Chinese threat actors have exploited a geo-mapping tool to maintain persistent access within targeted environments for over a year. This abuse leverages the legitimate functionality of the geo-mapping software to evade detection and sustain long-term presence. The threat is characterized by stealthy operations, making it difficult for defenders to identify and remove the adversary. While no known exploits are currently active in the wild, the persistence mechanism poses a significant risk to confidentiality and integrity of affected systems. European organizations using similar geo-mapping tools or related infrastructure could be targeted, especially those in strategic sectors. Mitigation requires focused monitoring of geo-mapping tool usage, anomaly detection, and strict access controls. Countries with high adoption of such tools and geopolitical relevance to China are at greater risk. The threat is assessed as high severity due to the potential for prolonged undetected compromise and sensitive data exposure.
Hackers have posted over 1 Tb of information allegedly stolen from Harvard on the Cl0p data leak website. The post Harvard Is First Confirmed Victim of Oracle EBS Zero-Day Hack appeared first on SecurityWeek .
Users can continue receiving important security updates for Windows 10 by enrolling in the ESU program. The post Windows 10 Still on Over 40% of Devices as It Reaches End of Support appeared first on SecurityWeek .
TA585 is a sophisticated cybercriminal threat actor that operates its entire attack chain, from infrastructure to email delivery and malware installation. The actor demonstrates innovation in the evolving cybercrime landscape, using unique web injection campaigns and complex filtering techniques. TA585 frequently delivers MonsterV2, a versatile malware with remote access trojan, loader, and stealer capabilities. MonsterV2 is used by multiple threat actors and avoids infecting computers in Commonwealth of Independent States countries. The malware is actively maintained and updated, with pricing ranging from $800 to $2,000 per month. TA585's campaigns often involve compromised websites, fake CAPTCHAs, and GitHub-themed attacks to deliver various payloads.
Oracle has released an emergency patch addressing a critical security flaw in its E-Business Suite. Although specific technical details about the vulnerability are not disclosed, the severity is rated critical, indicating a high risk of exploitation. No known exploits are currently reported in the wild, but the urgency of the patch suggests potential for significant impact if left unpatched. European organizations using Oracle E-Business Suite should prioritize applying this patch to prevent possible compromise. The flaw could affect confidentiality, integrity, and availability of enterprise resource planning data and processes. Countries with a high adoption of Oracle E-Business Suite and significant enterprise infrastructure are most at risk. Immediate mitigation involves deploying the official patch and reviewing access controls and monitoring for suspicious activity. Given the critical nature and potential for broad impact, this vulnerability demands swift action to avoid operational disruption or data breaches.
Threat actors used automation to create over 175 malicious NPM packages targeting more than 135 organizations. The post NPM Infrastructure Abused in Phishing Campaign Aimed at Industrial and Electronics Firms appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 13th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Qilin ransomware group has claimed responsibility for targeting Asahi, Japan’s largest brewing company, that had been hacked on September 29th. The attack resulted in the exfiltration of over 9,300 files totaling 27GB […] The post 13th October – Threat Intelligence Report appeared first on Check Point Research .
A phishing campaign using fake 'Inflation Refund' text messages is targeting New Yorkers, attempting to deceive recipients into revealing sensitive information or installing malware. The scam exploits current economic concerns to lure victims with promises of financial relief. Although primarily reported in New York, the tactic could potentially spread to other regions. The attack does not require prior authentication but relies on user interaction to succeed. There are no known exploits in the wild beyond the phishing messages themselves. The threat poses a high risk due to potential financial loss and identity theft. European organizations should be aware of similar scams exploiting economic anxieties. Mitigation requires user education, robust SMS filtering, and verification procedures for unsolicited financial communications. Countries with significant US financial or diaspora connections may be more exposed. Overall, the threat severity is assessed as high due to its social engineering effectiveness and potential impact on confidentiality and financial integrity.
Blind enumeration of gRPC services exploits subtle differences in error messages returned by gRPC servers when invalid requests are made. Attackers can map available services and methods even when server reflection is disabled, by sending crafted requests and analyzing error codes such as UNIMPLEMENTED, NOT_FOUND, and INVALID_ARGUMENT. This technique reveals service sprawl, method proliferation, and inconsistent authentication controls, often arising from partial migrations and fragmented development teams. Although crafting valid protobuf messages still requires additional effort, enumerating service existence significantly aids attackers in reconnaissance. The threat is particularly relevant for organizations using gRPC-based microservices architectures without strict security controls or proper network segmentation. European organizations with complex service deployments and legacy microservices are at risk of information disclosure and potential unauthorized access. Mitigation involves strict authentication enforcement on all methods, network segmentation of internal services, disabling or tightly controlling reflection endpoints, and regular audits for service sprawl and auth drift. Countries with strong technology sectors and widespread gRPC adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. The severity is assessed as medium due to the information disclosure nature, the need for some attacker effort, and the lack of direct remote code execution or data manipulation without further exploitation.
