Memento Labs is reportedly resurfacing as a cyber threat actor linked to the legacy of Hacking Team, a notorious surveillance software vendor known for supplying governments with offensive cyber tools. While concrete technical details and active exploits are currently minimal, the campaign's reemergence signals potential renewed activity in targeted cyber espionage or surveillance operations. There is no evidence of widespread exploitation or public exploits at this time, and the threat appears to be in early stages of observation. European organizations, especially those in government, defense, and critical infrastructure sectors, should be vigilant given Hacking Team's historical targeting patterns. Mitigation should focus on enhanced monitoring for advanced persistent threat (APT) behaviors, network segmentation, and strict access controls. Countries with significant government and defense industries, such as Germany, France, Italy, and the UK, are likely to be primary targets. Given the medium severity and lack of active exploitation, the threat should be considered medium risk but monitored closely for escalation. Defenders should prioritize threat intelligence sharing and proactive detection capabilities to identify any emerging indicators of compromise related to Memento Labs.
The SideWinder threat actor group has adopted a new attack chain leveraging Microsoft's ClickOnce deployment technology to target South Asian diplomats. This campaign uses ClickOnce to deliver malicious payloads, exploiting trust in legitimate Microsoft frameworks to bypass security controls. The attacks are highly targeted, focusing on diplomatic personnel, which suggests espionage motives. Although no known exploits are currently reported in the wild, the campaign's sophistication and targeting elevate its risk. European organizations with diplomatic ties or South Asian connections could face indirect risks, especially if involved in related geopolitical activities. Mitigation requires strict control over ClickOnce application execution, enhanced email filtering, and user awareness training focused on this attack vector. Countries with significant diplomatic engagement with South Asia or hosting South Asian diplomatic missions are more likely to be affected. Given the high impact on confidentiality and the ease of exploitation via social engineering, the suggested severity is high.
Recent reports indicate a decline in ransomware profits as victims increasingly refuse to pay ransom demands. This trend suggests a shift in victim response strategies, potentially reducing the financial incentives for ransomware operators. Despite the drop in profits, ransomware remains a high-priority cybersecurity threat due to its disruptive nature and potential for data loss. European organizations, often targeted by ransomware, may experience changes in attack patterns or ransom negotiation dynamics. The threat does not involve a new vulnerability or exploit but reflects evolving attacker-victim interactions. Defenders should focus on strengthening incident response, backup strategies, and ransomware resilience. Countries with high ransomware incident rates and critical infrastructure reliance on digital systems are most at risk. The severity is assessed as high given ransomware's impact on confidentiality, integrity, and availability, even if exploitation ease varies. No direct technical exploit details are provided, but the ongoing ransomware threat landscape necessitates vigilance and proactive defense measures.
A data breach involving House Democrats’ Resume Bank DomeWatch has resulted in the leak of thousands of Capitol Hill job applicants' personal data. The exposed information likely includes sensitive personal details submitted during the application process for government positions. Although no active exploits are known, the breach poses risks related to identity theft, phishing, and reputational damage. The leak was reported via Reddit and covered by an external news source, indicating limited public discussion so far. European organizations are indirectly affected, mainly through potential targeting of applicants or affiliated entities. Mitigation involves enhanced data protection policies, monitoring for misuse of leaked data, and improving access controls on recruitment databases. Countries with strong ties to US government operations or with significant diplomatic presence in Washington, D. C.are more likely to be impacted. The severity is assessed as medium due to the sensitivity of the data and the potential for misuse, despite the lack of direct system compromise or active exploitation.
LeetAgent is a malware tool used by the ForumTroll APT group, which exploited a zero-day Chrome vulnerability to infect Russian organizations. The same tools were also used to distribute Dante, a sophisticated commercial spyware developed by Memento Labs (formerly HackingTeam). Dante features modular encrypted components and self-destructs if inactive. The attacks targeted media, government, educational, and financial sectors primarily in Russia and Belarus. No known exploits are currently active in the wild beyond these campaigns. Detection has been achieved through advanced XDR solutions, and threat intelligence is available via Kaspersky’s APT data service. European organizations face risks mainly if targeted by similar threat actors or if they share infrastructure or partnerships with affected regions. Mitigation requires patching browsers, monitoring for indicators of compromise, and employing advanced detection tools. Given the malware’s sophistication, modularity, and use of zero-days, the threat severity is assessed as high.
The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers. The post Massive China-Linked Smishing Campaign Leveraged 194,000 Domains appeared first on SecurityWeek .
HyperRat is a newly identified Android malware marketed as a ready-made spying tool, enabling attackers to covertly monitor infected devices. Although it is currently not known to be exploited in the wild, its availability as an off-the-shelf spyware increases the risk of widespread misuse. The malware targets Android devices, potentially compromising user confidentiality by accessing sensitive data and communications. European organizations with employees using Android devices are at risk of espionage and data leakage. Mitigation requires proactive mobile security measures, including app vetting, endpoint protection, and user awareness to detect and prevent installation of such spyware. Countries with high Android adoption and significant digital infrastructure, such as Germany, France, Italy, Spain, and the UK, are most likely to be affected. Given the malware’s spying capabilities, ease of distribution, and potential impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious app behavior and enforce strict mobile device management policies to reduce exposure.
