The RondoDox botnet is actively targeting 56 known n-day vulnerabilities in a series of worldwide attacks. These n-day flaws represent previously disclosed but unpatched security issues across multiple products and platforms. Although no known exploits in the wild have been confirmed yet, the botnet's broad targeting and high-priority classification indicate a significant threat. The attacks are global, leveraging the botnet's capability to scan and exploit vulnerable systems that remain unpatched. European organizations are at risk, especially those with delayed patch management or using affected software. The botnet's exploitation could lead to compromised confidentiality, integrity, and availability of systems. Mitigation requires rapid identification of vulnerable systems, prioritized patching, and enhanced network monitoring for anomalous botnet activity. Countries with high technology adoption and critical infrastructure reliance on vulnerable platforms are most at risk. Given the scope and ease of exploitation of known vulnerabilities without authentication, the threat severity is assessed as high. Defenders should focus on proactive vulnerability management and network defenses to mitigate this evolving botnet threat.
UTA0388 is a threat actor group known for espionage malware campaigns evolving from the HealthKick malware to the more recent GOVERSHELL variant. This malware family targets sensitive information through advanced persistence and stealth techniques, indicating a focus on long-term intelligence gathering. Although no known exploits are currently active in the wild, the malware's evolution suggests increasing sophistication and potential for targeted attacks. European organizations, especially those in government, healthcare, and critical infrastructure sectors, could be prime targets given the espionage nature of the malware. The threat is considered high severity due to its potential impact on confidentiality and integrity, combined with the difficulty of detection and removal. Mitigation requires proactive threat hunting, network segmentation, and enhanced monitoring for unusual behaviors linked to GOVERSHELL. Countries with significant government and healthcare digital infrastructure, such as Germany, France, and the UK, are likely to be most affected. The threat actor's focus on espionage aligns with geopolitical interests in Europe, increasing the risk to strategic targets. Defenders should prioritize intelligence sharing and implement advanced endpoint detection and response capabilities to mitigate this evolving threat.
Threat actors have begun leveraging the Velociraptor digital forensics and incident response (DFIR) tool as part of ransomware attack campaigns. Velociraptor, originally designed for legitimate forensic investigations and incident response, is being repurposed by attackers to facilitate lateral movement, reconnaissance, and data collection within compromised networks. This misuse enhances attackers' ability to identify valuable targets and escalate privileges before deploying ransomware payloads. The threat is considered high severity due to the tool's powerful capabilities, ease of use, and the significant impact ransomware attacks can have on confidentiality, integrity, and availability of systems. European organizations, especially those with critical infrastructure and large enterprise environments, face increased risk given the tool’s effectiveness in complex networks. Mitigation requires tailored detection of Velociraptor usage patterns, strict endpoint monitoring, and network segmentation to limit attacker movement. Countries with high adoption of enterprise IT infrastructure and critical sectors such as finance, manufacturing, and government are most likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the potential for widespread disruption, ease of exploitation by skilled attackers, and the critical nature of impacted assets.
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.
This entry describes a security analysis of a medical device, focusing on the methods and findings of the assessment. The information is sourced from a Reddit NetSec post linking to an external site, cc-sw.com, which hosts the detailed analysis. No specific vulnerabilities, exploits, or affected device versions are detailed in the provided data. The severity is marked as medium, but no CVSS score is available. There are no known exploits in the wild, and the discussion level on Reddit is minimal. The content appears to be an informational security analysis rather than a direct report of an active threat or vulnerability. European organizations using similar medical devices could benefit from reviewing such analyses to understand potential risks. However, without concrete vulnerability details or exploit data, the immediate threat level remains uncertain. Mitigation would involve following best practices for medical device security and monitoring for updates from device manufacturers.
Hackers have stolen approximately 70,000 government ID photos from Discord, a popular communication platform. Discord has publicly acknowledged the breach but dismissed claims that the attackers attempted extortion. The stolen data primarily consists of sensitive government-issued identification images, raising concerns about privacy and potential misuse. There is no evidence of active exploitation or widespread impact beyond the data theft. The incident highlights risks associated with storing sensitive personal information on third-party platforms. European organizations using Discord for official or semi-official communications may face increased exposure to identity theft or social engineering attacks. Mitigation should focus on minimizing sensitive data exposure on such platforms and enhancing monitoring for suspicious activities. Countries with high Discord usage and significant government digital engagement are more likely to be affected. The severity is assessed as medium due to the sensitivity of the data and lack of confirmed active exploitation.
A recent security news report reveals that all SonicWall Cloud Backup users have their firewall configuration files stored in a manner that may expose sensitive information. This exposure could potentially allow unauthorized access to firewall settings, leading to risks such as network compromise or data leakage. Although no known exploits are currently active in the wild, the high severity rating indicates significant potential impact. The threat primarily affects organizations using SonicWall Cloud Backup services, which are widely deployed in Europe. Attackers gaining access to these configuration files could manipulate firewall rules, bypass security controls, or extract confidential network topology information. Immediate attention is required to assess and secure backup storage configurations. European organizations, especially those in countries with high SonicWall adoption and critical infrastructure, should prioritize mitigation steps. No CVSS score is available, but the threat is assessed as high severity due to the sensitivity of the data and potential for exploitation without user interaction or authentication. Defenders should review backup storage policies, enforce strict access controls, and monitor for unusual access patterns to mitigate this risk.
