OpenAI has taken action to disrupt cyberattack campaigns by Russian, North Korean, and Chinese threat actors who were misusing ChatGPT to facilitate their malicious activities. These state-sponsored hackers leveraged ChatGPT to generate phishing emails, malware code snippets, and other attack tools, enhancing their operational capabilities. Although no specific software vulnerabilities or exploits are detailed, the misuse of AI language models represents a novel threat vector in cyber operations. The disruption efforts by OpenAI aim to limit the abuse of their platform for cybercrime, thereby reducing the effectiveness of these adversaries. European organizations remain at risk due to the global nature of these threat actors and their targeting of critical infrastructure and enterprises. Mitigations include monitoring for AI-generated phishing attempts, enhancing user awareness, and collaborating with AI providers to detect and block malicious use. Countries with significant digital infrastructure and geopolitical interest, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the high potential impact on confidentiality and integrity and the ease of exploitation via AI-generated content, the threat severity is assessed as high. Defenders should focus on integrating AI misuse detection into their security operations and maintaining vigilance against sophisticated social engineering attacks.
The hackers claim the theft of 27 gigabytes of data, including contracts, employee information, and financial documents. The post Ransomware Group Claims Attack on Beer Giant Asahi appeared first on SecurityWeek .
Today, I spoted on VirusTotal an interesting Python RAT. They are tons of them but this one attracted my attention based on some function names present in the code: self_modifying_wrapper(), decrypt_and_execute() and polymorph_code(). A polymorphic malware is a type of malware that has been developed to repeatedly mutate its appearance or signature files at every execution time. The file got a very low score of 2/64 on VT! (SHA256:7173e20e7ec217f6a1591f1fc9be6d0a4496d78615cc5ccdf7b9a3a37e3ecc3c).
Salesforce has been targeted by widespread data theft attacks involving remote code execution (RCE) attempts. Despite the severity and scale of these breaches, Salesforce has publicly refused to pay ransom demands. The attacks indicate a significant compromise risk to customer data and internal systems, highlighting vulnerabilities in cloud service security. No specific affected versions or patches have been disclosed, and there are no known exploits in the wild yet. The threat is considered high severity due to the potential impact on confidentiality and integrity of sensitive data. European organizations relying on Salesforce services could face indirect impacts through data exposure or service disruption. Mitigation requires enhanced monitoring, strict access controls, and incident response readiness. Countries with high Salesforce adoption and critical cloud infrastructure are most at risk. The threat underscores the importance of robust cloud security practices and ransomware resilience strategies.
Medusa ransomware is reported to be exploiting a vulnerability in the GoAnywhere Managed File Transfer (MFT) software, as confirmed by Microsoft. This exploitation allows attackers to deploy ransomware payloads, potentially encrypting critical files and demanding ransom payments. Although no specific affected versions or CVEs have been disclosed, the threat is considered medium severity due to the potential impact on confidentiality, integrity, and availability of data. The attack vector involves leveraging a flaw in a widely used enterprise file transfer solution, which is common in European organizations for secure data exchange. No known exploits in the wild have been confirmed yet, but the threat is newsworthy and emerging. European organizations using GoAnywhere MFT should prioritize patching and monitoring for suspicious activity. Countries with significant adoption of GoAnywhere MFT and critical infrastructure relying on secure file transfers are at higher risk. Mitigation includes applying vendor patches once available, restricting network access to MFT servers, implementing robust backup strategies, and enhancing detection capabilities for ransomware behaviors. Given the medium severity, proactive defense is essential to prevent potential ransomware incidents impacting business continuity and data security.
Recent research indicates that AI technologies have become the leading channel for data exfiltration within enterprises. This emerging threat leverages AI capabilities to bypass traditional security controls, making detection and prevention more challenging. The use of AI for data theft can involve automated reconnaissance, sophisticated social engineering, and covert data extraction methods. European organizations face increased risks due to widespread AI adoption and the sensitivity of data handled under regulations like GDPR. Mitigation requires tailored strategies including AI behavior monitoring, enhanced data loss prevention tuned for AI patterns, and strict access controls on AI tools. Countries with advanced digital economies and high AI integration, such as Germany, France, and the UK, are particularly vulnerable. Given the high potential impact on confidentiality and integrity, ease of exploitation through AI automation, and broad scope across enterprises, this threat is assessed as high severity. Defenders must prioritize understanding AI-driven exfiltration tactics and adapt their security frameworks accordingly.
BIETA and its subsidiary CIII research develop and sell technologies supporting China’s intelligence, counterintelligence, and military operations. The post Security Firm Exposes Role of Beijing Research Institute in China’s Cyber Operations appeared first on SecurityWeek .
The Mic-E-Mouse attack is a newly reported threat where compromised computer mice are exploited to capture audio conversations. This attack leverages the microphone capabilities embedded or accessible via certain computer mice to eavesdrop on users without their knowledge. Although no specific affected versions or exploits in the wild have been confirmed, the campaign is linked to advanced persistent threat (APT) actors, indicating a targeted and sophisticated approach. The attack does not require user interaction beyond normal mouse use, making it stealthy and potentially widespread. The severity is assessed as medium due to the targeted nature and complexity of exploitation. European organizations, especially those in sensitive sectors, could face confidentiality breaches if such devices are used within their environments. Mitigation requires strict hardware procurement policies, network segmentation, and monitoring for unusual device behavior. Countries with high adoption of advanced peripherals and significant strategic or governmental targets are more likely to be affected. Given the lack of patches or CVSS scoring, the threat is rated medium severity based on impact and exploitation factors.
