Hacktivists have reportedly breached critical infrastructure in Canada, as warned by a Canadian cyber agency. The breach is considered critical, indicating significant potential impact on essential services. Details are limited, with minimal discussion and no known exploits currently in the wild. The attack highlights the growing threat posed by hacktivist groups targeting national infrastructure. European organizations should be aware of similar risks, especially those with interconnected infrastructure or shared supply chains. Mitigation requires enhanced monitoring, incident response readiness, and collaboration with national cybersecurity agencies. Countries with close economic and security ties to Canada, or with similar critical infrastructure profiles, are more likely to be affected. The severity is assessed as critical due to the breach of critical infrastructure, potential for widespread disruption, and the difficulty in defending such targets. Defenders must prioritize threat intelligence sharing and proactive defense measures to mitigate similar threats.
A new malware threat leveraging NFC relay attacks targets Android tap-to-pay transactions, enabling attackers to clone payment credentials by intercepting and relaying NFC signals. This malware can effectively bypass typical proximity requirements of NFC payments, allowing fraudulent transactions without physical card or device possession. Although no known exploits are currently active in the wild, the technique poses a medium-level risk due to its potential to compromise payment confidentiality and integrity. European organizations with high adoption of Android tap-to-pay services, especially in retail and financial sectors, are at risk. Mitigation requires enhanced transaction authentication, user awareness, and device security hardening. Countries with widespread NFC payment adoption and significant mobile payment infrastructure, such as the UK, Germany, France, and the Nordics, are most likely affected. The threat is medium severity given the complexity of exploitation and limited current exploitation evidence. Defenders should prioritize monitoring for unusual NFC activity and enforce multi-factor authentication for payment approvals.
Hackers have compromised corporate XWiki servers to deploy unauthorized cryptocurrency mining operations. This threat involves attackers gaining access to XWiki instances, leveraging them to mine cryptocurrencies without the organizations' consent. The exploitation does not currently have known public exploits or patches, and detailed technical specifics are limited. The attack primarily impacts server availability and resource utilization, potentially degrading performance and increasing operational costs. European organizations using XWiki for internal collaboration or documentation are at risk, especially those with exposed or poorly secured instances. Mitigation requires immediate hardening of XWiki deployments, including access controls, monitoring for unusual resource usage, and applying security best practices. Countries with significant enterprise adoption of XWiki and higher cloud infrastructure usage are more likely to be targeted. Given the medium severity, the threat poses moderate risk but can escalate if attackers gain deeper access or persist longer. Defenders should prioritize detection and containment to prevent resource abuse and potential lateral movement.
Ten malicious npm packages have been discovered stealing developer credentials across Windows, macOS, and Linux platforms. These packages, once installed, exfiltrate sensitive authentication data, potentially compromising developer accounts and access to critical code repositories. The threat affects developers using npm, a widely adopted package manager in the JavaScript ecosystem, making it a significant risk for software supply chain security. Although no known exploits are currently active in the wild, the high severity rating underscores the potential damage if these packages are used in development environments. European organizations relying on npm for software development are at risk, especially those with large developer teams and open-source dependencies. Immediate mitigation involves auditing dependencies, removing suspicious packages, and enhancing credential security practices. Countries with strong technology sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. The threat is assessed as high severity due to the sensitive nature of stolen credentials, ease of exploitation via package installation, and broad platform coverage without requiring user interaction beyond installing the package.
The company has built a plug-and-play photonic layer transmission system that encrypts data in transit to prevent interception. The post CyberRidge Emerges From Stealth With $26 Million for Photonic Encryption Solution appeared first on SecurityWeek .
Intel and AMD have published advisories after academics disclosed details of the new TEE.fail attack method. The post New Attack Targets DDR5 Memory to Steal Keys From Intel and AMD TEEs appeared first on SecurityWeek .
A recent campaign has been identified targeting the Visual Studio Code (VSCode) extension marketplace, where attackers have uploaded a dozen malicious extensions aimed at developers. These extensions pose a supply chain attack risk by potentially compromising developer environments and injecting malicious code into software development workflows. Although no known exploits are currently active in the wild, the presence of malicious plugins in a widely used IDE marketplace elevates the risk profile. The threat is assessed as medium severity due to the potential impact on confidentiality and integrity, combined with the ease of exploitation through trusted extension installation. European organizations relying heavily on VSCode for software development could face risks of intellectual property theft, code integrity compromise, and downstream supply chain contamination. Mitigation requires proactive extension vetting, restricting extension installation policies, and monitoring for unusual IDE behaviors. Countries with strong software development sectors and high VSCode adoption, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the medium severity and the supply chain nature of the attack, defenders should prioritize awareness and controls around IDE plugin management.
