Researchers have determined that a significant portion of global satellite traffic lacks encryption. Let's delve into how data — even from your cellphone calls — can leak from orbit.
UK mobile carriers are implementing measures to block spoofed phone numbers as part of a fraud crackdown. This initiative aims to reduce the prevalence of caller ID spoofing, a technique frequently used in phone-based scams and social engineering attacks. By preventing spoofed numbers, carriers seek to enhance trust in telephony communications and protect consumers from fraudulent calls. While this action is currently focused on the UK, it reflects a broader industry trend toward combating telecom fraud. The measure does not represent a direct vulnerability or exploit but rather a defensive improvement. European organizations relying on telephony for customer interactions or internal communications may benefit indirectly from reduced spoofing-related fraud. However, the announcement itself is informational and does not describe a new threat or vulnerability. No known exploits or technical vulnerabilities are associated with this news. The severity is assessed as high in terms of the importance of the issue addressed, but it is not a direct threat. This is primarily a security news update about mitigation efforts rather than a new attack vector.
In September 2025, SonicWall disclosed a security breach attributed to state-sponsored hackers. The breach involved unauthorized access to SonicWall's systems, potentially compromising sensitive data and impacting the security of their customers. While specific technical details and affected product versions were not disclosed, the incident is considered high severity due to the involvement of advanced threat actors and the critical nature of SonicWall's security products. No known exploits in the wild have been reported yet. European organizations relying on SonicWall's VPN and firewall solutions may face increased risk of data exposure and operational disruption. Mitigation requires immediate review of SonicWall product configurations, enhanced monitoring for suspicious activity, and applying any forthcoming patches or guidance from SonicWall. Countries with significant SonicWall deployments and strategic sectors such as finance, government, and critical infrastructure are most at risk. Given the breach's potential impact on confidentiality and integrity, ease of exploitation by skilled attackers, and the broad scope of affected systems, the suggested severity is high. Defenders should prioritize threat detection, incident response readiness, and collaboration with SonicWall for remediation updates.
For several years, we have offered a "new domain" list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the list has been causing issues, resulting in a "cut-off" list being returned. To resolve this issue, I updated the API call. It is sort of backward compatible, but it will not allow you to retrieve the full list. Additionally, we offer a simple "static file" containing the complete list. This file should be used whenever possible instead of the API.
The 'SmudgedSerpent' hacking group has been reported targeting U. S.policy experts amid heightened Iran–Israel tensions. While specific technical details and indicators of compromise are not disclosed, the activity is considered high priority due to its geopolitical context and potential espionage motives. There is no evidence of known exploits in the wild or affected software versions. The threat appears focused on information gathering rather than disruptive attacks. European organizations, especially those engaged in policy, diplomatic, or intelligence sectors related to Middle Eastern affairs, could face indirect risks. Mitigation should emphasize enhanced monitoring of targeted personnel, threat intelligence sharing, and strict access controls. Countries with strong diplomatic ties or intelligence cooperation with the U. S.
A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities. Their malware samples are primarily distributed through Telegram groups, with strong anti-detection capabilities and highly targeted lures. The article describes new watering hole activities by the group, including the use of modified MSI installers for popular messaging apps like Telegram. The group has evolved its tactics since previous reports, making their operations more covert and difficult to detect. The analysis reveals the group's use of various programming languages and sophisticated techniques, suggesting it may be part of a larger, more advanced organization called Miuuti Group.
DragonForce, a ransomware-as-a-service group active since 2023, has rebranded as a cartel and formed alliances with groups like Scattered Spider, LAPSUS$, and ShinyHunters. The group uses Conti-derived code and employs BYOVD attacks to terminate processes. DragonForce has expanded its affiliate program, allowing partners to white-label payloads and create variants. The group has exposed over 200 victims on its leak site, targeting various sectors. DragonForce's partnership with Scattered Spider, known for sophisticated social engineering techniques, has led to high-profile breaches. The group's ransomware samples show significant overlap with Conti's leaked source files and use ChaCha20 encryption.