Hacktivists have targeted critical infrastructure but mistakenly attacked a decoy plant designed to mislead attackers. This incident highlights the increasing risk posed by hacktivist groups to vital infrastructure sectors. Although no known exploits are currently in the wild, the critical nature of the target and the attacker's intent underscore the potential severity of such threats. European organizations operating critical infrastructure should be vigilant, as these sectors are often high-value targets. The attack on a decoy suggests defenders are employing deception tactics to detect and mitigate intrusions. This event emphasizes the need for robust cybersecurity measures, including threat intelligence, network segmentation, and incident response readiness. No specific vulnerabilities or affected versions are identified, limiting detailed technical mitigation steps. The threat is assessed as critical due to the potential impact on availability and integrity of essential services. Countries with significant critical infrastructure and geopolitical exposure in Europe are most likely to be affected. Defenders must prioritize proactive monitoring and deception strategies to counter similar hacktivist campaigns.
Hidden comments allowed full control over Copilot responses and leaked sensitive information and source code. The post GitHub Copilot Chat Flaw Leaked Data From Private Repositories appeared first on SecurityWeek .
A new malvertising campaign is distributing fake Microsoft Teams installers that deploy the Oyster backdoor, also known as Broomstick. This malware enables attackers to maintain persistent unauthorized access to infected systems. The campaign leverages deceptive advertising to trick users into downloading and executing malicious installers masquerading as legitimate Teams software. Although no known exploits are reported in the wild yet, the threat poses a medium severity risk due to its potential for espionage and data exfiltration. European organizations using Microsoft Teams are at risk, especially those with less stringent software verification processes. Attackers could leverage this backdoor to compromise confidentiality and integrity of sensitive information. Mitigation requires user education, strict verification of software sources, and enhanced endpoint detection capabilities. Countries with high Teams adoption and strategic sectors such as finance and government are more likely to be targeted. The threat is assessed as medium severity given the malware’s capabilities, delivery method, and lack of required user interaction beyond initial installation.
The company said there is no evidence that confidential client data was stolen from its systems. The post Chinese Hackers Breached Law Firm Williams & Connolly via Zero-Day appeared first on SecurityWeek .
The FileFix attack is a newly identified campaign that leverages cache smuggling techniques to bypass security software detection. By exploiting caching mechanisms, attackers can deliver malicious payloads that evade traditional scanning and filtering tools. This method complicates detection as the malicious content is hidden within cached data, making it less visible to security controls. Although no known exploits are currently active in the wild, the attack's high severity rating indicates significant potential risk. European organizations, especially those relying on caching proxies or web security gateways, could be targeted due to the attack's evasion capabilities. Mitigation requires advanced monitoring of cache behavior, strict validation of cached content, and deployment of security solutions capable of inspecting cached data. Countries with high adoption of web caching infrastructure and critical industries such as finance and manufacturing are more likely to be impacted. Given the attack's ability to compromise confidentiality and integrity without requiring user interaction, and its ease of exploitation through common caching mechanisms, the suggested severity is high. Defenders should prioritize understanding cache smuggling vectors and updating their security policies accordingly.
In early September, hackers stole the firewall configuration backup files stored using the MySonicWall service. The post All SonicWall Cloud Backup Users Had Firewall Configurations Stolen appeared first on SecurityWeek .
The hackers claim the theft of over 2 million photos of government identification documents provided to Discord for age verification. The post Discord Says 70,000 Users Had IDs Exposed in Recent Data Breach appeared first on SecurityWeek .
Two teenagers were arrested by UK police in connection with a ransomware attack targeting a nursery, known as the Kido ransomware incident. The attack involved encrypting data and demanding ransom, disrupting operations at the affected childcare facility. While the ransomware strain is not widely reported as exploited in the wild, this case highlights the ongoing threat ransomware poses to small organizations. The arrest demonstrates law enforcement's increasing focus on cybercrime involving younger perpetrators. European organizations, especially small businesses and critical service providers, remain at risk from similar ransomware attacks. Mitigation requires proactive backup strategies, network segmentation, and user awareness to prevent initial compromise. The UK is the most directly affected country due to the location of the incident and arrests. Given the medium severity rating and limited exploitation scope, the threat is serious but not critical. Defenders should prioritize ransomware resilience and incident response readiness to mitigate impact from such attacks.
Over the course of three months, Volexity observed UTA0388 using various themes and fictional identities across dozens of spear phishing campaigns. As time passed, Volexity observed UTA0388 broaden their targeting and send emails in a variety of different languages, including English, Chinese, Japanese, French, and German. In most cases, the initial email sent by UTA0388 contained a link to phishing content hosted on a cloud-based service that would lead to malware.
Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States. Since March 2025, Mandiant Consulting has responded to intrusions across a range of industry verticals, most notably legal services, Software as a Service (SaaS) providers, Business Process Outsourcers (BPOs), and Technology. The value of these targets extends beyond typical espionage missions, potentially providing data to feed development of zero-days and establishing pivot points for broader access to downstream victims.
A phishing campaign leverages Zoom's document sharing feature to establish initial trust with victims. The attack directs users through a fake bot protection page before presenting a Gmail-like login interface to harvest credentials. Entered credentials are transmitted to the attacker via WebSocket and validated on the backend. This technique exploits user trust in Zoom and mimics legitimate Gmail login to increase success rates. The campaign is currently observed with minimal discussion and no known widespread exploitation. It poses a medium risk due to credential compromise potential without requiring advanced exploitation or vulnerabilities. European organizations using Gmail and Zoom are at risk, especially those with remote workforces relying on these platforms. Attackers can gain unauthorized access to email accounts, leading to data breaches and further attacks. Mitigation requires user awareness, multi-factor authentication enforcement, and monitoring for suspicious login attempts. Countries with high Zoom and Gmail usage and significant remote work adoption are most likely affected.
