A data leak from a Chinese technology firm has reportedly exposed details of state-linked hacking operations. The leak, surfaced via a Reddit post linking to an external news source, suggests that sensitive information about cyber espionage activities tied to a nation-state actor has been compromised. Although the breach is categorized as medium severity and no direct exploits are currently known, the exposure of operational details could enable adversaries to better understand and potentially counter these hacking campaigns. European organizations may face increased risks if targeted by these state-linked actors or if their infrastructure overlaps with the compromised information. Mitigation requires enhanced monitoring for related threat indicators, strengthening incident response capabilities, and reviewing exposure of sensitive operational data. Countries with significant technology sectors, critical infrastructure, or geopolitical interest in China are more likely to be affected. Given the medium severity, the threat poses a moderate risk primarily through intelligence exposure rather than immediate exploitation. Defenders should prioritize intelligence sharing and proactive defense measures to mitigate potential follow-on attacks.
ASUS has disclosed a critical authentication bypass vulnerability affecting its DSL series routers. This flaw allows an attacker to circumvent authentication mechanisms, potentially gaining unauthorized administrative access to the device. Exploitation could lead to full control over the router, enabling attackers to manipulate network traffic, deploy malware, or disrupt services. No known exploits are currently reported in the wild, but the severity and nature of the vulnerability make it a high-risk threat. European organizations using ASUS DSL routers are at risk, especially those in sectors relying heavily on stable and secure network infrastructure. Immediate mitigation steps include monitoring for official patches from ASUS and implementing network-level protections. Countries with significant ASUS router deployments and critical infrastructure reliance are more likely to be targeted. Given the ease of exploitation without authentication and the potential for widespread impact, this vulnerability is assessed as critical severity. Defenders should prioritize identification, patching, and network segmentation to reduce exposure.
The ransomware landscape is experiencing significant fragmentation, complicating defense efforts, while the notorious LockBit ransomware group has reemerged as a prominent threat. This resurgence signals a potential increase in targeted ransomware attacks leveraging LockBit's established infrastructure and tactics. European organizations, especially those in critical infrastructure and high-value sectors, face heightened risks due to LockBit's return and the broader ransomware ecosystem's instability. The fragmentation among ransomware groups may lead to more unpredictable attack vectors and increased competition, potentially escalating ransom demands and attack frequency. Defenders should prioritize monitoring for LockBit indicators, enhance incident response readiness, and implement targeted controls to mitigate ransomware risks. Countries with high digital infrastructure reliance and previous ransomware incidents, such as Germany, France, and the UK, are particularly vulnerable. Given the high impact on confidentiality, integrity, and availability, combined with ease of exploitation and no need for user interaction in some cases, this threat is assessed as high severity. Immediate, specific mitigation steps beyond generic advice are critical to reduce exposure and potential damage.
Yurei ransomware, identified in September 2025, targets corporate networks primarily in transportation, IT, marketing, and food sectors. Developed in Go, it uses strong encryption algorithms ChaCha20-Poly1305 for file encryption and secp256k1-ECIES for key protection. The ransomware excludes certain files and directories to maintain system operability. Each file is encrypted with a unique key and nonce, ensuring only the attacker can decrypt the data. The ransom note threatens data leaks and regulatory notifications if demands are unmet within five days. While currently observed in Sri Lanka and Nigeria, the ransomware’s sophisticated encryption and typical corporate targeting pose a medium-level threat globally. No known exploits in the wild or CVEs exist yet. European organizations should be vigilant due to potential expansion and regulatory impact. Mitigation requires proactive network segmentation, strict access controls, and advanced detection of lateral movement and privilege escalation.
Akira was seen exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files this year. The post Akira Ransomware Group Made $244 Million in Ransom Proceeds appeared first on SecurityWeek .
In October 2025, DoorDash experienced a significant data breach exposing user information. The breach was reported via Reddit's InfoSecNews and covered by a trusted cybersecurity news outlet, BleepingComputer. Although specific technical details and affected versions are not disclosed, the incident is classified as high severity due to the exposure of sensitive user data. No known exploits are currently active in the wild, and discussion around the breach remains minimal. European organizations using DoorDash services could face indirect risks, particularly if user data includes European residents or if DoorDash is integrated into corporate environments. Mitigation focuses on monitoring for suspicious activity, enforcing strong authentication, and preparing incident response plans. Countries with higher DoorDash usage or strategic interest in food delivery platforms, such as the UK, Germany, France, and the Netherlands, are more likely to be impacted. Given the breach's potential impact on confidentiality and the lack of detailed technical information, the suggested severity is high. Defenders should prioritize user notification, credential resets, and enhanced monitoring to mitigate risks stemming from this breach.