All new extensions will be required to declare their data collection practices in their manifest file using a specific key. The post New Firefox Extensions Required to Disclose Data Collection Practices appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .
Coveware has attributed the drop to large enterprises increasingly refusing to pay up and smaller amounts paid by mid-market firms. The post Ransomware Payments Dropped in Q3 2025: Analysis appeared first on SecurityWeek .
The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks. The post Chrome Zero-Day Exploitation Linked to Hacking Team Spyware appeared first on SecurityWeek .
I was intrigued when Johannes talked about malware that uses BASE64 over DNS to communicate. Take a DNS request like this: label1.label2.tld. Labels in a request like this can only be composed with letters (not case-sensitive), digits and a hyphen character (-). While BASE64 is encoded with letters (uppercase and lowercase), digits and special characters + and /. And also a special padding character: =.
The Russian agricultural regulatory agency Rosselkhoznadzor was targeted by a distributed denial-of-service (DDoS) attack, causing delays in food shipments across Russia. This attack disrupted the agency's online services, impacting its ability to process and manage food shipment logistics. Although no direct exploitation of software vulnerabilities was reported, the attack highlights the risk of service disruption to critical supply chain infrastructure. The attack's medium severity reflects its impact on availability rather than confidentiality or integrity. European organizations involved in agricultural trade or supply chains linked to Russia could face indirect effects such as delays or increased scrutiny. Mitigation should focus on enhancing DDoS resilience through traffic filtering, capacity scaling, and incident response planning. Countries with strong trade ties to Russia and significant agricultural sectors, such as Germany, Poland, and the Netherlands, are more likely to be affected. Given the attack's nature and impact, the suggested severity is medium due to the disruption of availability without evidence of data compromise or exploitation complexity.
Mozilla has announced a new policy requiring all new Firefox extensions to disclose their data collection practices. This move aims to increase transparency and protect user privacy by informing users about what data extensions collect before installation. While this is a positive step for security and privacy, it is not a direct vulnerability or exploit but rather a policy change to mitigate potential risks from malicious or overly intrusive extensions. There are no known exploits or active attacks related to this announcement. European organizations using Firefox should be aware of this change as it impacts extension vetting and user trust. The policy may reduce risks associated with data leakage through extensions but does not eliminate the need for ongoing vigilance. This announcement is informational and does not represent an immediate threat or vulnerability. Given the nature of the information, the suggested severity is low. Key defenders should focus on monitoring extension permissions and educating users about safe extension usage.
A recent phishing campaign exploits fake death claims related to LastPass to trick users into divulging credentials and breaching password vaults. Attackers impersonate LastPass or related entities, leveraging emotional manipulation to increase success rates. This social engineering tactic targets users of LastPass password managers, aiming to gain unauthorized access to their stored credentials. The campaign is high severity due to the sensitive nature of compromised data and potential for widespread credential theft. No known exploits in the wild have been reported yet, but the threat is credible given the trusted brand impersonation and phishing vector. European organizations using LastPass are at risk, particularly those with employees susceptible to social engineering. Mitigation requires targeted user awareness training, multi-factor authentication enforcement, and vigilant email filtering. Countries with high LastPass adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The threat is assessed as high severity due to the potential impact on confidentiality and ease of exploitation via phishing without technical vulnerabilities. Defenders should prioritize detection of phishing attempts referencing LastPass death claims and reinforce secure password management practices.
At the Pwn2Own Ireland event, hackers earned over $1 million by discovering and exploiting 73 zero-day vulnerabilities across various software and hardware targets. These zero-days represent previously unknown security flaws that could be leveraged for unauthorized access, data theft, or system compromise. Although no known exploits are currently active in the wild, the sheer volume and diversity of vulnerabilities highlight significant security risks. European organizations using affected products should be vigilant, as attackers could weaponize these zero-days before patches are widely deployed. Mitigation requires timely patching once updates are released, enhanced monitoring for unusual activity, and applying defense-in-depth strategies. Countries with high technology adoption and critical infrastructure reliant on the targeted systems are at greater risk. Given the high impact potential and ease of exploitation demonstrated in controlled environments, the threat severity is assessed as high. Defenders must prioritize awareness and readiness to respond to emerging exploits stemming from these zero-days.
A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.
The customer information published on the dark web includes names, addresses, phone numbers, and email addresses. The post Toys ‘R’ Us Canada Customer Information Leaked Online appeared first on SecurityWeek .
Questions have been raised over the technical viability of the purported WhatsApp exploit, but the researcher says he wants to keep his identity private. The post Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta appeared first on SecurityWeek .
