A threat actor exploited a vulnerability, exfiltrated data, and attempted to extort Eurofiber. The post Data Stolen in Eurofiber France Hack appeared first on SecurityWeek .
Dutch police have seized 250 servers used by a bulletproof hosting service, disrupting infrastructure that cybercriminals rely on for resilient, abuse-resistant hosting. Bulletproof hosting providers typically enable malicious actors to operate phishing sites, malware distribution, and other illicit activities with reduced risk of takedown. While this action does not represent a direct vulnerability or exploit, it significantly impacts cybercrime operations by removing critical hosting resources. European organizations may benefit from reduced exposure to certain threats hosted on these servers, though attackers may migrate to other providers. The seizure highlights law enforcement's increasing capability to target cybercrime infrastructure. Mitigation for organizations includes enhanced monitoring for malicious domains and IPs linked to bulletproof hosting and collaboration with law enforcement. Countries with high cybercrime activity and significant hosting infrastructure, such as the Netherlands, Germany, and the UK, are most relevant in this context. The severity of this event is assessed as medium, given its indirect but meaningful impact on cyber threat landscape and no direct exploitation vector. Defenders should note this development as a positive disruption to cybercrime hosting but remain vigilant for shifts in attacker infrastructure.
Princeton University has disclosed a data breach impacting its donors and alumni, exposing sensitive personal information. The breach was recently reported and is considered high priority due to the nature of the data involved. Although no specific technical details or exploited vulnerabilities have been publicly shared, the incident highlights risks to confidentiality and privacy. There is no evidence of known exploits in the wild related to this breach. European organizations connected to educational institutions or donor management systems should be aware of similar risks. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and improving incident response. Countries with strong academic ties to Princeton or significant donor communities may be more concerned. The severity is assessed as high given the potential impact on personal data confidentiality and the trust implications. Defenders should prioritize reviewing access controls, encryption practices, and communication protocols with stakeholders. This breach underscores the ongoing threat to institutions holding sensitive personal data.
Eurofiber France has publicly warned of a data breach after a hacker attempted to sell stolen customer data. The breach involves unauthorized access to sensitive customer information, raising concerns about confidentiality and potential misuse. Although no specific technical details or exploited vulnerabilities have been disclosed, the incident highlights risks to data privacy and organizational reputation. There is no evidence of widespread exploitation or known active exploits in the wild at this time. European organizations, especially those in France and neighboring countries, should be vigilant due to the potential exposure of critical infrastructure customer data. Immediate actions to verify system integrity and enhance monitoring are recommended. The breach underscores the importance of robust access controls and incident response capabilities. Given the high severity rating and the nature of the data involved, this incident demands urgent attention to mitigate further risk. Defenders should prioritize containment, forensic analysis, and communication with affected stakeholders.
The Pennsylvania Attorney General's office confirmed a data breach resulting from a ransomware attack attributed to the INC Ransom group. This incident involved unauthorized access to sensitive data, impacting the confidentiality of information held by a key governmental entity. The attack highlights the ongoing threat posed by ransomware campaigns targeting public sector organizations. Although no specific technical details or exploited vulnerabilities have been disclosed, the breach underscores the risk of ransomware actors gaining access to critical systems and exfiltrating data. European organizations, especially governmental and public institutions, face similar risks from ransomware groups employing data theft and extortion tactics. The attack's high severity reflects the potential for significant operational disruption and reputational damage. Mitigation requires tailored defenses including enhanced network segmentation, proactive threat hunting, and robust incident response planning. Countries with strong public sector digital infrastructures and geopolitical interest in US-related cyber threats, such as the UK, Germany, and France, may be more likely to face similar ransomware threats. Given the high impact on confidentiality and the nature of ransomware attacks, the suggested severity is high.
The Everest ransomware group claims to have stolen data belonging to millions of Under Armour customers along with 345GB of internal company records. This incident involves a significant data breach combined with ransomware activity, where sensitive customer and corporate data have been exfiltrated. Although no CVSS score is provided, the threat is assessed as medium severity due to the impact on confidentiality and potential reputational damage. There is no indication of known exploits in the wild or specific affected software versions. European organizations, particularly those in countries with strong retail and sportswear markets, could be indirectly impacted through supply chain or customer data exposure. Mitigation should focus on enhancing data protection, monitoring for ransomware indicators, and ensuring robust incident response plans. Countries like Germany, the UK, France, Italy, and Spain are most likely to be affected due to their market size and economic ties with global retail brands. The threat does not require user interaction for data theft but likely involves some level of initial access, making it moderately difficult to exploit. Defenders should prioritize data encryption, network segmentation, and continuous monitoring to reduce risk.