The Medusa ransomware operators exploited the GoAnywhere MFT vulnerability one week before patches were released. The post Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks appeared first on SecurityWeek .
A critical vulnerability in the GoAnywhere managed file transfer software has been exploited in active ransomware attacks, as reported by Microsoft and covered by BleepingComputer. The flaw allows attackers to execute arbitrary code remotely, enabling ransomware deployment without requiring user interaction or authentication. This vulnerability poses a significant risk to organizations relying on GoAnywhere for secure file transfers, potentially leading to data encryption, operational disruption, and financial loss. European organizations using GoAnywhere are at heightened risk, especially in countries with high adoption of this software in critical infrastructure and enterprise sectors. Immediate patching and enhanced network monitoring are essential to mitigate exploitation. Due to the critical nature and ease of exploitation, this threat demands urgent attention from cybersecurity teams across Europe.
A recently reported security threat involves the potential for attackers to take remote control over industrial generators. While detailed technical specifics are limited, the threat highlights vulnerabilities in the control systems of industrial generators that could be exploited remotely. This could allow adversaries to manipulate generator operations, potentially causing disruptions in power supply or damaging critical infrastructure. The threat is currently assessed as medium severity, with no known exploits in the wild and minimal public discussion. European organizations relying on industrial generators for critical power backup or infrastructure support could face operational risks if targeted. Mitigation requires focused security measures on industrial control systems, including network segmentation, strict access controls, and continuous monitoring for anomalous activity. Countries with significant industrial sectors and critical infrastructure dependent on such generators are more likely to be affected. Given the potential impact on availability and integrity of power systems, and the ease of remote exploitation, this threat is assessed as medium severity. Defenders should prioritize securing generator control interfaces and enhancing incident response capabilities.
Salesforce says the extortion attempts are related to past or unsubstantiated incidents, and not to fresh intrusions. The post Hackers Extorting Salesforce After Stealing Data From Dozens of Customers appeared first on SecurityWeek .
A financially motivated cybercrime operation has been identified, targeting users with over 80 spoofed domain names and lure websites. The campaign, which began in September 2024, focuses on government tax sites, consumer banking, age 18+ social media content, and Windows assistant applications. The actors use these domains to deliver Android and Windows trojans, likely for credential theft. The operation employs common techniques such as spoofed domains and lure websites, prioritizing scale and conversion rates over technical sophistication. The most common lures exploit curiosity and desire, making victims less likely to report infections. Users are advised to be cautious when encountering unfamiliar links or download prompts.
A recent cyberattack on Red Hat's GitLab instance by the Crimson Collective resulted in the theft of approximately 570GB of compressed data, including 28,000 internal repositories and sensitive customer engagement reports containing infrastructure and authentication details. This breach exposes critical intellectual property and sensitive information across multiple sectors. Additional significant incidents include ransomware and data breaches affecting global organizations, highlighting a trend of sophisticated attacks targeting supply chains, manufacturing, and service providers. Notably, vulnerabilities in widely used software such as VMware Aria Operations, Linux sudo, and Fortra’s GoAnywhere MFT have been actively exploited, increasing the attack surface. European organizations relying on Red Hat and related open-source infrastructure are at risk of indirect impacts from leaked credentials and infrastructure details. The threat landscape underscores the need for targeted mitigation strategies focusing on supply chain security, privileged access management, and rapid patching of critical vulnerabilities. Given the scale and sensitivity of the stolen data, the threat severity is assessed as high for European entities.
Wiz has teamed up with Microsoft, Google and AWS and is inviting cloud security researchers to its Zeroday.Cloud competition. The post $4.5 Million Offered in New Cloud Hacking Competition appeared first on SecurityWeek .
The WARMCOOKIE backdoor continues to evolve, with ongoing updates and new infections observed. Recent developments include new handlers for executing various file types, a string bank for defense evasion, and code optimizations. A campaign ID field has been added, providing context for operators. Infrastructure analysis reveals a default SSL certificate potentially used for WARMCOOKIE back-ends. Despite disruption attempts, the backdoor remains active in malvertising and spam campaigns. The malware's selective usage and continuous updates suggest its persistence as a threat, highlighting the need for enhanced organizational protection measures.
ParkMobile pays... $1 each for 2021 data breach that hit 22 million
Source: https://www.bleepingcomputer.com/news/security/parkmobile-pays-1-each-for-2021-data-breach-that-hit-22-million/
CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief
Source: https://thehackernews.com/2025/10/cometjacking-one-click-can-turn.html
New Study Warns Several Free iOS and Android VPN Apps Use Outdated Software and Leak User Data
Source: https://hackread.com/studyfree-ios-android-vpn-apps-leak-data/