Threat actors engage in elaborate attack chains to infect trucking and logistics companies with remote access tools. The post Transportation Companies Hacked to Steal Cargo appeared first on SecurityWeek .
Operation SkyCloak is a recently identified cyber threat involving a Tor-enabled OpenSSH backdoor targeting defense sector organizations. The backdoor leverages Tor to anonymize command and control communications, complicating detection and attribution. Although no known exploits are currently active in the wild, the malware's design suggests a focus on stealthy, persistent access to sensitive defense infrastructure. The threat is considered high severity due to its potential impact on confidentiality and integrity within critical defense environments. European defense organizations are at risk, especially those with extensive OpenSSH deployments and strategic defense roles. Mitigation requires advanced network monitoring for Tor traffic, strict SSH access controls, and enhanced endpoint detection capabilities. Countries with significant defense industries and NATO membership are likely primary targets. Given the complexity and stealth of this backdoor, the suggested severity is high. Defenders should prioritize detection of anomalous Tor usage and review SSH configurations to prevent unauthorized backdoor implantation.
Google's AI tool 'Big Sleep' has identified five new high-severity vulnerabilities in Apple's Safari WebKit engine. These vulnerabilities affect the core rendering engine used by Safari and other applications on Apple platforms. Although no known exploits are currently active in the wild, the discovery highlights potential risks to confidentiality, integrity, and availability for users of Safari. The vulnerabilities have not yet been assigned CVEs or patches, and technical details remain limited. European organizations relying on Safari for web access could face targeted attacks exploiting these flaws, especially in sectors with high-value data. Mitigation requires close monitoring of Apple security advisories and rapid deployment of patches once available. Countries with significant Apple user bases and strategic technology sectors are at higher risk. The threat is assessed as high severity due to the critical nature of WebKit in web browsing, the potential for remote code execution, and the lack of current mitigations. Defenders should prioritize vulnerability management and consider temporary mitigations such as limiting Safari use or sandboxing until patches are released.
Hackers have been leveraging Remote Monitoring and Management (RMM) tools to infiltrate freighters, enabling them to steal cargo shipments. This attack vector exploits the trust and access granted to RMM tools within maritime logistics environments, allowing attackers to bypass traditional security controls. The breach highlights a growing trend of targeting supply chain and transportation sectors, which are critical for global trade. European organizations involved in shipping and freight logistics face significant risks due to their reliance on these technologies and the strategic importance of their ports. The attackers' use of legitimate management tools complicates detection and response efforts. Mitigation requires stringent access controls, continuous monitoring of RMM tool usage, and segmentation of operational technology networks. Countries with major shipping hubs and extensive maritime trade, such as the Netherlands, Germany, and Belgium, are particularly vulnerable. Given the high impact on confidentiality, integrity, and availability of cargo operations and the ease of exploitation through trusted tools, this threat is assessed as high severity. Defenders must prioritize securing RMM environments and enhancing incident response capabilities to prevent cargo theft and operational disruption.
Dante spyware is a newly identified malicious software linked to the rebranded hacking group formerly known as Hacking Team, now operating as Memento Labs. This spyware is designed for covert surveillance and data exfiltration, continuing the legacy of sophisticated offensive cyber tools. Although no specific affected software versions or exploits in the wild have been confirmed, the association with a known advanced threat actor suggests a medium risk level. European organizations, especially those in critical infrastructure, government, and private sectors, could be targeted due to the strategic value of their data. Mitigation requires enhanced network monitoring, threat hunting for indicators of compromise related to Dante, and strict access controls. Countries with high adoption of targeted technologies and historical exposure to espionage campaigns, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity, the threat impacts confidentiality primarily, with moderate ease of exploitation likely requiring some level of access or social engineering. Defenders should prioritize awareness of this emerging spyware and prepare incident response plans accordingly.
To deploy AI tools securely and ethically, teams must balance innovation with accountability—establishing strong governance, upskilling developers, and enforcing rigorous code reviews. The post How Software Development Teams Can Securely and Ethically Deploy AI Tools appeared first on SecurityWeek .
