though it requires proactive deployment and monitoring by defenders.

Malware#netsec#redditGermany+7

Britain and its allies face escalating “hybrid threats … designed to weaken critical national infrastructure, undermine our interests and interfere in our democracies.” The post UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare appeared first on SecurityWeek .

NewsGermanyFrance+8

The Spiderman Phishing Kit is a newly identified phishing toolkit targeting European banks, designed to steal user credentials in real-time. It enables attackers to capture login details as victims interact with fake banking websites. The kit is reported via Reddit and linked from a cybersecurity news source, indicating emerging threat activity but with minimal current discussion or exploitation evidence. This phishing campaign focuses on European financial institutions, potentially impacting customer data confidentiality and banking operations. The attack requires user interaction, typically through deceptive emails or messages leading to fraudulent sites. No known exploits or patches exist yet, and the threat is assessed as medium severity due to its targeted nature and real-time credential theft capability. European organizations, especially banks and their customers, should be vigilant and implement specific anti-phishing controls. Countries with significant banking sectors and high internet banking adoption are more likely to be targeted. Immediate mitigation includes enhanced email filtering, user awareness training, and multi-factor authentication enforcement. Given the lack of CVSS score, the threat is assessed as medium severity considering the impact on confidentiality and the need for user interaction for exploitation.

Phishing#infosecnews#redditGermany+7