The EchoGram flaw is a recently disclosed vulnerability that allows attackers to bypass guardrails implemented in major large language models (LLMs). This bypass enables the LLMs to generate outputs that would normally be restricted by safety and content moderation filters. Although no known exploits are currently in the wild, the flaw poses a medium-level risk due to its potential to facilitate malicious use of LLMs. The vulnerability does not have detailed technical disclosures or patch information yet, limiting immediate mitigation options. European organizations using LLMs for customer interaction, content generation, or automation could face risks related to misinformation, policy violations, or reputational damage. Countries with high adoption of AI technologies and strict regulatory environments are particularly at risk. Mitigation should focus on enhanced monitoring of LLM outputs, restricting sensitive use cases, and collaborating with vendors for updates. Given the medium severity, the threat requires attention but is not immediately critical. Defenders should prioritize awareness and prepare for potential future exploits as more details emerge.
Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, Erick Ntekereze, and Oleksandr Didenko have pleaded guilty. The post 5 Plead Guilty in US to Helping North Korean IT Workers appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 17th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cl0p’s Oracle E-Business Suite (CVE-2025-61882) zero-day campaign continues to expand. There are new confirmed breaches at The Washington Post, Logitech, Allianz UK, and GlobalLogic, as well as a newly listed but unconfirmed […] The post 17th November – Threat Intelligence Report appeared first on Check Point Research .
AIPAC has disclosed a data breach affecting hundreds of individuals, as reported by a recent news article sourced from Reddit's InfoSec community. The breach involves unauthorized access to sensitive data, though specific technical details and exploited vulnerabilities remain undisclosed. No known exploits are currently reported in the wild, and the discussion around the incident is minimal. The breach is assessed as high severity due to the potential exposure of sensitive information and the organization's profile. European organizations may face indirect impacts, especially those collaborating with or connected to AIPAC or similar entities. Mitigation focuses on enhanced monitoring, incident response readiness, and data protection strategies. Countries with significant diplomatic, political, or advocacy ties to AIPAC or with high cybersecurity awareness are more likely to be affected or targeted for related attacks. Given the lack of detailed technical information, the threat is rated as high severity based on potential confidentiality and integrity impacts, ease of exploitation inferred from the breach occurrence, and the scope involving hundreds of affected individuals.
Logitech has confirmed a data breach resulting from a ransomware extortion campaign conducted by the Clop threat group. The attackers gained unauthorized access to Logitech's systems and exfiltrated sensitive data, which they are using to extort the company. Although no detailed technical specifics or affected product versions have been disclosed, the breach highlights the ongoing risk posed by ransomware groups targeting large multinational corporations. European organizations using Logitech products or collaborating with Logitech may face indirect risks from data exposure or supply chain impacts. The breach underscores the importance of robust cybersecurity measures, including network segmentation, incident response readiness, and monitoring for extortion attempts. No known exploits or patches are currently available, and the attack appears to be a targeted campaign rather than widespread exploitation. Given the high-profile nature of Logitech and the involvement of Clop, this incident is considered a high-severity threat with potential confidentiality and reputational impacts. European countries with significant Logitech market presence and critical infrastructure sectors are particularly at risk of secondary effects. Organizations should proactively review their exposure and strengthen defenses against ransomware and data exfiltration threats.
The threat involves evolving impersonation campaigns distributing the Gh0st RAT malware, a remote access trojan known for stealthy espionage and data exfiltration. Attackers use digital doppelganger techniques to mimic legitimate entities, increasing the likelihood of successful phishing and social engineering. Although no specific affected versions or exploits in the wild are reported, the campaign's medium severity reflects the potential for significant confidentiality and integrity impacts. European organizations, especially those in critical infrastructure and government sectors, face elevated risks due to targeted espionage motives. Mitigation requires tailored detection of impersonation tactics, enhanced email filtering, and user training focused on recognizing sophisticated social engineering. Countries with high adoption of targeted software and strategic geopolitical importance, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the malware's capabilities, ease of exploitation via social engineering, and broad potential impact without requiring user authentication but needing user interaction. Defenders should prioritize monitoring for impersonation indicators, deploying endpoint detection for Gh0st RAT behaviors, and enforcing strict access controls to limit lateral movement.
