Windows 11 23H2 is approaching its end of life (EOL), meaning Microsoft will cease providing security updates and patches for this version after the designated date. Organizations continuing to use this version post-EOL will be exposed to unpatched vulnerabilities, increasing their risk of compromise. Although no specific exploits are currently known in the wild targeting this EOL, the lack of security updates inherently raises the threat level. European organizations relying on Windows 11 23H2 should plan timely upgrades to supported versions to maintain security posture. Failure to upgrade may lead to increased exposure to malware, ransomware, and other cyberattacks exploiting unpatched vulnerabilities. The impact is particularly significant for sectors with strict compliance requirements and critical infrastructure. Countries with high Windows 11 adoption and strong digital economies are at greater risk. Proactive asset management and patching strategies are essential to mitigate risks associated with this EOL. This threat is assessed as medium severity due to the indirect nature of the risk and absence of active exploits.
The malware uses invisible Unicode characters to hide its code and blockchain-based infrastructure to prevent takedowns. The post Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware appeared first on SecurityWeek .
Myanmar is notorious for hosting cyberscam operations responsible for bilking people all over the world. The post Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People appeared first on SecurityWeek .
COLDRIVER, a Russian state-sponsored threat group, swiftly shifted operations after their LOSTKEYS malware was exposed in May 2025. They developed new malware families, including NOROBOT, YESROBOT, and MAYBEROBOT, within days. The infection chain begins with a COLDCOPY lure disguised as a CAPTCHA, leading to the deployment of NOROBOT, a DLL that retrieves subsequent stages. YESROBOT, a Python backdoor, was briefly used before being replaced by MAYBEROBOT, a more flexible PowerShell backdoor. The malware chain has undergone constant evolution, with COLDRIVER focusing on evading detection while maintaining intelligence collection capabilities against high-value targets. The group's tactics include using HTTPS for command retrieval, encrypting commands, and implementing various evasion techniques.
This research focuses on detecting Kerberos attacks through network traffic analysis and developing detection signatures for the Suricata IDS. It aims to improve identification of malicious activity targeting Kerberos authentication, a critical component in many enterprise environments. Although no specific vulnerabilities or exploits are detailed, the work enhances defensive capabilities against potential Kerberos-based threats. The threat does not describe active exploitation but provides tools to detect attack patterns. European organizations relying heavily on Kerberos for authentication could benefit from these detection improvements. Mitigation involves deploying updated IDS signatures and monitoring network traffic for anomalous Kerberos behavior. Countries with significant enterprise IT infrastructure and high adoption of Microsoft Active Directory environments are most relevant. Given the medium severity and absence of active exploits, the threat is primarily a detection enhancement rather than an immediate risk. Defenders should prioritize integrating these detection capabilities to strengthen their security posture against Kerberos attacks.
The DNS0. EU private DNS service has shut down due to sustainability issues, impacting users relying on this service for DNS resolution. While this is not a direct security vulnerability or exploit, the sudden unavailability of a DNS service can cause disruptions in network connectivity and potentially increase exposure to DNS-related attacks if users switch to less secure alternatives. European organizations using DNS0. EU may face operational challenges and should ensure they migrate to trusted DNS providers promptly. No known exploits or vulnerabilities are associated with this shutdown. The threat is primarily operational and availability-related rather than a direct cybersecurity compromise. Organizations should review their DNS configurations and monitor for any unusual DNS traffic or redirection attempts during the transition. Countries with higher adoption of DNS0. EU or critical infrastructure relying on it are more likely to be affected.
The Russian Lynk group has leaked sensitive files from the UK Ministry of Defence (MoD), including detailed information on eight military bases. This data breach represents a significant compromise of confidential military information, potentially exposing critical infrastructure and operational details. The leak was reported via a Reddit InfoSec news post linking to an external article, with minimal public discussion so far. Although no specific technical exploitation details or affected software versions are provided, the leak's nature suggests a targeted campaign against UK defense assets. The breach poses a high risk to confidentiality and national security, with potential ramifications for allied European countries. Immediate mitigation involves reviewing access controls, enhancing monitoring for related threat actor activity, and conducting thorough incident response. European countries with close military cooperation with the UK or shared defense infrastructure are most likely to be affected. Given the sensitivity and potential impact, this threat is assessed as high severity despite the absence of a CVSS score.
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
The ClickFix analysis highlights the growing threat of copy/paste attacks as a significant driver of security breaches. These attacks exploit the common user behavior of copying and pasting data, often leading to credential theft, injection of malicious commands, or unauthorized data exfiltration. Although no specific software vulnerability or exploit is detailed, the threat emphasizes the human and process weaknesses that facilitate these breaches. European organizations are at risk due to widespread use of affected platforms and the high value of their data. Mitigation requires targeted user training, enhanced endpoint monitoring for clipboard activity, and implementation of strict data handling policies. Countries with advanced digital economies and high adoption of remote work technologies, such as Germany, France, and the UK, are particularly vulnerable. Given the ease of exploitation and potential impact on confidentiality and integrity without requiring sophisticated tools or authentication, the threat severity is assessed as high. Defenders should prioritize awareness campaigns and technical controls to detect and prevent malicious copy/paste activities.