This threat involves attackers using memory-only filesystems (tmpfs) on Linux systems, such as /dev/shm, to hide malicious tools or stage data exfiltration. Traditional forensic imaging tools cannot capture these volatile filesystems because they lack block device backing. The analyst describes a method to collect both metadata and file contents from these tmpfs mounts by first extracting inode metadata using stat commands and then archiving file contents with tar, preserving forensic integrity. This technique has been tested successfully on numerous Linux and Unix-like systems. The threat highlights the challenge of detecting and collecting evidence from in-memory filesystems that attackers exploit to evade detection. The severity is medium due to the difficulty in forensic collection and potential for attackers to hide artifacts in tmpfs, but exploitation requires system access. European organizations running Linux servers with tmpfs mounts are at risk of stealthy attacks leveraging this technique.
The Everest group has claimed responsibility for a cyberattack targeting Svenska kraftnät, Sweden's national power grid operator. While details remain sparse and unverified, the incident raises concerns about the security of critical infrastructure in Sweden. No technical specifics or evidence of exploitation have been publicly disclosed, and there are no known exploits in the wild linked to this claim. The attack, if confirmed, could impact the confidentiality, integrity, and availability of power grid operations, potentially disrupting energy supply. European organizations, especially those involved in critical infrastructure, should remain vigilant. Mitigation should focus on enhanced monitoring, incident response readiness, and securing operational technology environments. Sweden is the primary affected country, with potential indirect effects on neighboring European countries due to interconnected energy networks. Given the lack of detailed information and confirmed impact, the threat severity is assessed as medium. Defenders should prioritize verifying the claim, assessing system integrity, and reinforcing cybersecurity controls in critical infrastructure sectors.
BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.
Recent reports indicate a decline in ransomware profits as victims increasingly refuse to pay ransom demands. This trend suggests a shift in victim response strategies, potentially reducing the financial incentives for ransomware operators. Despite the drop in profits, ransomware remains a high-priority cybersecurity threat due to its disruptive nature and potential for data loss. European organizations, often targeted by ransomware, may experience changes in attack patterns or ransom negotiation dynamics. The threat does not involve a new vulnerability or exploit but reflects evolving attacker-victim interactions. Defenders should focus on strengthening incident response, backup strategies, and ransomware resilience. Countries with high ransomware incident rates and critical infrastructure reliance on digital systems are most at risk. The severity is assessed as high given ransomware's impact on confidentiality, integrity, and availability, even if exploitation ease varies. No direct technical exploit details are provided, but the ongoing ransomware threat landscape necessitates vigilance and proactive defense measures.
All new extensions will be required to declare their data collection practices in their manifest file using a specific key. The post New Firefox Extensions Required to Disclose Data Collection Practices appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .
The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks. The post Chrome Zero-Day Exploitation Linked to Hacking Team Spyware appeared first on SecurityWeek .
Shortly after the browser was launched, numerous fraudulent domains and fake applications were discovered. The post Hackers Target Perplexity Comet Browser Users appeared first on SecurityWeek .
The relationship between the Russian government and cybercriminal groups has evolved from passive tolerance. The post Russian Government Now Actively Managing Cybercrime Groups: Security Firm appeared first on SecurityWeek .
This threat involves the use of machine learning techniques to enhance acoustic eavesdropping attacks by exploiting MEMS (Micro-Electro-Mechanical Systems) devices. The blog series aims to reproduce and demonstrate how MEMS sensors, commonly found in consumer electronics, can be leveraged to capture and reconstruct audio signals surreptitiously. Although no specific affected versions or exploits in the wild are reported, the approach highlights a novel attack vector that could compromise confidentiality by capturing sensitive conversations. The attack does not require direct system compromise but relies on physical proximity or access to sensor data streams. European organizations with high usage of MEMS-enabled devices in sensitive environments could be at risk. Mitigation involves restricting sensor access, monitoring unusual sensor data usage, and applying hardware or software-level protections. Countries with advanced technology sectors and high adoption of IoT and smart devices, such as Germany, France, and the UK, are more likely to be affected. Given the potential confidentiality breach and the complexity of exploitation, the threat severity is assessed as medium. Defenders should prioritize awareness and sensor data governance to mitigate risks from such emerging acoustic side-channel attacks.
