Fortinet has disclosed critical authentication bypass vulnerabilities affecting FortiCloud's Single Sign-On (SSO) login mechanism. These flaws allow attackers to circumvent authentication controls, potentially gaining unauthorized access to FortiCloud management interfaces without valid credentials. Although no known exploits are currently observed in the wild, the critical severity rating underscores the urgency for organizations to address these issues promptly. The vulnerabilities impact the confidentiality and integrity of cloud-managed Fortinet devices and services, posing significant risks to network security. European organizations relying on FortiCloud for centralized device management and SSO are particularly at risk. Mitigation requires immediate application of vendor patches once available, strict monitoring of FortiCloud access logs, and implementing compensating controls such as multi-factor authentication and network segmentation. Countries with high Fortinet market penetration and critical infrastructure deployments, including Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected. Given the ease of exploitation without authentication and the broad impact on cloud-managed security infrastructure, the suggested severity is critical. Defenders must prioritize patch management and enhance monitoring to prevent potential unauthorized access and lateral movement within networks.
The Broadside botnet is a malware campaign targeting TBK brand DVR devices, raising concerns particularly for maritime logistics sectors that rely on these devices. This botnet infects vulnerable DVRs to conscript them into a larger network of compromised devices, potentially enabling distributed denial-of-service (DDoS) attacks or other malicious activities. Although no known exploits are currently active in the wild, the threat is considered medium severity due to the potential impact on maritime operations and critical infrastructure. The botnet's focus on TBK DVRs, which are commonly used in maritime logistics for surveillance and monitoring, highlights a strategic targeting of supply chain and port security systems. European organizations involved in maritime transport and port operations could face operational disruptions and data confidentiality risks if infected. Mitigation requires targeted actions such as network segmentation of DVR devices, strict access controls, firmware updates where available, and enhanced monitoring for unusual network traffic patterns. Countries with significant maritime trade and port infrastructure, such as the Netherlands, Germany, Belgium, Spain, and Italy, are most likely to be affected. Given the medium severity, the threat demands proactive defense measures but does not currently indicate widespread exploitation or critical system compromise. Defenders should prioritize securing TBK DVR devices and related maritime logistics systems to prevent botnet infiltration and potential service disruptions.
Ransomware IAB is a newly reported malware strain that abuses Endpoint Detection and Response (EDR) solutions to execute its payload stealthily, evading traditional detection mechanisms. By leveraging the trust and elevated privileges of EDR software, the ransomware can bypass security controls and maintain persistence on infected systems. Although no known exploits are currently observed in the wild, the technique represents a sophisticated escalation in ransomware tactics. European organizations relying heavily on EDR solutions for endpoint security may face increased risk due to this stealthy execution method. The threat is assessed as high severity given its potential to compromise confidentiality, integrity, and availability without requiring user interaction. Mitigation requires advanced monitoring of EDR behavior, strict application control policies, and rapid incident response capabilities. Countries with high adoption of EDR technologies and critical infrastructure sectors are most likely to be targeted. Immediate attention to this emerging threat is recommended to prevent impactful ransomware incidents in Europe.
The GeminiJack 0-Click flaw in Gemini AI is a recently disclosed vulnerability that allows data leaks without any user interaction. This zero-click nature means attackers can exploit the flaw remotely and silently, potentially accessing sensitive user data. Although no known exploits are currently observed in the wild, the medium severity rating suggests moderate risk. The vulnerability affects Gemini AI, a product whose market penetration and deployment details remain unclear. European organizations using Gemini AI or related services could face confidentiality breaches if targeted. Mitigation is complicated by the absence of patches or detailed technical disclosures, requiring heightened monitoring and cautious data handling. Countries with advanced AI adoption and critical infrastructure relying on Gemini AI are more likely to be impacted. Given the zero-click exploit vector and data exposure potential, the threat is assessed as medium severity. Defenders should prioritize detection capabilities and restrict unnecessary data exposure until official patches are available.
STAC6565 is a threat actor group deploying the QWCrypt ransomware, with a strong focus on Canadian targets, accounting for 80% of observed attacks. The ransomware campaign, attributed to the Gold Blade group, represents a high-severity threat due to its potential to disrupt operations and cause data loss. While currently primarily targeting Canada, the ransomware's capabilities and tactics could pose risks to European organizations, especially those with cross-border ties or similar infrastructure. No known exploits or patches are available yet, and minimal public technical details limit immediate defensive measures. European entities should be vigilant, particularly in sectors with Canadian connections or similar vulnerabilities. Proactive monitoring for ransomware indicators and strengthening incident response plans are critical. Countries with strong trade or digital ties to Canada, or with significant ransomware incident histories, are at higher risk. Given the ransomware's impact potential and ease of deployment by threat actors, the suggested severity is high. Defenders should prioritize threat intelligence sharing and implement advanced endpoint detection and response solutions to mitigate risks.
The US seeks information on the leader of Emennet Pasargad, Mohammad Bagher Shirinkar, and long-time employee Fatemeh Sedighian Kashi. The post US Posts $10 Million Bounty for Iranian Hackers appeared first on SecurityWeek .
The botnet attempts to steal credentials from infected TBK DVR devices, in addition to abusing them to launch DDoS attacks. The post New ‘Broadside’ Botnet Poses Risk to Shipping Companies appeared first on SecurityWeek .
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.
