Over the past two months, my outlook account has been receiving phishing email regarding cloud storage payments, mostly in French and some English with the usual warning such as the account is about to be locked, space is full, loss of data, refused payment, expired payment method, etc.
TransparentTribe, a Pakistani-linked threat actor, is conducting a cyber espionage campaign targeting Indian military organizations using DeskRAT, a Golang-based Remote Access Trojan. The attack begins with phishing emails containing links to malicious ZIP archives that deploy multi-stage payloads designed for Linux environments, specifically targeting the Indian government-endorsed BOSS operating system. DeskRAT establishes command and control over WebSocket connections and uses various persistence techniques to maintain access. The campaign leverages regional tensions and local protests to increase the likelihood of successful compromise. While primarily focused on Indian military targets, the malware's Linux focus and sophisticated evasion techniques highlight a targeted espionage effort. No known exploits or CVEs are associated with this malware yet, and the severity is assessed as medium. European organizations are not the primary target but could be indirectly impacted if geopolitical tensions escalate or if similar tactics are adopted against allied or related entities. Defenders should focus on phishing prevention, monitoring WebSocket traffic, and hardening Linux systems, especially those running government or military-grade OS variants.
A recently disclosed privilege escalation technique targets laptops using BitLocker with TPM and PIN protection. The method leverages weaknesses in the interaction between BitLocker, TPM, and PIN authentication to escalate privileges on the device. Although no known exploits are currently in the wild, the technique poses a medium-level risk due to its potential to bypass security controls protecting encrypted drives. European organizations using BitLocker with TPM and PIN on laptops could face confidentiality and integrity risks if attackers gain physical or remote access. Mitigation requires careful management of BitLocker configurations, firmware updates, and restricting physical access. Countries with high adoption of Windows enterprise laptops and strong use of BitLocker encryption, such as Germany, France, and the UK, are more likely to be affected. Given the complexity and requirement for some level of access, the threat severity is assessed as medium. Defenders should prioritize monitoring for unusual privilege escalations and ensure endpoint security policies are robust to prevent exploitation.
Agenda ransomware group, also known as Qilin, has been deploying a Linux-based ransomware binary on Windows hosts using legitimate remote management and file transfer tools. This cross-platform execution technique bypasses Windows-centric detections and security solutions. The attack chain includes the use of BYOVD for defense evasion, deployment of multiple SOCKS proxy instances for C&C traffic obfuscation, and targeted theft of backup credentials. Agenda has affected 591 victims across 58 countries since January 2025, primarily targeting organizations in developed markets and high-value industries. The group's sophisticated approach combines legitimate tools, cross-platform execution, and strategic targeting of backup infrastructure, making detection significantly more challenging for organizations.
SquareX has shown how malicious browser extensions can impersonate AI sidebar interfaces. The post AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk appeared first on SecurityWeek .
Infostealers landscape exploded in 2024 and they remain a top threat today. If Windows remains a nice target (read: Attackers&#;x26;#;39; favorite), I spotted an Infostealer targeting Android devices. This sounds logical that attackers pay attention to our beloved mobile devices because all our life is stored on them.
A critical vulnerability in Lanscope Endpoint Manager has been confirmed by CISA to be actively exploited in ongoing cyberattacks. Lanscope Endpoint Manager is an endpoint management solution used to monitor and control enterprise devices. The vulnerability allows attackers to potentially execute unauthorized actions on affected systems, posing a significant risk to confidentiality, integrity, and availability. Although specific technical details and affected versions are not disclosed, the critical severity indicates a high-impact flaw. European organizations using Lanscope Endpoint Manager are at risk, especially those in sectors with high endpoint management reliance. No official patches or CVSS score are currently available, but the threat is urgent. Mitigation should focus on immediate risk reduction, including network segmentation, monitoring for suspicious activity, and vendor engagement for updates. Countries with strong adoption of Lanscope products and critical infrastructure sectors are most likely to be targeted. The ease of exploitation and active attacks justify a suggested severity rating of critical. Defenders must prioritize detection and containment to prevent compromise.
