Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
This analysis explores the corporate structure and operations of Intellexa, a mercenary spyware vendor. It reveals new companies likely tied to Intellexa's network, particularly within a Czech cluster, and examines their roles in product shipment and potential infection vectors. The report traces Intellexa's activities across multiple countries, including new evidence of Predator spyware deployment in Iraq. It highlights the challenges in tracking such operations due to complex corporate structures and evolving techniques. The analysis also discusses broader trends in the spyware ecosystem, including geopolitical fragmentation, persistent facilitators, and expanding targeting beyond traditional victims to include corporate leaders.
Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Hyundai AutoEver America was hacked in February and the attackers managed to steal SSNs and other personal data. The post Automotive IT Firm Hyundai AutoEver Discloses Data Breach appeared first on SecurityWeek .
The 130-page document covers several important aspects and it’s available in both Japanese and English. The post Japan Issues OT Security Guidance for Semiconductor Factories appeared first on SecurityWeek .
Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.
The ransomware group Qilin has been highly active in 2025, publishing over 40 victim cases per month on its leak site. Manufacturing, professional services, and wholesale trade are the most affected sectors. Attackers likely originate from Eastern Europe or Russian-speaking regions. They use tools like Cyberduck for data exfiltration and leverage notepad.exe and mspaint.exe to view sensitive information. The attack flow includes initial VPN access, reconnaissance, credential theft, lateral movement, and ransomware deployment. Two encryptors are often used: one spread via PsExec and another targeting network shares. The ransomware encrypts files, deletes backups, and leaves ransom notes. Persistence is achieved through scheduled tasks and registry modifications.
The Brazilian Caminho loader is a sophisticated malware delivery mechanism active since March 2025, leveraging LSB steganography to hide . NET payloads within images hosted on legitimate platforms. It initiates infection via phishing emails containing malicious scripts that download these steganographic images. The loader executes payloads filelessly in memory and establishes persistence using scheduled tasks. Caminho operates as a Loader-as-a-Service, delivering multiple malware families such as Remcos RAT, Xworm, and Katz stealer across South America, Africa, and Eastern Europe. Its use of bulletproof hosting and Portuguese language artifacts indicates a Brazilian origin and professional operation. The campaign targets multiple industries opportunistically without a specific sector focus. The infection chain employs multiple advanced techniques including fileless execution, steganography, and obfuscation, complicating detection and mitigation efforts. European organizations, especially in Eastern Europe, face risks of data theft, espionage, and system compromise. Mitigation requires targeted email security, memory scanning, and monitoring of scheduled tasks for persistence.
A new . NET-based backdoor leveraging Windows Cryptographic API (CAPI) has been identified targeting Russian automotive and e-commerce companies. The malware is distributed via phishing emails containing ZIP attachments, which when opened, deploy the backdoor enabling remote code execution (RCE). Although currently focused on Russian firms, the technique and malware could potentially spread to other regions. The backdoor abuses . NET capabilities and CAPI functions to evade detection and maintain persistence. No known public exploits or patches exist yet, and the threat is considered high severity due to its RCE capabilities and targeted nature. European organizations with business ties or supply chains linked to Russian auto or e-commerce sectors should be vigilant. Mitigation requires enhanced email filtering, user training against phishing, and monitoring for unusual . NET process behavior and cryptographic API usage.
The "BlackSuit Blitz" is a ransomware attack campaign targeting a global equipment manufacturer, as detailed by Palo Alto Networks' Unit 42. This malware campaign involves sophisticated tactics to infiltrate corporate networks and encrypt critical data, disrupting operations. Although the attack is rated medium severity and no known exploits are currently in the wild, the threat demonstrates the potential for significant operational impact. European organizations in manufacturing and critical infrastructure sectors could be at risk due to the global nature of the targeted industry. The attack does not require known vulnerabilities or specific affected software versions, indicating a possible use of social engineering or credential compromise. Mitigation requires enhanced network segmentation, proactive threat hunting, and employee awareness training tailored to ransomware tactics. Countries with strong manufacturing bases and critical infrastructure, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the medium severity, the attack poses a moderate risk to confidentiality, integrity, and availability, with exploitation complexity likely moderate and no indication of user interaction requirements. Defenders should prioritize detection of lateral movement and ransomware behaviors and implement robust backup and recovery strategies.
Other noteworthy stories that might have slipped under the radar: US universities targeted by payroll pirates, Zimbra vulnerability exploited, Mic-E-Mouse attack. The post In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware appeared first on SecurityWeek .
A recent cyberattack on Red Hat's GitLab instance by the Crimson Collective resulted in the theft of approximately 570GB of compressed data, including 28,000 internal repositories and sensitive customer engagement reports containing infrastructure and authentication details. This breach exposes critical intellectual property and sensitive information across multiple sectors. Additional significant incidents include ransomware and data breaches affecting global organizations, highlighting a trend of sophisticated attacks targeting supply chains, manufacturing, and service providers. Notably, vulnerabilities in widely used software such as VMware Aria Operations, Linux sudo, and Fortra’s GoAnywhere MFT have been actively exploited, increasing the attack surface. European organizations relying on Red Hat and related open-source infrastructure are at risk of indirect impacts from leaked credentials and infrastructure details. The threat landscape underscores the need for targeted mitigation strategies focusing on supply chain security, privileged access management, and rapid patching of critical vulnerabilities. Given the scale and sensitivity of the stolen data, the threat severity is assessed as high for European entities.
The WARMCOOKIE backdoor continues to evolve, with ongoing updates and new infections observed. Recent developments include new handlers for executing various file types, a string bank for defense evasion, and code optimizations. A campaign ID field has been added, providing context for operators. Infrastructure analysis reveals a default SSL certificate potentially used for WARMCOOKIE back-ends. Despite disruption attempts, the backdoor remains active in malvertising and spam campaigns. The malware's selective usage and continuous updates suggest its persistence as a threat, highlighting the need for enhanced organizational protection measures.
The brewing giant has reverted to manual order processing and shipment as operations at its Japanese subsidiaries are disrupted. The post Beer Giant Asahi Says Data Stolen in Ransomware Attack appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 29th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Stellantis, Automotive maker giant which owns Citroën, FIAT, Jeep, Chrysler, and Peugeot, has suffered a data breach that resulted in exposure of North American customer contact information after attackers accessed a third-party […] The post 29th September – Threat Intelligence Report appeared first on Check Point Research .
Jaguar Land Rover extends shutdown after cyberattack by another week
Source: https://www.bleepingcomputer.com/news/security/jaguar-land-rover-extends-shutdown-after-cyberattack-by-another-week/