JS#SMUGGLER is a threat actor or campaign leveraging compromised legitimate websites to deliver the NetSupport Remote Access Trojan (RAT). The attack involves injecting malicious JavaScript payloads into trusted sites, which then silently deploy NetSupport RAT onto victims' systems. This RAT enables attackers to gain persistent remote access, potentially leading to data theft, espionage, or further network compromise. The threat is considered high severity due to the use of trusted sites for delivery, the capabilities of NetSupport RAT, and the stealthy infection vector. European organizations relying on web traffic from compromised sites are at risk, especially those with remote workforce or critical infrastructure. Mitigation requires proactive monitoring of web assets, enhanced endpoint detection, and network segmentation to limit RAT impact. Countries with high internet usage, significant remote workforces, and strategic industries are more likely targets. Given the ease of exploitation via compromised sites and the high impact on confidentiality and integrity, the threat is assessed as high severity. Defenders should prioritize detection of unusual RAT activity and patch any web application vulnerabilities that could lead to site compromise.
Cybercriminals are increasingly manipulating online photos to fabricate virtual kidnapping scenarios, demanding ransoms from victims or their families. This social engineering tactic leverages altered images to create believable threats without physical abduction. The FBI has highlighted this emerging trend, emphasizing the psychological pressure on victims. Although no direct software vulnerabilities are exploited, the threat exploits human trust and fear. European organizations and individuals may face increased targeting due to widespread social media use and digital photo sharing. The threat's medium severity reflects its significant impact on confidentiality and integrity of personal safety perceptions, despite lacking technical exploitation. Mitigation requires enhanced public awareness, verification protocols, and law enforcement collaboration. Countries with high social media penetration and affluent populations are more vulnerable. This threat underscores the evolving nature of cybercrime blending digital manipulation with psychological tactics.
The article '10 (Not So) Hidden Dangers of Age Verification' highlights significant privacy and security risks associated with age verification systems. These systems, often mandated to restrict access to age-restricted content, can inadvertently expose sensitive personal data, increase surveillance risks, and create new attack surfaces. The dangers include data breaches, identity theft, and misuse of biometric or government-issued ID data. European organizations implementing such systems must carefully consider data protection regulations like GDPR and the potential reputational damage from mishandling sensitive information. Mitigation requires adopting privacy-preserving verification methods, minimizing data collection, and ensuring robust encryption and secure storage. Countries with high digital service adoption and strict age verification laws, such as Germany, France, and the UK, are particularly at risk. Given the medium severity, the threat primarily impacts confidentiality and privacy, with moderate ease of exploitation due to reliance on third-party verification services. Defenders should prioritize privacy-centric designs and compliance with European data protection standards.
The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .
Ransomware payments reached the highest level in 2023, at $1.1 billion paid in 1,512 reported incidents. The post Ransomware Payments Surpassed $4.5 Billion: US Treasury appeared first on SecurityWeek .
A side-channel tracking technique leveraging WhatsApp and Signal allows an attacker to infer a target phone's device activity state (screen on/off, offline) by sending silent probe reactions to invalid message IDs and measuring delivery receipt round-trip times. This method does not generate visible notifications or messages on the victim's device, making it stealthy. Over time, attackers can profile user behavior such as when they are home, sleeping, or mobile. The attack requires the ability to send messages to the target number, which can be mitigated by restricting unknown contacts in privacy settings. Although no direct data breach occurs, this privacy-invasive tracking poses significant risks. The threat is relevant to European users given WhatsApp and Signal's widespread adoption. No known exploits in the wild exist yet, but the proof-of-concept is publicly available.
A security news report highlights the patching of firmware vulnerabilities in pulse oximeters, medical devices used to monitor blood oxygen levels. While no specific vulnerabilities or exploits are detailed, the discussion emphasizes the importance of firmware updates to address potential security risks. There are no known exploits in the wild, and the threat currently has minimal public discussion. The medium severity rating suggests moderate risk, likely due to the critical nature of medical devices and potential impacts on device integrity and patient safety. European healthcare providers using affected pulse oximeters should prioritize firmware updates once available. The threat is more relevant to countries with advanced healthcare infrastructure and significant use of such medical devices. Given the lack of detailed technical data and exploit evidence, the overall risk is assessed as medium. Defenders should monitor for official patches and verify device firmware integrity to mitigate potential risks.
CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.
Chinese state-sponsored hackers have developed and deployed a new malware family named BRICKSTORM targeting VMware systems. The malware appears to be designed for espionage or sabotage against virtualized environments, potentially compromising confidentiality and availability of critical infrastructure. Although no specific affected VMware versions or exploits in the wild have been confirmed, the threat is credible given the actor's sophistication and targeting of virtualization platforms. European organizations relying on VMware virtualization for critical workloads could face risks including data breaches, system disruption, and operational downtime. Mitigation requires enhanced monitoring of VMware environments, strict network segmentation, and rapid incident response capabilities. Countries with high VMware adoption and strategic geopolitical interest in China-related cyber activities are most at risk. The threat is assessed as medium severity due to limited current exploitation evidence but significant potential impact if leveraged. Defenders should prioritize detection of unusual VMware activity and apply VMware security best practices to reduce exposure.
GOLD BLADE, a threat group previously focused on cyberespionage, has evolved into a hybrid operation combining data theft with selective ransomware deployment. The group has refined its intrusion methods, shifting from traditional phishing to abusing recruitment platforms for delivering weaponized resumes. Their operations follow cycles of dormancy and sudden activity bursts, introducing new tradecraft in each wave. GOLD BLADE has modified its RedLoader infection chain multiple times, implemented a Bring Your Own Vulnerable Driver approach, and developed a custom ransomware called QWCrypt. The group's targeting has narrowed to focus primarily on Canadian organizations across various sectors. Their sophisticated tactics and continual refinement demonstrate a level of operational maturity uncommon among financially motivated actors.