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source […] The post 20th October – Threat Intelligence Report appeared first on Check Point Research .
The individuals ran a highly sophisticated cybercrime-as-a-service (CaaS) platform that caused roughly €5 million (~$5.8 million) in losses. The post SIM Farm Dismantled in Europe, Seven Arrested appeared first on SecurityWeek .
A comprehensive guide to configuring privacy and security in ChatGPT: data collection and usage, memory, Temporary Chats, connectors, and account security.
The judge ruled that punitive damages of $167 million awarded by a jury were excessive. The post NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million appeared first on SecurityWeek .
Experian was fined $3.2 million for mass-collecting personal data, highlighting significant privacy and regulatory compliance issues. This incident underscores risks related to unauthorized or excessive data collection practices by large data brokers. Although no direct technical exploit or vulnerability is reported, the event signals potential privacy violations that could lead to reputational damage and regulatory penalties. European organizations should be aware of similar risks under GDPR and other data protection laws. The fine emphasizes the importance of strict data governance and compliance with privacy regulations. No active exploitation or technical attack vectors are indicated. The threat is primarily regulatory and compliance-related rather than a direct cybersecurity vulnerability. Organizations handling personal data must ensure lawful data collection and processing practices. Countries with strong data protection enforcement and large financial or data services sectors are most likely to be impacted.
A new . NET-based backdoor leveraging Windows Cryptographic API (CAPI) has been identified targeting Russian automotive and e-commerce companies. The malware is distributed via phishing emails containing ZIP attachments, which when opened, deploy the backdoor enabling remote code execution (RCE). Although currently focused on Russian firms, the technique and malware could potentially spread to other regions. The backdoor abuses . NET capabilities and CAPI functions to evade detection and maintain persistence. No known public exploits or patches exist yet, and the threat is considered high severity due to its RCE capabilities and targeted nature. European organizations with business ties or supply chains linked to Russian auto or e-commerce sectors should be vigilant. Mitigation requires enhanced email filtering, user training against phishing, and monitoring for unusual . NET process behavior and cryptographic API usage.
Europol has dismantled a SIM box operation that rented out phone numbers to facilitate various cybercrime activities. SIM boxes are devices that use multiple SIM cards to route calls over the internet, often enabling fraud, spam, and evasion of telecommunication controls. This operation's takedown disrupts a critical enabler for cybercriminals who rely on rented numbers to mask their identities and conduct illicit activities. European organizations face risks from such schemes as they can be targeted by fraud, phishing, and other attacks leveraging these rented numbers. The threat is high due to the scale and sophistication of the operation, although no direct exploits or vulnerabilities are involved. Mitigation requires enhanced telecommunication monitoring, collaboration with law enforcement, and improved detection of anomalous call patterns. Countries with significant telecom infrastructure and high cybercrime activity, such as the UK, Germany, France, Italy, and the Netherlands, are most likely affected. The severity is assessed as high given the impact on confidentiality and fraud potential, ease of exploitation by criminals, and broad scope of affected telecom services. Defenders should prioritize monitoring for SIM box activity and cooperate with authorities to reduce the availability of rented numbers for cybercrime.
The U.S.is the top target for cyberattacks, with criminals and foreign adversaries targeting companies, governments and organizations. The post Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US appeared first on SecurityWeek .
Attackers are embedding blocks of links that lead to porn sites, online casinos, and the like. We explain their objective, and how to protect your website.
Microsoft has revoked 200 fraudulent digital certificates that were used in the Rhysida ransomware campaign. These certificates were exploited by attackers to sign malicious payloads, helping them evade detection and appear legitimate. The revocation disrupts the attackers' ability to use these certificates for code signing, thereby mitigating part of the threat. The Rhysida ransomware campaign remains a high-severity threat due to its use of trusted certificates to facilitate malware distribution. European organizations, especially those with high reliance on Microsoft ecosystems and critical infrastructure, could be targeted. The campaign highlights the ongoing risk of certificate-based trust abuse in ransomware operations. Defenders should prioritize monitoring for suspicious signed binaries and ensure robust certificate validation processes. Countries with significant Microsoft product usage and critical infrastructure sectors are at elevated risk. Immediate mitigation includes updating certificate revocation lists and enhancing endpoint detection capabilities to identify signed malware. The threat is assessed as high severity given the impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted certificates and no need for user interaction once infection vectors are triggered.
This threat report highlights ransomware attacks disproportionately impacting small businesses, emphasizing both financial and psychological damage. It details a new malware campaign by the North Korean group Famous Chollima, which targets job seekers with trojanized applications to steal credentials and cryptocurrency. The campaign employs multiple tactics including credential dumping, phishing, and malware execution techniques. The report stresses the importance of empathetic leadership and comprehensive incident response plans that address technical and human factors. Indicators include multiple malware hashes linked to this campaign. The threat is medium severity due to its targeted nature, impact on confidentiality and availability, and the exploitation complexity. European small businesses, especially those with limited cybersecurity resources, are at heightened risk. Mitigation requires tailored incident response, user awareness focused on job seeker scams, and credential protection strategies. Countries with significant small business sectors and exposure to North Korean threat activity are most likely affected.