The Iran-linked threat actor group MuddyWater has launched a global espionage campaign targeting over 100 organizations worldwide. This campaign focuses on intelligence gathering and is characterized by high-priority targeting of entities likely involved in sensitive sectors. Although specific technical details and exploited vulnerabilities are not disclosed, MuddyWater is known for using sophisticated tactics including spear-phishing and custom malware. The campaign poses significant risks to confidentiality and integrity of targeted organizations’ data. European organizations, especially those in critical infrastructure, government, and defense sectors, are at heightened risk due to their strategic value. Mitigation requires enhanced threat hunting, network monitoring for MuddyWater TTPs, and strict access controls. Countries with strong geopolitical ties or adversarial relations with Iran, and those with high adoption of targeted technologies, are more likely to be affected. Given the espionage nature, ease of exploitation is moderate but impact on confidentiality is high, warranting a high severity rating. Defenders should prioritize detection of MuddyWater indicators and implement proactive cyber threat intelligence sharing.
The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.
Star Blizzard started using the NoRobot (BaitSwitch) and MaybeRobot (SimpleFix) malware after public reporting on the LostKeys malware. The post Russian APT Switches to New Backdoor After Malware Exposed by Researchers appeared first on SecurityWeek .
The Jingle Thief campaign, conducted by financially motivated threat actors from Morocco, targets global enterprises in retail and consumer services sectors to execute gift card fraud. Using phishing and smishing tactics, the attackers gain access to Microsoft 365 environments, exploiting cloud services for reconnaissance, lateral movement, and persistence. They focus on compromising gift card issuance systems, leveraging internal documentation and communication channels. The campaign demonstrates sophisticated techniques, including tailored phishing, internal email manipulation, and device registration abuse. The attackers maintain long-term access, sometimes over a year, making detection challenging. Their activities often align with holiday periods to maximize impact.
Jewett-Cameron Company says hackers stole sensitive information and are threatening to release it unless a ransom is paid. The post Fencing and Pet Company Jewett-Cameron Hit by Ransomware appeared first on SecurityWeek .
Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.
Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.
The PolarEdge botnet campaign targets routers from Cisco, ASUS, QNAP, and Synology to expand its network of compromised devices. This campaign leverages vulnerabilities or weak configurations in these widely used routers to enlist them into a botnet, potentially enabling large-scale distributed denial-of-service (DDoS) attacks, data interception, or further lateral movement. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the critical role these devices play in network infrastructure. European organizations using these brands are at risk, especially those with less stringent router security practices. The campaign's expansion highlights the ongoing threat posed by botnets exploiting IoT and network edge devices. Defenders should focus on hardening router configurations, applying firmware updates, and monitoring network traffic for anomalies. Countries with high adoption of these router brands and significant digital infrastructure are more likely to be targeted. Immediate mitigation steps can reduce the risk of compromise and limit the botnet's growth.
Russian threat actors have evolved a malware campaign that leverages fake "I am not a robot" CAPTCHA prompts to deliver malicious payloads. This technique abuses user trust in CAPTCHA interfaces to trick victims into executing malware, potentially leading to system compromise. The malware is associated with advanced persistent threat (APT) groups and represents a high-severity risk due to its social engineering vector and stealthy delivery. Although no known exploits are currently active in the wild, the campaign's sophistication and targeting suggest a significant threat to organizations, especially those with high user interaction and web-facing services. European organizations are at risk given the widespread use of CAPTCHA mechanisms and the geopolitical focus on this region. Mitigation requires enhanced user awareness, web filtering, and endpoint detection tuned to identify unusual CAPTCHA-related behaviors. Countries with large digital economies and critical infrastructure in Europe are most likely targets. The threat is assessed as high severity due to the potential for confidentiality breaches, ease of exploitation via social engineering, and the broad scope of affected systems without requiring prior authentication or complex user interaction beyond clicking a fake CAPTCHA.
A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.
The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting Windows Server machines primarily in government, financial, and industrial sectors across Asia, Africa, and Latin America. Attackers gain initial access by exploiting SQL servers and deploy custom implants such as Neursite and NeuralExecutor. These implants employ advanced persistence, evasion, and command execution techniques, using a multi-stage loading process and diverse communication protocols for command and control (C2). Although attribution is uncertain, indicators suggest possible links to Chinese-speaking threat actors. The campaign highlights the critical need for robust server security and continuous monitoring to detect complex multi-stage intrusions. No known exploits are currently in the wild, and the campaign is rated medium severity. The focus on Windows Server environments and SQL exploitation techniques underscores the risk to organizations relying on these technologies.
A threat actor has been infecting servers of high-profile entities with backdoors to exfiltrate information and deploy additional payloads. The post Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign appeared first on SecurityWeek .
