CISA has issued a warning about active spyware campaigns targeting high-value users of Signal and WhatsApp messaging platforms. These campaigns aim to hijack accounts and compromise communications through sophisticated spyware infections. The threat actors focus on individuals with sensitive or strategic communications, leveraging vulnerabilities or social engineering to deploy spyware. This poses significant risks to confidentiality and privacy, especially for organizations relying on these encrypted messaging services. European organizations using Signal and WhatsApp for secure communications are at risk of espionage and data theft. The campaigns do not currently have known exploits in the wild but are considered high priority due to their targeted nature and potential impact. Mitigation requires enhanced user awareness, strict device hygiene, and monitoring for suspicious activity. Countries with high adoption of these messaging apps and strategic geopolitical interests are most vulnerable. The severity is assessed as high given the potential for significant confidentiality breaches and the difficulty in detecting spyware infections.
A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.
Harvard University has disclosed a data breach impacting its alumni and donors, potentially exposing sensitive personal information. The breach was recently reported and is considered high severity due to the nature of the affected individuals and the sensitivity of the data involved. Although specific technical details and exploited vulnerabilities are not provided, the incident highlights risks to personal data confidentiality and potential misuse. There are no known exploits in the wild related to this breach at this time. European organizations, especially educational institutions and donor-related entities, should be aware of similar risks. Mitigation should focus on strengthening data protection, monitoring for suspicious activity, and enhancing incident response capabilities. Countries with strong academic ties and donor networks to Harvard or similar institutions may be more concerned. The severity is assessed as high due to the breach's impact on confidentiality and the potential for identity theft or fraud. Defenders should prioritize data security audits and communication strategies to affected parties.
Delta Dental of Virginia experienced a data breach impacting 145,918 customers, exposing sensitive personal information. The breach was publicly reported on November 24, 2025, with limited technical details available. Although no known exploits are currently active in the wild, the incident is classified as high severity due to the volume of affected individuals and potential exposure of sensitive data. The breach primarily affects customers in the United States, but European organizations with similar data handling practices should be aware of the risks. The lack of detailed technical information limits precise attribution or attack vector analysis. Organizations should review their data protection measures, especially those handling sensitive health or insurance data, to prevent similar incidents. Enhanced monitoring, incident response readiness, and data encryption are recommended. European countries with significant healthcare and insurance sectors, such as Germany, France, and the UK, should be particularly vigilant. The breach underscores the importance of robust cybersecurity controls in protecting customer data against unauthorized access and exfiltration.
We continue to encounter high-profile vulnerabilities related to the use of URL mapping (or "aliases") with URL-based access control. Last week, we wrote about the Oracle Identity Manager vulnerability. I noticed some scans for an older vulnerability with similar roots today:
The Cl0p ransomware group has listed Mazda and Mazda USA as victims of the Oracle EBS campaign on its leak website. The post Mazda Says No Data Leakage or Operational Impact From Oracle Hack appeared first on SecurityWeek .
More than 1.6 Tb of data allegedly stolen from Cox was made public by the hackers. The post Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. […] The post 24th November – Threat Intelligence Report appeared first on Check Point Research .
A recent report discusses what is described as the first autonomous AI-driven cyberattack, highlighting the urgent need for changes in SaaS security paradigms. The attack reportedly leverages AI capabilities to conduct operations without human intervention, potentially increasing the speed and scale of exploitation. While technical details remain sparse and no known exploits are currently active in the wild, the emergence of autonomous AI attacks signals a shift in threat actor capabilities. European organizations relying heavily on SaaS platforms may face increased risks due to the automation and sophistication of such attacks. Mitigation requires enhanced monitoring for AI-driven anomalies, integration of AI-aware defense mechanisms, and rigorous SaaS security posture management. Countries with significant SaaS adoption and critical infrastructure reliance on cloud services, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the medium severity assessment and lack of exploitation evidence, the threat is serious but not yet critical. Defenders should prioritize understanding AI threat vectors and adapt security controls accordingly.
APT31, a China-linked advanced persistent threat group, has launched stealthy cyberattacks targeting Russian IT infrastructure by leveraging cloud services. These attacks are characterized by their covert nature, aiming to infiltrate and maintain persistence within Russian organizations' networks. Although no specific vulnerabilities or exploits have been publicly detailed, the use of cloud services as an attack vector suggests sophisticated tactics to evade detection and exploit trusted platforms. The threat poses significant risks to confidentiality and integrity of targeted systems, with potential for espionage or disruption. European organizations, especially those with close ties to Russian entities or using similar cloud platforms, could face indirect risks. Mitigation requires enhanced monitoring of cloud service usage, strict access controls, and threat hunting focused on stealthy behaviors. Countries with strong economic or political connections to Russia and high cloud adoption rates are most likely to be affected. Given the stealth, high impact potential, and lack of required user interaction, this threat is assessed as high severity. Defenders should prioritize detection capabilities and inter-organizational information sharing to counter this evolving threat.
APT-C-26 (Lazarus) has conducted a sophisticated attack campaign deploying customized monitoring software disguised as remote IT tools. The malware includes a registration program, daemon process, and DLL, leveraging Windows Shell extensions for persistence and creating a covert remote desktop environment. It employs advanced evasion techniques such as disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data and uploads it to a remote server, enabling persistent surveillance and remote control. This campaign targets various industries globally and is attributed to the North Korean Lazarus group. The attack does not require known exploits but uses stealthy persistence and privilege escalation tactics. European organizations face risks of espionage, data leakage, and operational disruption. Mitigation requires targeted detection of the specific malware components, strict control of remote IT access, and enhanced endpoint monitoring. Countries with high adoption of Windows enterprise environments and strategic industries are most at risk, including Germany, France, the UK, and the Netherlands.
The FCC has rolled back cybersecurity regulations for telecommunications providers, reducing mandated security requirements despite ongoing risks from state-sponsored hacking. This regulatory rollback potentially weakens the security posture of critical telecom infrastructure, which is a vital component of national and international communications. European organizations relying on transatlantic telecom services or interconnected networks may face increased risks due to diminished security standards in US-based telcos. The rollback does not represent a direct vulnerability or exploit but increases systemic risk by lowering baseline protections against sophisticated cyber threats. Mitigation requires European entities to independently enforce stringent security controls and closely monitor telecom service providers' security practices. Countries with strong transatlantic telecom links and high-value targets in finance, government, and critical infrastructure sectors are most at risk. Given the indirect nature of the threat, the suggested severity is medium, reflecting increased exposure but no immediate exploit. Defenders should prioritize supply chain risk management and enhance network monitoring to compensate for reduced regulatory oversight in the US telecom sector.
The ToddyCat APT group has developed advanced tools and techniques to covertly access corporate email data by targeting both on-premises Outlook OST files and Microsoft 365 cloud environments. Their toolkit includes PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and methods to steal OAuth tokens from Microsoft 365 processes. They leverage SMB for remote file access, dump process memory, and search for access tokens to bypass security monitoring. These tactics enable stealthy data theft of sensitive email content and credentials. Detection guidance is available for each technique to help defenders identify and mitigate these intrusions. The threat is assessed as medium severity due to the complexity and targeted nature of the attacks, with no known exploits in the wild yet. European organizations using Microsoft 365 and Outlook are at risk, especially those with valuable email communications and cloud integrations.
APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads. The post Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks appeared first on SecurityWeek .
From time to time, it can be instructive to look at generic phishing messages that are delivered to one's inbox or that are caught by basic spam filters. Although one usually doesn't find much of interest, sometimes these little excursions into what should be a run-of-the-mill collection of basic, commonly used phishing techniques can lead one to find something new and unusual. This was the case with one of the messages delivered to our handler inbox yesterday…
APT24, a Chinese threat actor, has conducted a three-year cyber espionage campaign using BADAUDIO, a highly obfuscated first-stage downloader. The group has evolved from broad strategic web compromises to more sophisticated tactics, including supply chain attacks and targeted phishing. They compromised a Taiwanese digital marketing firm, affecting over 1,000 domains. APT24 uses advanced techniques like control flow flattening, fingerprinting, and covert data exfiltration. The malware integrates with Cobalt Strike Beacon and employs DLL Search Order Hijacking for execution. The campaign demonstrates the actor's persistent and adaptive capabilities, highlighting the growing sophistication of Chinese cyber threats.
The Everest ransomware group claims to have breached Petrobras, a major Brazilian energy company, indicating a significant ransomware attack targeting critical infrastructure. Although details are limited and sourced primarily from Reddit and a news article, the incident highlights the ongoing threat ransomware poses to energy sector organizations globally. The attack could lead to data theft, operational disruption, and financial loss. European energy firms with similar profiles should be vigilant. Mitigation requires enhanced network segmentation, robust backup strategies, and proactive threat hunting. Countries with strong energy sectors and historical ransomware targeting, such as Germany, France, and the UK, are particularly at risk. Given the high potential impact on confidentiality, integrity, and availability, and the likely ease of exploitation by ransomware actors, this threat is assessed as high severity. Defenders must prioritize detection and response capabilities to mitigate potential ransomware intrusions.
APT24, a known advanced persistent threat group, is shifting from traditional watering hole attacks to employing multi-vector attack strategies. This evolution involves leveraging multiple attack vectors simultaneously or sequentially to increase the likelihood of successful compromise. Although no specific vulnerabilities or exploits are detailed, the pivot indicates a more sophisticated and adaptable threat actor. European organizations, especially those in critical infrastructure and government sectors, may face increased risk due to the complexity and persistence of these attacks. The threat does not currently have known exploits in the wild, but the medium severity suggests moderate risk. Mitigation requires enhanced detection capabilities, cross-vector monitoring, and proactive threat hunting tailored to multi-vector tactics. Countries with significant digital infrastructure and geopolitical relevance in Europe, such as Germany, France, and the UK, are likely primary targets. Given the medium severity, the threat impacts confidentiality and integrity with moderate ease of exploitation and no requirement for user interaction. Defenders should focus on improving visibility across multiple attack surfaces and integrating threat intelligence feeds related to APT24 activity.
