Threats affecting Belgium

UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.

Malware#smart contracts#blockchainGermany+9

A phishing campaign is impersonating LastPass by sending scam emails with alarming subjects like 'We Have Been Hacked' to trick users into clicking malicious links. These links lead to fake websites hosted on domains such as lastpassdesktop.com, designed to steal credentials and secret keys, potentially compromising users' password vaults. LastPass has confirmed it has not been breached and is actively working with partners like Cloudflare to take down these fraudulent domains and warn users. Similar phishing attacks have targeted other password managers, increasing the risk to users relying on these services. The campaign leverages social engineering tactics to create urgency and exploit trust in the LastPass brand. No direct system vulnerabilities are exploited, but the threat targets user credentials through deception. European organizations using LastPass or similar password managers are at risk of credential theft if users fall for these scams. Mitigation requires user education, domain blocking, and enhanced email filtering to detect and prevent phishing attempts.

Campaign#phishing#credential theftGermany+9

The China-linked advanced persistent threat (APT) group known as Jewelbug has conducted a rare cross-nation cyberattack targeting a Russian IT provider. This campaign represents an unusual geopolitical targeting pattern, as it involves a Chinese APT focusing on a Russian entity. The attack is characterized by medium severity, with no known exploits in the wild or publicly disclosed technical details. The campaign was reported recently and is considered newsworthy due to its geopolitical implications and the involvement of a sophisticated threat actor. There are no specific affected software versions or vulnerabilities disclosed, and the attack details remain limited. European organizations should be aware of potential indirect impacts, especially those with ties to Russian IT infrastructure or supply chains. Mitigation should focus on enhanced monitoring for APT tactics, supply chain security, and cross-border intelligence sharing. Countries with significant IT service dependencies on Russian providers or geopolitical interest in Sino-Russian relations are more likely to be affected. Given the medium severity and limited technical details, the threat requires vigilance but does not currently indicate an immediate critical risk to European entities.

Campaign#infosecnews#redditGermany+6

LinkPro is a newly discovered Linux rootkit that leverages eBPF (extended Berkeley Packet Filter) technology to stealthily hide its presence on infected systems. It activates upon receiving specially crafted 'magic' TCP packets, allowing attackers to control compromised hosts covertly. This rootkit's use of eBPF, a legitimate kernel feature, makes detection challenging as it operates at a low level within the Linux kernel. Although no known exploits are currently reported in the wild, the rootkit's capabilities pose a significant risk to Linux-based infrastructure. European organizations relying on Linux servers, especially those exposed to external networks, could be targeted. The rootkit threatens system confidentiality, integrity, and availability by enabling persistent unauthorized access and potential data exfiltration or sabotage. Mitigation requires advanced monitoring of eBPF programs, network traffic analysis for anomalous TCP packets, and strict kernel security policies. Countries with high Linux adoption in critical sectors and strategic geopolitical relevance are more likely to be affected. Given its stealth, activation method, and potential impact, this threat is assessed as high severity. Defenders should prioritize detection and containment strategies tailored to eBPF misuse and network-based triggers.

News#infosecnews#redditGermany+9

A maximum-severity vulnerability in Adobe software has been confirmed by CISA to be actively exploited in the wild. Although specific affected versions and technical details are not provided, the flaw is rated high severity and is now leveraged by attackers. This exploitation poses significant risks to confidentiality, integrity, and availability of affected systems. European organizations using Adobe products are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires immediate patching once updates are available, enhanced monitoring for exploitation attempts, and restricting Adobe software usage where possible. Countries with high Adobe market penetration and strategic digital infrastructure, such as Germany, France, and the UK, are likely most impacted. Given the active exploitation and high severity, the threat is assessed as critical. Defenders should prioritize vulnerability management and incident detection related to Adobe products to reduce exposure.

News#infosecnews#redditGermany+7

Hackers are leveraging blockchain smart contracts as a novel vector to distribute malware through compromised WordPress websites. This attack involves embedding malicious payloads or commands within blockchain smart contracts, which are then referenced or executed via infected WordPress sites, enabling malware propagation. The technique exploits the decentralized and immutable nature of blockchain to evade traditional detection and takedown methods. European organizations using WordPress for their web presence are at risk, especially those with limited security controls or outdated plugins. The attack can compromise confidentiality, integrity, and availability of affected systems, potentially leading to data breaches or service disruptions. Mitigation requires advanced monitoring of blockchain interactions, securing WordPress installations, and implementing strict content validation. Countries with high WordPress adoption and significant blockchain development or usage are more likely to be targeted. Given the complexity and stealth of this attack vector, the threat is assessed as high severity. Defenders should prioritize detection of anomalous blockchain-related activities and ensure robust WordPress security hygiene.