A recently patched vulnerability in Fortinet FortiWeb web application firewall products has been actively exploited to create unauthorized administrative accounts. This flaw allows attackers to escalate privileges by injecting admin-level credentials, potentially leading to full control over the affected devices. Although the vulnerability has been patched, exploitation attempts have been observed in the wild, highlighting the urgency for organizations to apply updates. The attack does not require user interaction but may require network access to the FortiWeb management interface. European organizations using FortiWeb appliances are at risk of unauthorized access, data compromise, and disruption of web application security controls. Immediate patching and monitoring for suspicious admin account creation are critical to mitigate this threat. Countries with significant Fortinet market presence and critical infrastructure relying on FortiWeb are particularly vulnerable. Given the ease of exploitation and high impact on confidentiality and integrity, this vulnerability is assessed as high severity. Defenders should prioritize deploying patches, auditing admin accounts, and restricting management interface access to trusted networks.
Following Hurricane Melissa's devastation in Jamaica in October 2025, cybercriminals launched a series of online scams exploiting the disaster. These scams included phishing campaigns, fake charity websites, and fraudulent financial-relief portals impersonating legitimate aid organizations. Attackers used social engineering tactics to prey on victims' compassion and urgency, often deploying scams within hours of the hurricane. A prominent example involved a cryptocurrency donation site with fabricated transaction data and static images to appear authentic. Numerous fraudulent domains soliciting cryptocurrency donations were identified. While primarily targeting individuals, these scams undermine trust in digital charity platforms and complicate legitimate relief efforts. European organizations involved in disaster relief, financial services, or public awareness campaigns should be vigilant. The threat is medium severity due to social engineering reliance and no direct system exploitation. Mitigation requires enhanced awareness, domain monitoring, and collaboration between cybersecurity entities and relief organizations.
A data breach at The Washington Post has compromised sensitive information affecting nearly 10,000 employees and contractors. The breach potentially exposes personal and professional data, raising concerns about identity theft, phishing, and insider threats. Although no specific technical details or exploited vulnerabilities have been disclosed, the incident is classified as high severity due to the scale and sensitivity of the impacted individuals. There is no evidence of active exploitation beyond the breach itself. European organizations should be alert to potential phishing campaigns leveraging the stolen data and review their own security posture against similar threats. Mitigation should focus on enhanced monitoring, employee awareness, and securing identity and access management systems. Countries with significant media presence and digital infrastructure, such as the UK, Germany, and France, may be more sensitive to related secondary threats. The breach underscores the critical need for robust data protection and incident response capabilities in media and related sectors. Given the lack of detailed exploit information, the suggested severity is high due to the breach's scope and potential impact on confidentiality and integrity.
Researchers have demonstrated how malicious extensions can create fake AI sidebars in the Comet and Atlas browsers, and spoof the models' responses. We explain how to avoid becoming a victim.
Scammers are exploiting WhatsApp's screen sharing feature to trick users into revealing one-time passwords (OTPs) and stealing funds. Attackers initiate screen sharing sessions under false pretenses, gaining real-time visibility into sensitive information such as OTPs used for two-factor authentication. This social engineering tactic bypasses technical controls by manipulating user trust and interaction. The threat primarily targets individuals but can have broader implications for organizations relying on WhatsApp for communication or authentication. No direct software vulnerability is exploited; rather, the attack leverages user behavior and the screen sharing capability. The ease of exploitation is moderate, requiring user interaction and deception. European organizations with employees or clients using WhatsApp are at risk, especially in countries with high WhatsApp penetration. Mitigation involves user education, strict policies on screen sharing, and alternative secure authentication methods. The threat is assessed as medium severity due to its impact on confidentiality and potential financial loss, despite requiring user cooperation.
Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .
Synnovis, a pathology services provider, suffered a ransomware attack that disrupted operations at several London hospitals and resulted in the theft of patient information. The attack caused significant operational interruptions in healthcare delivery, impacting critical diagnostic services. Although no specific vulnerability or exploit details have been disclosed, the incident highlights the risk ransomware poses to healthcare infrastructure. There is no evidence of known exploits in the wild or available patches, and the attack appears targeted at healthcare service providers. The breach of patient data raises concerns about confidentiality and regulatory compliance under GDPR. European healthcare organizations should prioritize securing their IT environments to prevent similar disruptions. Mitigation should focus on network segmentation, robust backup strategies, incident response readiness, and enhanced monitoring for ransomware indicators. Given the critical nature of healthcare services and the sensitivity of patient data, the suggested severity of this threat is high. The United Kingdom is the most directly affected country, with potential risks extending to other European nations with similar healthcare service providers and infrastructure. Defenders must be vigilant about ransomware threats targeting healthcare and ensure comprehensive cybersecurity hygiene to mitigate impact.
A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.
When I'm teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[2]. Let's have a look at the infection path.
Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.
NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .
