Threats affecting Belgium

Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.

News#infosecnews#redditGermany+9

SAP addressed a maximum severity vulnerability in its SQL Anywhere Monitor product. The flaw, described as having maximum severity, could potentially allow attackers to compromise affected systems. Although specific technical details and affected versions were not disclosed, the vulnerability is significant enough to warrant urgent attention. No known exploits are currently reported in the wild. The medium severity rating provided may underestimate the risk given the 'maximum severity' description in the title. European organizations using SAP SQL Anywhere Monitor should prioritize patching once updates are available. The threat primarily impacts database monitoring environments, which are critical for operational continuity. Countries with a strong SAP user base and critical infrastructure relying on SAP products are at higher risk. Mitigation involves applying SAP patches promptly, restricting access to monitoring tools, and enhancing network segmentation. Given the potential impact on confidentiality, integrity, and availability, and the lack of detailed exploitation requirements, the suggested severity is high.

News#infosecnews#redditGermany+7

Synology recently addressed multiple zero-day vulnerabilities in its BeeStation product that were publicly demonstrated at the Pwn2Own Ireland security competition. These zero-days represent critical security flaws that could allow attackers to compromise affected systems. Although no known exploits are currently active in the wild, the public disclosure increases the urgency for organizations to apply patches promptly. The vulnerabilities could impact confidentiality, integrity, and availability of data managed by BeeStation, a platform often used for storage and collaboration. European organizations using Synology BeeStation should prioritize remediation to mitigate potential exploitation risks. The threat is rated high severity due to the nature of zero-day exploits and the potential for significant operational disruption. Countries with high adoption of Synology products and strategic data infrastructure are at greater risk. Immediate mitigation involves applying vendor patches once available, restricting network access to BeeStation services, and monitoring for suspicious activity. This threat highlights the importance of proactive vulnerability management and rapid response to zero-day disclosures.

News#infosecnews#redditGermany+7

ThreatFox IOCs for 2025-11-12

Indicator#type:osint#tlp:whiteGermany+9

A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.

Campaign#phishing#domain registrationGermany+9

A recent ransomware attack attributed to the RansomHub group was uncovered following an unusual CPU spike detected in a system. The attack involves ransomware that encrypts data and demands payment for decryption keys, posing a significant threat to affected organizations. Although no specific affected software versions or exploits in the wild have been reported, the high severity rating indicates a serious risk. European organizations, especially those with critical infrastructure or high-value data, could face operational disruption and financial losses. Mitigation requires proactive monitoring of system performance anomalies, robust endpoint protection, network segmentation, and incident response readiness. Countries with high adoption of vulnerable systems and strategic importance in sectors like finance, manufacturing, and healthcare are more likely to be targeted. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through typical ransomware infection vectors, and no need for user interaction beyond initial compromise, the threat severity is assessed as high. Defenders should prioritize detection of abnormal resource usage patterns and maintain updated backups to mitigate potential damage.

Malware#infosecnews#redditGermany+9

Prompt injection vulnerabilities in AI browsers allow attackers to manipulate AI-driven browser interfaces by injecting malicious prompts that alter the AI's behavior. This threat can lead to unauthorized actions, data leakage, or misinformation within AI-assisted browsing sessions. Although no known exploits are currently active in the wild, the medium severity rating reflects the potential risks if exploited. European organizations using AI browsers for sensitive tasks could face confidentiality and integrity risks. Mitigation requires strict input validation, sandboxing AI prompt processing, and monitoring AI outputs for anomalies. Countries with high adoption of AI technologies and digital services, such as Germany, France, and the UK, are more likely to be affected. The threat is medium severity due to the moderate impact on confidentiality and integrity, ease of exploitation through crafted inputs, and no requirement for authentication or user interaction. Defenders should prioritize securing AI browser environments and educating users on potential prompt manipulation tactics.

News#infosecnews#redditGermany+5

APT37, a known advanced persistent threat group, has been observed abusing Google Find Hub functionality to conduct data-wiping attacks on Android devices. This attack leverages the integration between Google Find Hub and Android to remotely trigger destructive actions, leading to potential data loss and device disruption. While no specific affected versions or exploits in the wild have been confirmed, the threat is considered high severity due to the destructive nature and potential for targeted attacks. European organizations using Android devices with Google Find Hub integration are at risk, especially those in sectors targeted by APT37. Mitigation requires strict control over device permissions, monitoring for unusual Find Hub activity, and applying security best practices for Android device management. Countries with high Android adoption and strategic interest to APT37, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the potential impact on data integrity and availability, ease of exploitation via trusted device features, and no need for user interaction. Defenders should prioritize detection of anomalous Find Hub commands and enforce robust endpoint security policies.

News#infosecnews#redditGermany+7

A critical vulnerability in Triofox has been exploited to execute malicious payloads by manipulating antivirus (AV) configurations. This flaw allows attackers to leverage AV settings to run arbitrary code, potentially leading to full system compromise. Although no known exploits in the wild have been reported yet, the severity is critical due to the nature of the attack vector and the potential impact. European organizations using Triofox, especially those integrating it with AV solutions, are at risk. The exploit requires no user interaction and can affect confidentiality, integrity, and availability of systems. Immediate mitigation steps include reviewing AV configurations, applying any available patches, and monitoring for suspicious activity. Countries with significant Triofox adoption and critical infrastructure relying on AV-integrated file sharing solutions are most vulnerable. Given the ease of exploitation and critical impact, this threat demands urgent attention from defenders in Europe.