Malware#infosecnews#redditGermany+7

North Korea's Chollima hacker group is deploying BeaverTail and OtterCookie malware as part of a job scam campaign. These malware families are used to compromise victims who respond to fraudulent job offers, enabling espionage and data theft. The campaign leverages social engineering to trick targets into executing malicious payloads. While no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential impact on confidentiality and organizational security. European organizations, especially those with remote hiring processes or in strategic sectors, could be targeted. Mitigation requires enhanced email filtering, user awareness training focused on job scams, and endpoint detection tuned for these malware signatures. Countries with significant exposure to North Korean cyber activities and large multinational corporations are at higher risk. The threat is medium severity given the moderate impact and social engineering exploitation vector without direct zero-day exploits or widespread automation.

Malware#infosecnews#redditGermany+7

The tech giant attributed the attacks to Vanilla Tempest, also known as Vice Spider and Vice Society. The post Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign appeared first on SecurityWeek .

MalwareGermanyFrance+8

Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in Windows. We promptly reported this issue to Microsoft and they fixed the vulnerability starting with OS Build 26100.4202 in the KB5058499 update preview released on May 28th 2025. In the following sections, we […] The post Denial of Fuzzing: Rust in the Windows kernel appeared first on Check Point Research .

Analysis#windowsGermany+10

A new tech support scam is leveraging the Microsoft logo to create a fake browser lock screen, tricking users into believing their system is compromised. This phishing attack aims to steal sensitive data by convincing victims to contact fraudulent support services. The scam does not exploit software vulnerabilities but relies on social engineering and visual deception. It has been recently reported on Reddit and covered by hackread.com, indicating emerging awareness but minimal current discussion or exploitation. European organizations and users are at risk due to the widespread use of Microsoft products and browsers. The scam's impact includes potential data theft, financial loss, and reputational damage. Mitigation requires user education, browser security enhancements, and blocking known scam domains. Countries with high Microsoft product adoption and significant digital infrastructure are most likely to be targeted. Given the ease of exploitation and potential data compromise without technical exploitation, the threat severity is assessed as medium.

Phishing#infosecnews#redditGermany+8

WireTap and Battering RAM — two independent theoretical papers — demonstrated the feasibility of attacks on trusted execution environments (TEEs).

AnalysisGermanyFrance+8

F5 has released high-priority security patches for its BIG-IP product line to address vulnerabilities that were disclosed following the theft of security details. Although no known exploits are currently active in the wild, the vulnerabilities are considered serious and could potentially allow attackers to compromise affected systems. The patches are critical for organizations using BIG-IP devices, which are widely deployed for application delivery and network security. European organizations relying on F5 BIG-IP infrastructure should prioritize patching to prevent potential exploitation. The threat primarily impacts confidentiality and integrity, with possible availability concerns if exploited. No specific affected versions or technical details were provided, limiting precise risk assessment. The threat severity is assessed as high due to the nature of the vulnerabilities and the critical role of BIG-IP in network environments. Countries with significant F5 BIG-IP deployments and critical infrastructure are at greater risk. Immediate mitigation involves applying the official patches and monitoring for suspicious activity related to BIG-IP devices.

News#infosecnews#redditGermany+7

Microsoft's October 2025 Patch Tuesday addresses 175 vulnerabilities, including three zero-day flaws. While no known exploits are currently reported in the wild, these zero-days represent significant security risks if left unpatched. The update covers a broad range of Microsoft products, potentially affecting many organizations globally. European entities relying on Microsoft technologies should prioritize timely patching to mitigate risks of exploitation. The medium severity rating reflects the broad impact but currently limited exploitation evidence. Attackers could leverage these vulnerabilities to compromise confidentiality, integrity, or availability of systems. No detailed technical specifics or affected versions are provided, limiting precise risk assessment. Organizations should monitor for further technical disclosures and threat intelligence updates. Proactive patch management and vulnerability scanning remain critical defenses. Countries with high Microsoft usage and strategic digital infrastructure are most at risk.

News#infosecnews#redditGermany+9

Clothing retailer MANGO has disclosed a data breach that exposed customer information. The breach was recently reported and confirmed by a trusted cybersecurity news source. Although specific technical details and the extent of the breach have not been fully disclosed, the incident is classified as high severity due to the exposure of sensitive customer data. There are no known exploits in the wild linked to this breach at this time. The breach highlights risks related to data confidentiality and potential misuse of personal information. European organizations, especially those in retail and e-commerce sectors, should be alert to similar threats. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and preparing incident response plans. Countries with significant MANGO customer bases and retail sectors are most likely to be impacted. The overall severity is assessed as high given the potential impact on customer privacy and brand reputation without requiring user interaction or authentication to exploit the breach.