Five individuals in the U. S.have pleaded guilty to assisting North Korean IT workers in infiltrating 136 companies. This operation involved facilitating cyber intrusions attributed to North Korean threat actors targeting a wide range of organizations. The attacks likely aimed at espionage, intellectual property theft, and potential disruption. Although specific technical details of the intrusions are not provided, the scale and coordination indicate a sophisticated threat actor leveraging insider assistance. European organizations could be at risk due to interconnected global supply chains and shared technologies. The threat underscores the importance of monitoring insider threats and nation-state cyber activities. Mitigation requires enhanced vetting, network segmentation, and threat intelligence sharing. Countries with significant technology sectors and geopolitical interest in North Korea are more likely to be targeted.
This report details two interconnected malware campaigns targeting Chinese-speaking users in 2025, using large-scale brand impersonation to deliver Gh0st RAT variants. The first campaign, active from February to March, mimicked three brands across over 2,000 domains. The second campaign, starting in May, impersonated over 40 applications with more sophisticated infection chains. Both campaigns used cloud infrastructure for payload delivery and DLL side-loading for evasion. The adversary demonstrated an evolving operational playbook, advancing from simple droppers to complex multi-stage infections. The campaigns' infrastructure remained active for months, indicating a persistent and well-resourced threat actor focused on Chinese-speaking targets globally.
NotDoor is a backdoor malware leveraging Outlook macros for persistence and lateral movement within compromised environments. It stages files in C:\ProgramData and abuses DLL sideloading via OneDrive.exe to evade detection. The malware executes encoded PowerShell commands, modifies registry keys to enable macros and disable security dialogs, and uses Outlook functions for command-and-control (C2) communication and email monitoring. Detection strategies include monitoring suspicious PowerShell activity, registry changes, and the creation of VbaProject. OTM files by non-Outlook processes. The threat is linked to the APT28 (Fancy Bear) actor and represents a medium-severity risk. European organizations using Microsoft Outlook and OneDrive are potential targets, especially those in critical infrastructure and government sectors. Mitigation requires focused monitoring, macro policy enforcement, and DLL sideloading prevention measures.
CISA has issued a warning about active attacks targeting vulnerabilities in Cisco ASA and Firepower devices. These attacks exploit security flaws in widely deployed Cisco network security products, potentially allowing attackers to compromise network perimeter defenses. Although no known exploits in the wild have been confirmed, the warning indicates active exploitation attempts. The severity is assessed as medium, reflecting the potential impact on confidentiality and availability if successfully exploited. European organizations using Cisco ASA and Firepower appliances should prioritize patching and monitoring to mitigate risks. The threat is particularly relevant to countries with high adoption of Cisco network infrastructure and critical industries relying on robust network security. Immediate mitigation steps include applying vendor patches, enhancing network monitoring for suspicious activity, and restricting management interface access. Given the strategic importance of Cisco devices in European enterprise and government networks, vigilance is essential to prevent disruption or data breaches. The threat does not require user interaction but may require network access, increasing the risk in exposed environments.
The 'SpearSpecter' campaign is a high-severity espionage operation attributed to Iranian threat actors targeting defense and government entities. It involves sophisticated spear-phishing and possibly custom malware to infiltrate sensitive networks. While no specific vulnerabilities or exploits have been publicly disclosed, the campaign's focus on high-value targets indicates a strategic intent to gather intelligence. European defense and government organizations are at risk due to their geopolitical relevance and collaboration with global security partners. The threat actors likely employ stealthy tactics to maintain persistence and evade detection. Mitigation requires enhanced email filtering, network monitoring for anomalous activity, and strict access controls. Countries with significant defense industries and government institutions, such as the UK, Germany, France, and Italy, are most likely to be targeted. Given the campaign's espionage nature, ease of exploitation is moderate but impact on confidentiality is critical. Defenders should prioritize threat intelligence sharing and incident response readiness to counter this evolving threat.