News#infosecnews#redditGermany+7

A critical vulnerability in Gladinet's Triofox file-sharing platform, CVE-2025-12480, allowed unauthenticated access to configuration pages, enabling arbitrary payload execution. Threat actor UNC6485 exploited this flaw as early as August 24, 2025, bypassing authentication and chaining it with anti-virus feature abuse for code execution. The vulnerability affected Triofox version 16.4.10317.56372 and was patched in version 16.7.10368.56560. Attackers created admin accounts, deployed remote access tools, conducted reconnaissance, and attempted privilege escalation. They used Zoho UEMS, Zoho Assist, and Anydesk for remote access, and set up encrypted tunnels for C2 communication. The exploit chain involved HTTP host header manipulation and abuse of the built-in anti-virus feature to execute malicious scripts.

KEVEPSS 95%Report on CVE-2025-12480CampaignGladinetCWE-284#anti-virus abuseGermany+7

Intel has filed a lawsuit against a former engineer accused of stealing approximately 18,000 top secret files prior to being laid off. This insider threat incident involves unauthorized exfiltration of highly sensitive intellectual property and confidential information. Although no direct exploit or vulnerability is reported, the breach highlights risks related to insider threats and data exfiltration. The incident underscores the importance of robust access controls, monitoring, and data loss prevention strategies. European organizations with similar intellectual property or sensitive data face comparable risks from disgruntled or departing employees. Mitigation requires strict enforcement of least privilege, timely revocation of access upon termination, and enhanced behavioral monitoring. Countries with significant semiconductor industries or advanced technology sectors are more likely to be impacted. Given the scale and sensitivity of the data stolen, the severity is assessed as high. Defenders should prioritize insider threat detection and response capabilities to prevent similar incidents.

News#infosecnews#redditGermany+6

The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.

Phishing#infosecnews#redditGermany+9

FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.

AnalysisGermanyFrance+9

Today, I noticed scans using the username "FTP_3cx" showing up in our logs.3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty for this particular string. The 3CX software does not appear to run an FTP server, but it offers a feature to back up configurations to an FTP server [2]. The example user used in the documentation is "3cxftpuser", not "FTP_3cx". Additionally, the documentation notes that the FTP server can run on a different system from the 3CX software. For a backup, it would not make much sense to have it all run on the same system.

NewsGermanyFrance+6

For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and potentially exposing sensitive communications between congressional offices and CBO […] The post 10th November – Threat Intelligence Report appeared first on Check Point Research .

AnalysisSwedenPoland+7

Nine malicious NuGet packages have been identified that contain time-delayed payloads designed to disrupt databases and industrial systems. These packages, once integrated into software projects, activate their payloads after a delay, complicating detection and mitigation efforts. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential to impact critical infrastructure and data integrity. European organizations relying on NuGet packages in software development, especially those in industrial automation and database management sectors, should be vigilant. The delayed activation mechanism increases the risk of prolonged undetected presence, potentially causing significant operational disruption. Mitigation requires proactive package auditing, supply chain security enhancements, and monitoring for unusual system behaviors. Countries with strong industrial bases and extensive software development ecosystems, such as Germany, France, and the UK, are particularly at risk. Given the complexity and potential impact, the threat is assessed as medium severity. Immediate attention to supply chain security hygiene is recommended to prevent exploitation.

Malware#infosecnews#redditGermany+6

The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland. The post Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site appeared first on SecurityWeek .

Malware#webGermany+7

A new Android remote data-wipe attack exploiting Google's Find Hub feature has been identified as part of the KONNI APT campaign. The attackers impersonated psychological counselors and human rights activists, distributing malware disguised as stress-relief programs via KakaoTalk messenger. They compromised Google accounts to track victims' locations and remotely wipe Android devices. The attack involved spear-phishing, prolonged reconnaissance, and abuse of legitimate management functions. Multiple RAT variants were deployed, including RemcosRAT, QuasarRAT, and RftRAT. The campaign utilized WordPress-based hosting and geographically distributed C2 servers to evade detection. This sophisticated attack demonstrates the evolving tactics of state-sponsored threat actors.

Malware#rat#find hubGermany+5

The GlassWorm malware has resurfaced on the OpenVSX marketplace with three new malicious Visual Studio Code extensions. These extensions are designed to infiltrate developer environments, potentially compromising source code confidentiality and integrity. GlassWorm is known for its stealthy behavior and ability to exfiltrate sensitive data from infected systems. Although no known exploits are currently active in the wild, the presence of these extensions on a popular open-source extension repository poses a significant risk. European organizations relying on VSCode and OpenVSX for development are at risk of supply chain attacks. The malware’s return highlights the ongoing threat of malicious code injection via trusted development tools. Mitigation requires strict extension vetting, monitoring network traffic for unusual activity, and restricting extension installation policies. Countries with large software development sectors and high adoption of VSCode and OpenVSX are most vulnerable. Given the malware’s potential impact on confidentiality and integrity, ease of exploitation via trusted extensions, and broad scope, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+7

A China-linked hacking group has been conducting a long-term espionage campaign targeting a U. S.non-profit organization. The campaign involves persistent cyber intrusions aimed at gathering sensitive information over an extended period. While specific technical details and exploited vulnerabilities are not disclosed, the threat reflects ongoing state-sponsored cyber espionage activities. The campaign is assessed as medium severity due to its targeted nature and potential impact on confidentiality. European organizations with ties to U. S.non-profits or similar sectors should be vigilant. Mitigation requires enhanced monitoring, threat intelligence sharing, and strict access controls.

Campaign#infosecnews#redditGermany+6