The Chinese-affiliated threat actor UNC6384 is exploiting the ZDI-CAN-25373 Windows vulnerability to deploy PlugX malware targeting European diplomatic entities, specifically in Hungary and Belgium. The attack vector involves spearphishing emails with malicious LNK files themed around diplomatic conferences. The campaign uses DLL side-loading of legitimate Canon printer utilities to evade detection and maintain persistence. UNC6384’s operations have expanded from Southeast Asia to Europe, focusing on espionage related to foreign policy, defense, and economic matters. This campaign demonstrates advanced social engineering and rapid exploitation of new vulnerabilities. The malware provides persistent remote access for intelligence gathering. No known public exploits exist yet, but the threat is active and targeted. The medium severity rating reflects the targeted nature and complexity of the attack. European diplomatic organizations should prioritize mitigation to protect sensitive information and maintain operational security.
The 130-page document covers several important aspects and it’s available in both Japanese and English. The post Japan Issues OT Security Guidance for Semiconductor Factories appeared first on SecurityWeek .
A security research campaign uncovered over 2,000 medium vulnerabilities, including 98 highly critical issues, across publicly exposed applications built on vibe-coded platforms integrating Lovable front-ends with Supabase backends. The research revealed 400+ exposed secrets and 175 instances of personally identifiable information (PII), including sensitive data such as bank details and medical information. Notable vulnerabilities include Broken Object Level Authorization (BOLA), Server-Side Request Forgery (SSRF), and zero-click account takeover exploits. The threat arises from the architectural integration where sensitive tokens and API keys are exposed in frontend bundles, increasing the attack surface. Although no known exploits are currently in the wild, the critical severity and volume of findings indicate a significant risk. European organizations using these platforms or similar architectures face risks of data breaches, unauthorized access, and service disruption. Mitigation requires targeted scanning for exposed secrets in frontend code, strict API authorization enforcement, and comprehensive secrets management. Countries with high adoption of Supabase and vibe-coded platforms, such as the UK, Germany, France, and the Netherlands, are most likely affected. Given the ease of exploitation and sensitive data exposure without authentication, the suggested severity is critical.
The hackers stole names, addresses, dates of birth, Social Security numbers, and health and insurance information. The post 10 Million Impacted by Conduent Data Breach appeared first on SecurityWeek .
A major US telecom backbone provider, Ribbon Communications, was reportedly compromised by nation-state actors. Ribbon Communications supplies critical communications technology to the US government and major telecom operators. Although specific technical details of the breach are not disclosed, the attack likely targets sensitive infrastructure supporting telecom networks. The incident highlights risks to telecom supply chains and potential impacts on network confidentiality, integrity, and availability. No known exploits or patches have been reported yet. European organizations relying on interconnected telecom infrastructure or using Ribbon products may face indirect risks. Mitigation requires enhanced monitoring, supply chain risk assessments, and collaboration with vendors. Countries with significant telecom infrastructure linked to US networks or strategic geopolitical interest in US-China/Russia relations are more likely to be affected. Given the medium severity and lack of detailed exploit information, the threat is assessed as high due to the critical nature of telecom backbone systems and potential for disruption or espionage.
Hacktivists have been reported by the Canadian Centre for Cyber Security to increasingly target internet-exposed Industrial Control Systems (ICS), with confirmed tampering incidents at a water facility and an oil and gas firm in Canada. These attacks highlight the growing risk to critical infrastructure sectors from threat actors exploiting exposed ICS environments. While no known exploits are currently in the wild, the medium severity rating reflects the potential for disruption to essential services. European organizations operating similar ICS environments, especially in water and energy sectors, face comparable risks. The threat underscores the need for enhanced ICS network segmentation, strict access controls, and continuous monitoring to detect unauthorized activity. Countries with significant oil, gas, and water infrastructure and high ICS adoption are more likely to be targeted. Given the ease of exploitation of internet-exposed ICS and the critical nature of these systems, the suggested severity is high. Defenders should prioritize reducing ICS exposure to the internet and implementing robust incident response plans tailored to ICS environments.
Hacktivists have reportedly breached critical infrastructure in Canada, as warned by a Canadian cyber agency. The breach is considered critical, indicating significant potential impact on essential services. Details are limited, with minimal discussion and no known exploits currently in the wild. The attack highlights the growing threat posed by hacktivist groups targeting national infrastructure. European organizations should be aware of similar risks, especially those with interconnected infrastructure or shared supply chains. Mitigation requires enhanced monitoring, incident response readiness, and collaboration with national cybersecurity agencies. Countries with close economic and security ties to Canada, or with similar critical infrastructure profiles, are more likely to be affected. The severity is assessed as critical due to the breach of critical infrastructure, potential for widespread disruption, and the difficulty in defending such targets. Defenders must prioritize threat intelligence sharing and proactive defense measures to mitigate similar threats.
Hackers have compromised corporate XWiki servers to deploy unauthorized cryptocurrency mining operations. This threat involves attackers gaining access to XWiki instances, leveraging them to mine cryptocurrencies without the organizations' consent. The exploitation does not currently have known public exploits or patches, and detailed technical specifics are limited. The attack primarily impacts server availability and resource utilization, potentially degrading performance and increasing operational costs. European organizations using XWiki for internal collaboration or documentation are at risk, especially those with exposed or poorly secured instances. Mitigation requires immediate hardening of XWiki deployments, including access controls, monitoring for unusual resource usage, and applying security best practices. Countries with significant enterprise adoption of XWiki and higher cloud infrastructure usage are more likely to be targeted. Given the medium severity, the threat poses moderate risk but can escalate if attackers gain deeper access or persist longer. Defenders should prioritize detection and containment to prevent resource abuse and potential lateral movement.