A widespread compromise of SonicWall VPN accounts has been reported, impacting over 100 accounts. The incident involves unauthorized access to SonicWall VPN services, potentially allowing attackers to infiltrate corporate networks. While detailed technical specifics and exploit methods are not disclosed, the high severity rating indicates significant risk to confidentiality and network integrity. European organizations using SonicWall VPN solutions may face elevated risks of data breaches and lateral movement within their infrastructure. No known public exploits have been confirmed yet, but the threat remains active and evolving. Mitigation requires immediate review of VPN access logs, enforcement of multi-factor authentication, and prompt application of any vendor patches or configuration hardening. Countries with high SonicWall adoption and critical infrastructure reliance on VPNs are most vulnerable. The threat severity is assessed as high due to the potential for unauthorized access without user interaction and the broad scope of affected accounts. Defenders should prioritize monitoring, incident response readiness, and user credential protection to mitigate impact.
A recent report details a method to bypass Air Canada's in-flight network restrictions, potentially allowing unauthorized access to restricted network segments or services during flights. The technique involves exploiting weaknesses in the network segmentation or filtering controls implemented on the aircraft's Wi-Fi system. While no known exploits are currently active in the wild, the medium severity rating reflects the potential for unauthorized network access and data exposure. European organizations with employees frequently traveling on Air Canada flights or using similar in-flight networks could face risks of data interception or unauthorized access. Mitigation requires enhanced network segmentation, robust filtering rules, and continuous monitoring of in-flight network traffic. Countries with high volumes of transatlantic flights to Canada, such as the UK, Germany, and France, are more likely to be affected. Given the ease of exploitation and potential confidentiality impact but limited scope and no authentication bypass, the threat is assessed as medium severity. Defenders should prioritize awareness and technical controls to prevent misuse of in-flight network access.
Microsoft has issued a warning about a threat actor group dubbed 'Payroll Pirates' who are targeting HR SaaS accounts to hijack payroll systems and steal employee salaries. These attackers gain unauthorized access to cloud-based HR platforms, manipulate payroll data, and redirect salary payments to fraudulent accounts. The threat primarily affects organizations using SaaS HR and payroll solutions, which are widely adopted across Europe. Exploitation does not require exploiting a software vulnerability but relies on credential compromise, phishing, or social engineering to access accounts. The impact includes financial loss, reputational damage, and potential regulatory penalties due to payroll fraud and data breaches. European organizations with large payroll operations and cloud HR deployments are at heightened risk. Mitigation requires enhanced identity and access management, multi-factor authentication, continuous monitoring of payroll transactions, and employee training. Countries with significant SaaS adoption and large enterprise sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the high financial impact and ease of exploitation through compromised credentials, the threat severity is assessed as high.
Other noteworthy stories that might have slipped under the radar: US universities targeted by payroll pirates, Zimbra vulnerability exploited, Mic-E-Mouse attack. The post In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware appeared first on SecurityWeek .
GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure. The post Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign appeared first on SecurityWeek .
The botnet packs over 50 exploits targeting unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices. The post RondoDox Botnet Takes ‘Exploit Shotgun’ Approach appeared first on SecurityWeek .
Supply chain attacks have surged by 250% from 2021 to 2024, with third-party vendor compromise accounting for 45% of incidents. These attacks have a longer average dwell time (287 days) compared to direct attacks (207 days), indicating significant detection challenges. The financial impact is substantial, with supply chain attacks costing an average of $5.12 million per incident. CISA has issued an emergency directive emphasizing zero-trust architecture, Software Bill of Materials (SBOM) requirements, and continuous vendor risk assessments to mitigate these threats. European organizations face heightened risks due to their reliance on complex vendor ecosystems and critical infrastructure. Countries with dense technology sectors and critical infrastructure, such as Germany, France, and the UK, are particularly vulnerable. Mitigation requires tailored vendor risk management, adoption of SBOM tools, and enhanced monitoring of supply chain interactions. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation through trusted vendors, and broad scope, this threat is assessed as critical severity.
The FBI has taken down the BreachForums portal, a dark web platform used to facilitate extortion campaigns targeting Salesforce and potentially other organizations. BreachForums was known for hosting stolen data and enabling ransomware and extortion actors to communicate and distribute sensitive information. This takedown disrupts a key infrastructure used by cybercriminals for extortion and data breaches. Although no specific CVEs or exploits are mentioned, the threat involved real-world breaches and extortion attempts impacting organizations relying on Salesforce services. European organizations using Salesforce or related cloud services could have been targeted for data theft or extortion. The FBI's action reduces the immediate risk but highlights the ongoing threat of criminal forums facilitating ransomware and data breaches. Mitigation requires enhanced monitoring for extortion attempts, securing Salesforce environments, and incident response readiness. Countries with high Salesforce adoption and critical infrastructure reliant on cloud services are most at risk. Given the high impact on confidentiality and integrity, ease of exploitation via social engineering or credential compromise, and the broad scope of affected organizations, the severity is assessed as high.
There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
SonicWall has disclosed that hackers breached all of its firewall backup systems, potentially exposing sensitive firewall configurations and related data. This breach could allow attackers to analyze backup data to identify vulnerabilities or gain unauthorized access to networks protected by SonicWall firewalls. Although no known exploits are currently reported in the wild, the compromise of backup data represents a significant risk to confidentiality and network integrity. European organizations using SonicWall firewalls may face increased risk of targeted attacks or lateral movement within their networks. Immediate mitigation involves verifying backup integrity, rotating credentials, and enhancing monitoring for suspicious activity. Countries with high SonicWall market penetration and critical infrastructure reliance on these firewalls are at greater risk. Given the breach scope and potential impact, the severity is assessed as high. Defenders should prioritize incident response, forensic analysis, and communication with SonicWall for remediation updates.
