The signs of a cyberattack were identified on systems EU's main executive body uses for mobile device management. The post European Commission Investigating Cyberattack appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks. The post Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog appeared first on SecurityWeek .
A new evolution in the ClickFix campaign, dubbed CrashFix, has been identified. This variant deliberately crashes victims' browsers and uses social engineering to lure users into executing malicious commands. The attack begins with a malicious ad redirecting users to install a harmful browser extension impersonating a legitimate ad blocker. The payload causes delayed browser issues and presents a fake security warning. It misuses the Windows utility finger.exe to execute malicious commands and downloads additional payloads, including a Python-based Remote Access Trojan (RAT). The RAT, named ModeloRAT, establishes persistence and performs extensive reconnaissance. The campaign targets domain-joined systems and employs multiple obfuscation techniques to evade detection.
Criminals are using AI to clone professional websites at an industrial scale. A new report shows how one AI-powered network grew to 150+ domains by hiding behind Cloudflare and rotating IP ranges. The post Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign appeared first on SecurityWeek .
The Cyberspy Group is an advanced persistent threat (APT) actor that has conducted cyber espionage operations targeting governments and critical infrastructure across 37 countries. Although Palo Alto Networks has not officially attributed this group, evidence suggests a likely connection to China. The campaign involves sophisticated intrusion techniques aimed at compromising sensitive governmental and infrastructure systems, potentially leading to significant confidentiality and operational impacts. No specific affected software versions or vulnerabilities have been disclosed, and no known exploits are currently reported in the wild. The threat is assessed as critical due to the broad scope, high-value targets, and potential for severe disruption. European organizations, especially those involved in government and critical infrastructure sectors, face heightened risk. Mitigation requires enhanced network monitoring, threat intelligence sharing, and rigorous access controls tailored to detect and prevent APT intrusions. Countries with significant government and critical infrastructure digital footprints, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected given their strategic importance and historical targeting patterns. The threat's complexity and stealthy nature necessitate proactive defense measures beyond standard patching and antivirus solutions.
For a few days, many phishing emails that landed into my mailbox contain strange URLs. They are classic emails asking you to open a document, verify your pending emails, …
A malicious email attachment containing a . bat script is delivering a multi-stage malware payload designed to steal data via a Chrome injector. The initial script is a fork of publicly available GitHub code but includes obfuscated Base64-encoded payloads executed through PowerShell. The payload fetches additional components from a compromised website, including a . NET program that establishes persistence via scheduled tasks and communicates with a Telegram-based command and control (C2) server. This malware, identified as XWorm V7.x, uses sophisticated obfuscation and evasion techniques to avoid detection. It targets Windows systems and aims to steal sensitive information silently. The attack does not require user interaction beyond opening the malicious attachment and does not currently have known widespread exploitation but poses a medium risk. European organizations using Windows and Chrome browsers are potential targets, especially those with less mature email security controls.
A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, directing users to malicious content. The TDS incorporates a clever DNS trick to evade detection by security groups. The system, operational since mid-2022, appears to be run by a financially motivated actor in affiliate marketing. It has the potential to interfere with devices on the network, alter DNS records, and conduct adversary-in-the-middle operations. The threat actor's ability to control DNS resolution poses significant risks beyond delivering unwanted advertising.
While both cyberwar and cyberwarfare will increase through 2026, cyberwarfare is likely to increase more dramatically. We hope it will never boil over – but we should be aware of the possibility and its consequences. The post Cyber Insights 2026: Cyberwar and Rising Nation State Threats appeared first on SecurityWeek .
Last week, a new AI agent framework was introduced to automate "live". It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in its design.
Rapid7 Labs has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom, involving a new custom backdoor named Chrysalis. The attack compromised Notepad++ infrastructure to deliver the backdoor. Analysis revealed multiple custom loaders, including one using Microsoft Warbird for obfuscation. The Chrysalis backdoor has extensive capabilities for information gathering, file operations, and remote command execution. Additional artifacts found include Cobalt Strike beacons and Metasploit payloads. The campaign shows Lotus Blossom evolving its tactics, mixing custom and off-the-shelf tools with advanced obfuscation techniques to evade detection.
A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox login page. The attackers exploit trusted platforms and harmless file formats to bypass security measures. The campaign uses social engineering tactics to harvest credentials, which are then exfiltrated to attacker-controlled infrastructure via Telegram. This method proves effective by leveraging legitimate business processes, trusted file types, and reputable cloud services to appear authentic and bypass automated security checks.
A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.