CISO burnout is increasing. Are we simply more aware of the condition? Or have demands on the CISO grown and burnout is now the inevitable result? The post CISO Burnout – Epidemic, Endemic, or Simply Inevitable? appeared first on SecurityWeek .
Cybercriminals are targeting trucking and logistics companies to steal cargo freight through elaborate attack chains. They compromise companies and use their access to bid on cargo shipments, which they then steal and sell. The threat actors typically deliver remote monitoring and management (RMM) tools as a first-stage payload. This cyber-enabled theft is part of a multi-million-dollar criminal enterprise that has increased due to digital transformation. The attackers use tactics such as compromising load boards, email thread hijacking, and direct targeting via email campaigns. They deliver RMM tools like ScreenConnect, SimpleHelp, and PDQ Connect, which grant full control of compromised machines. The activity has been observed since at least June 2025, with nearly two dozen campaigns in the last two months alone.
Research by: Alexey Bukhteyev Key takeaways Introduction XLoader is a widely observed malicious loader with information-stealing capabilities. It first surfaced in 2020 as a rebrand of the FormBook code base, a well-known and capable information stealer, and has since undergone substantial hardening and feature growth. In addition to the Windows variant, its developers also marketed […] The post Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering appeared first on Check Point Research .
North Korean threat actors Kimsuky and Lazarus have deployed new sophisticated malware toolsets named HttpTroy and an upgraded BLINDINGCAN variant. HttpTroy is a backdoor delivered via a VPN invoice-themed attack, involving a dropper and loader (MemLoad), granting extensive system control. Lazarus's upgraded BLINDINGCAN is delivered through a new Comebacker malware variant, targeting victims in Canada. Both toolsets use advanced obfuscation, stealth techniques, and layered evasion to avoid detection. These attacks highlight DPRK's evolving cyber espionage capabilities. Although currently observed targeting South Korea and Canada, European organizations could be at risk due to geopolitical tensions and similar attack methodologies. No known exploits in the wild have been reported yet. Mitigation requires targeted detection of these toolsets, network monitoring for associated indicators, and enhanced endpoint defenses. The threat is assessed as medium severity due to its espionage focus, stealth, and complexity, but limited current scope and no public CVSS score.
The Rhysida ransomware gang, previously known as Vice Society, is conducting a sophisticated malvertising campaign using Bing ads to distribute OysterLoader malware. This malware acts as an initial access tool, establishing persistence and enabling further payload deployment, including ransomware. The gang employs code-signing certificates, including Microsoft Trusted Signing, to evade detection and increase trustworthiness of their malware. Their activity has notably increased in 2025, with over 40 certificates tracked compared to 7 in 2024. They also utilize Latrodectus malware for initial access. The campaign leverages legitimate services and advanced evasion techniques, highlighting significant resource investment and operational maturity. This threat poses a medium severity risk but can lead to severe consequences if ransomware is deployed. European organizations should be vigilant against malvertising campaigns and suspicious software downloads, especially those impersonating popular software. Mitigation requires enhanced monitoring of code-signed binaries, user awareness, and blocking malicious ad traffic.
For the latest discoveries in cyber research for the week of 3rd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Everest ransomware group has claimed responsibility for a series of attacks impacting AT&T, Dublin Airport, and Air Arabia. The ransomware gang exfiltrated sensitive data including 576,000 AT&T applicant records, 1.5 million […] The post 3rd November – Threat Intelligence Report appeared first on Check Point Research .
A large-scale attack infrastructure dubbed TruffleNet has been identified, built around the open-source tool TruffleHog. This infrastructure is used to systematically test compromised credentials and perform reconnaissance across AWS environments. The campaign involves over 800 unique hosts across 57 distinct Class C networks, characterized by consistent configurations and the use of Portainer. Alongside TruffleNet, adversaries are exploiting Amazon Simple Email Service (SES) to facilitate Business Email Compromise (BEC) campaigns. The attackers create email identities using compromised WordPress sites and conduct aggressive cloud reconnaissance. This activity highlights the evolving tactics of threat actors in exploiting cloud infrastructure at scale, combining credential theft, reconnaissance automation, and SES abuse to conduct high-volume fraud with minimal detection.