Let’s compare TikTok, Twitch, YouTube, Reddit, Pinterest, Facebook, Instagram, and other social media based on the amount of data they collect and their privacy settings.
Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.
A significant data breach involving Ernst & Young's (EY) cloud environment resulted in a public exposure of a 4TB SQL Server backup. The leak was disclosed via a Neo Security Labs blog and discussed minimally on Reddit's NetSec subreddit. The exposed data volume suggests a large-scale compromise potentially containing sensitive corporate and client information. Although no known exploits are currently in the wild, the breach poses a medium severity risk due to the potential confidentiality impact and the scale of data involved. European organizations, especially those with close business ties or shared cloud infrastructure with EY, may face indirect risks from this exposure. Mitigation requires immediate audit of cloud storage permissions, encryption of backups, and enhanced monitoring for unauthorized access. Countries with significant EY presence and financial sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the nature of the breach—large data exposure without active exploitation—the suggested severity is medium. Defenders should prioritize verifying their own cloud security postures and reviewing third-party data handling agreements.
CISA has issued a warning about two newly discovered vulnerabilities in Dassault systems that are currently being actively exploited. These vulnerabilities pose a high risk due to their active exploitation status and potential impact on affected systems. Although specific technical details and affected versions are not provided, the alert highlights the urgency for organizations using Dassault products to prioritize mitigation efforts. European organizations relying on Dassault software, especially in aerospace, defense, and manufacturing sectors, could face significant operational and data security risks. The lack of publicly available patches increases the threat level, necessitating immediate risk assessment and temporary protective measures. Countries with strong aerospace and defense industries, such as France and Germany, are particularly at risk. Given the active exploitation and high severity, the threat is assessed as high severity. Defenders should monitor official advisories, apply any available mitigations, restrict network access to vulnerable systems, and enhance monitoring for suspicious activity related to Dassault software. This proactive approach is critical to minimizing potential damage from these vulnerabilities.
This report discusses how Security Operations Center (SOC) teams implement real-time defenses against credential replay attacks, a type of attack where stolen authentication credentials are reused to gain unauthorized access. Credential replay attacks threaten confidentiality and integrity by allowing attackers to impersonate legitimate users without needing to crack passwords. The article highlights operational strategies and tools SOC teams use to detect and mitigate these attacks promptly. While no specific vulnerabilities or exploits are detailed, the focus is on defensive measures and incident response workflows. European organizations face risks due to the widespread use of credential-based authentication systems and the increasing sophistication of attackers. Mitigation involves deploying multi-factor authentication, continuous monitoring for anomalous login patterns, and leveraging threat intelligence to identify replay attempts. Countries with high digital adoption and critical infrastructure reliance on credential authentication are more likely to be targeted. Given the medium severity and absence of active exploits, the threat remains significant but manageable with proactive defense. SOC teams must prioritize real-time detection capabilities and adaptive response to reduce the attack surface and potential damage from credential replay attacks.
Witnesses on the Thai side of the border reported hearing explosions and seeing smoke coming from the center over the past several nights starting on Friday. The post Stragglers From Myanmar Scam Center Raided by Army Cross Into Thailand as Buildings are Blown Up appeared first on SecurityWeek .
A DLL hijacking vulnerability has been identified involving narrator.exe, a Windows accessibility helper. This issue allows an attacker to load a malicious DLL by exploiting the way Windows resolves DLL dependencies for narrator.exe. Although no known exploits are currently active in the wild, the vulnerability could be leveraged to execute arbitrary code with the privileges of the affected process. The threat is rated medium severity due to the potential for privilege escalation and code execution without requiring user interaction, but it lacks widespread exploitation and detailed technical disclosure. European organizations using Windows systems with narrator.exe enabled could be impacted, especially those with high reliance on accessibility features or legacy configurations. Mitigation involves monitoring DLL loading paths, applying strict DLL search order policies, and employing application whitelisting. Countries with significant Windows enterprise usage and critical infrastructure are more likely to be targeted.
Recent reports indicate that ransomware payments have hit a record low, with only 23% of victims paying ransoms in Q3 2025. This trend suggests a shift in ransomware attack dynamics and victim response strategies. Although ransomware remains a significant malware threat, the declining payment rate may reflect improved defensive measures, increased law enforcement actions, or changes in attacker tactics. European organizations, often targeted by ransomware, could experience reduced financial losses from ransom payments but must remain vigilant against evolving ransomware techniques. The threat landscape is dynamic, and attackers may adapt to these changes by altering extortion methods or targeting less prepared victims. Defenders should focus on enhancing detection, incident response, and backup strategies to mitigate ransomware impact. Countries with high ransomware incident rates and critical infrastructure are more likely to be affected. Overall, while the payment rate decline is positive, ransomware remains a persistent threat requiring ongoing attention.
Data allegedly stolen from the companies has been made available for download on the Cl0p ransomware leak website. The post Industrial Giants Schneider Electric and Emerson Named as Victims of Oracle Hack appeared first on SecurityWeek .
While reviewing malicious messages that were delivered to our handler inbox over the past few days, I noticed that the “subject” of one phishing e-mail looked quite strange when displayed in the Outlook message list…