Breach#infosecnews#redditSpain+6

Recent reports highlight that certain satellites transmit communications without encryption, exposing global data to interception. This lack of encryption allows adversaries to eavesdrop on sensitive transmissions, potentially compromising confidentiality and operational security. Although no known exploits are currently active in the wild, the inherent vulnerability poses a medium-level risk due to the critical nature of satellite communications. European organizations relying on satellite links for data, especially in defense, maritime, and remote infrastructure sectors, face increased exposure. Mitigation requires immediate assessment of satellite communication channels, implementation of encryption protocols, and monitoring for unauthorized interception attempts. Countries with significant satellite communication infrastructure and strategic interests in space and defense, such as France, Germany, the UK, and Italy, are most likely to be affected. The threat is medium severity given the ease of passive interception, the broad scope of affected systems, and the absence of required authentication or user interaction. Defenders should prioritize securing satellite links and raising awareness of this exposure to prevent data leakage and espionage.

News#infosecnews#redditFrance+7

The "BlackSuit Blitz" is a ransomware attack campaign targeting a global equipment manufacturer, as detailed by Palo Alto Networks' Unit 42. This malware campaign involves sophisticated tactics to infiltrate corporate networks and encrypt critical data, disrupting operations. Although the attack is rated medium severity and no known exploits are currently in the wild, the threat demonstrates the potential for significant operational impact. European organizations in manufacturing and critical infrastructure sectors could be at risk due to the global nature of the targeted industry. The attack does not require known vulnerabilities or specific affected software versions, indicating a possible use of social engineering or credential compromise. Mitigation requires enhanced network segmentation, proactive threat hunting, and employee awareness training tailored to ransomware tactics. Countries with strong manufacturing bases and critical infrastructure, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the medium severity, the attack poses a moderate risk to confidentiality, integrity, and availability, with exploitation complexity likely moderate and no indication of user interaction requirements. Defenders should prioritize detection of lateral movement and ransomware behaviors and implement robust backup and recovery strategies.

Malware#infosecnews#redditGermany+7

Two critical vulnerabilities with CVSS scores of 10.0 have been discovered in Red Lion Remote Terminal Units (RTUs), which are widely used in industrial control systems (ICS). These bugs could allow attackers to gain full control over affected RTUs, potentially compromising industrial processes and critical infrastructure. Although no known exploits are currently in the wild, the severity and potential impact of these flaws are extremely high. The vulnerabilities could lead to unauthorized remote access, manipulation of control commands, and disruption of industrial operations. European organizations relying on Red Lion RTUs in sectors such as energy, manufacturing, and utilities are at significant risk. Immediate mitigation steps include applying vendor patches once available, segmenting ICS networks, and enhancing monitoring for unusual activity. Countries with substantial industrial infrastructure and critical ICS deployments, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation and the critical nature of the impact, the suggested severity is critical. Defenders must prioritize identifying affected devices and implementing compensating controls to prevent potential industrial sabotage or operational disruption.

News#infosecnews#redditGermany+7

For a while, clipboard content has been monitored by many infostealers. Purposes can be multiple, like simply searching and exfiltrating juicy data or on-the-fly modification like crypto-wallet swapping&&#x23&#x3b;x26&#x3b;&#x23&#x3b;x5b&#x3b;1&&#x23&#x3b;x26&#x3b;&#x23&#x3b;x5d&#x3b;. Note that the clipboard is a major risk when you don&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;t disable clipboard sharing between your virtual machines and hosts. A malware running in a sandbox will access your (host) clipboard without problem!

Malware#pythonGermany+7

A recent malware campaign uses SEO poisoning on Bing to distribute a trojanized Ivanti Pulse Secure VPN client via lookalike domains. Users are tricked into downloading a malicious MSI installer that steals VPN credentials from the connectionstore.dat file. Stolen credentials are exfiltrated to a command and control server hosted on Azure infrastructure. The attack employs signed executables and referrer-based conditional content delivery to evade detection. This credential theft technique has been linked to subsequent Akira ransomware deployments. Organizations are advised to implement multi-factor authentication, conduct user awareness training, and monitor for suspicious network and endpoint activity. No CVE or known exploits in the wild are reported yet. The threat poses a medium severity risk due to credential compromise and potential ransomware follow-on attacks. European organizations using Ivanti Pulse Secure VPN are at risk, especially in countries with high adoption of this VPN solution and critical infrastructure sectors.

Malware#ivanti#credential theftGermany+7

A newly discovered Android vulnerability, dubbed 'Pixnapping,' allows malicious apps to steal two-factor authentication (2FA) codes without requiring any special permissions. This flaw exploits a weakness in how Android handles screen content or notifications, enabling rogue applications to capture sensitive 2FA codes silently. Although no known exploits are currently in the wild, the high severity rating indicates significant risk if weaponized. European organizations relying on Android devices for 2FA could face increased risks of account compromise and unauthorized access. Mitigation requires immediate attention to app vetting, restricting app sources, and monitoring for suspicious app behavior. Countries with high Android usage and critical infrastructure reliant on 2FA are most vulnerable. The threat is assessed as high severity due to the potential confidentiality breach, ease of exploitation without permissions, and broad impact scope. Defenders should prioritize patching once available and enhance multi-layered authentication security measures.

News#infosecnews#redditGermany+9