ESET researchers have uncovered a new instance of Operation DreamJob, a campaign attributed to the North Korea-aligned Lazarus group, targeting European defense companies involved in UAV technology. The attacks align with North Korea's efforts to enhance its drone program, likely aiming to steal proprietary information and manufacturing know-how. The campaign uses social engineering tactics, trojanized open-source projects, and deploys the ScoringMathTea RAT. The attackers' toolset includes various droppers, loaders, and downloaders, with a focus on UAV-related targets. This activity highlights the ongoing threat posed by Lazarus and North Korea's interest in advancing its drone capabilities through cyberespionage.
SquareX has shown how malicious browser extensions can impersonate AI sidebar interfaces. The post AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk appeared first on SecurityWeek .
Recent reports highlight a medium-severity security issue involving unseeable prompt injections in screenshots within Comet and other AI-powered browsers. These vulnerabilities allow attackers to embed hidden malicious prompts that are not visible in screenshots, potentially misleading users or automated systems relying on visual verification. While no known exploits are currently active in the wild, the issue raises concerns about the integrity of user interactions and the trustworthiness of AI browser interfaces. The threat primarily affects AI browsers that integrate prompt-based interactions, with Comet being a notable example. European organizations using such browsers for sensitive tasks could face risks related to confidentiality and integrity breaches. Mitigation requires browser vendors to implement robust prompt rendering and screenshot validation mechanisms, alongside user awareness about the limitations of screenshot-based verification. Countries with higher adoption of AI browsers and strong digital service sectors, such as Germany, France, and the Netherlands, are more likely to be impacted. Given the medium severity, the threat demands attention but is not immediately critical. Defenders should prioritize updates from browser vendors and consider alternative verification methods beyond screenshots.
The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.
The TARmageddon flaw affects the Async-Tar Rust library, enabling attackers to smuggle extra archives when processing nested TAR files. This vulnerability can lead to unintended extraction of malicious or unexpected files, potentially bypassing security controls. Although no known exploits are currently in the wild and no specific affected versions or patches have been disclosed, the flaw poses a medium risk due to its potential impact on integrity and availability. European organizations using Rust-based tooling or services that rely on Async-Tar for archive processing could be exposed, especially in software development, cloud services, and container environments. Mitigation involves closely monitoring updates from the library maintainers, auditing nested TAR file handling, and implementing strict validation of archive contents. Countries with strong Rust adoption and significant software development sectors, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. The threat is assessed as medium severity given the complexity of exploitation and the absence of authentication or user interaction requirements. Defenders should prioritize awareness and proactive patching once fixes are available to prevent potential supply chain or deployment compromises.
The security paradox of local large language models (LLMs) highlights the conflicting security implications of running LLMs locally versus relying on cloud-based services. While local LLMs reduce data exposure to external servers, they introduce new risks such as local system compromise, unauthorized model manipulation, and data leakage through insecure storage or execution environments. This paradox creates a complex security landscape where organizations must balance confidentiality, integrity, and availability concerns. European organizations adopting local LLMs may face risks related to sensitive data processing on endpoint devices, increasing the attack surface. Mitigations include enforcing strict access controls, securing local environments, monitoring for anomalous model behavior, and applying cryptographic protections to stored data and models. Countries with strong AI adoption and digital transformation initiatives, such as Germany, France, and the UK, are more likely to be affected due to higher local LLM usage. Given the medium severity and absence of known exploits, the threat requires proactive but measured attention to prevent exploitation of local deployment weaknesses.
Star Blizzard started using the NoRobot (BaitSwitch) and MaybeRobot (SimpleFix) malware after public reporting on the LostKeys malware. The post Russian APT Switches to New Backdoor After Malware Exposed by Researchers appeared first on SecurityWeek .
Cursor and Windsurf integrated development environments (IDEs) have been found to contain over 94 unpatched (n-day) vulnerabilities originating from their embedded Chromium components. These vulnerabilities span a wide range of security issues inherent to Chromium, potentially exposing users to risks such as remote code execution, privilege escalation, and data leakage. Although no known exploits are currently active in the wild, the sheer volume and severity of these vulnerabilities pose a significant threat, especially given the widespread use of these IDEs in software development. European organizations using these IDEs may face increased risk of compromise, intellectual property theft, or disruption of development workflows. Immediate attention to patching or mitigating these vulnerabilities is critical. The threat is assessed as high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation of Chromium vulnerabilities. Countries with strong software development sectors and high adoption of these IDEs, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize updating Chromium components, applying vendor patches when available, and implementing network-level protections to reduce exposure. Continuous monitoring for suspicious activity related to these IDEs is also recommended.
Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.
Russian threat actors have evolved a malware campaign that leverages fake "I am not a robot" CAPTCHA prompts to deliver malicious payloads. This technique abuses user trust in CAPTCHA interfaces to trick victims into executing malware, potentially leading to system compromise. The malware is associated with advanced persistent threat (APT) groups and represents a high-severity risk due to its social engineering vector and stealthy delivery. Although no known exploits are currently active in the wild, the campaign's sophistication and targeting suggest a significant threat to organizations, especially those with high user interaction and web-facing services. European organizations are at risk given the widespread use of CAPTCHA mechanisms and the geopolitical focus on this region. Mitigation requires enhanced user awareness, web filtering, and endpoint detection tuned to identify unusual CAPTCHA-related behaviors. Countries with large digital economies and critical infrastructure in Europe are most likely targets. The threat is assessed as high severity due to the potential for confidentiality breaches, ease of exploitation via social engineering, and the broad scope of affected systems without requiring prior authentication or complex user interaction beyond clicking a fake CAPTCHA.
The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting Windows Server machines primarily in government, financial, and industrial sectors across Asia, Africa, and Latin America. Attackers gain initial access by exploiting SQL servers and deploy custom implants such as Neursite and NeuralExecutor. These implants employ advanced persistence, evasion, and command execution techniques, using a multi-stage loading process and diverse communication protocols for command and control (C2). Although attribution is uncertain, indicators suggest possible links to Chinese-speaking threat actors. The campaign highlights the critical need for robust server security and continuous monitoring to detect complex multi-stage intrusions. No known exploits are currently in the wild, and the campaign is rated medium severity. The focus on Windows Server environments and SQL exploitation techniques underscores the risk to organizations relying on these technologies.
A threat actor has been infecting servers of high-profile entities with backdoors to exfiltrate information and deploy additional payloads. The post Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign appeared first on SecurityWeek .
The malware uses invisible Unicode characters to hide its code and blockchain-based infrastructure to prevent takedowns. The post Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware appeared first on SecurityWeek .
COLDRIVER, a Russian state-sponsored threat group, swiftly shifted operations after their LOSTKEYS malware was exposed in May 2025. They developed new malware families, including NOROBOT, YESROBOT, and MAYBEROBOT, within days. The infection chain begins with a COLDCOPY lure disguised as a CAPTCHA, leading to the deployment of NOROBOT, a DLL that retrieves subsequent stages. YESROBOT, a Python backdoor, was briefly used before being replaced by MAYBEROBOT, a more flexible PowerShell backdoor. The malware chain has undergone constant evolution, with COLDRIVER focusing on evading detection while maintaining intelligence collection capabilities against high-value targets. The group's tactics include using HTTPS for command retrieval, encrypting commands, and implementing various evasion techniques.
The GlassWorm malware is a self-spreading malicious software targeting OpenVSX and VS Code extension registries. It propagates by infecting extensions within these registries, potentially compromising developers and users who download affected extensions. This malware can lead to unauthorized code execution, data theft, and supply chain compromise. European organizations relying on VS Code and OpenVSX for software development are at risk of indirect infection through compromised extensions. The malware's self-spreading nature increases the risk of rapid proliferation across development environments. Mitigation requires rigorous extension vetting, monitoring for unusual extension behavior, and restricting extension installation policies. Countries with significant software development sectors and high adoption of VS Code and OpenVSX, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and integrity, ease of spread, and no need for user interaction beyond extension installation, the threat severity is assessed as high.
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source […] The post 20th October – Threat Intelligence Report appeared first on Check Point Research .
I found another piece of malware this weekend. This one looks more like a proof-of-concept because the second-stage payload is really "simple", but it attracted my attention because it uses a nice technique to obfuscate the code.
A new . NET-based backdoor leveraging Windows Cryptographic API (CAPI) has been identified targeting Russian automotive and e-commerce companies. The malware is distributed via phishing emails containing ZIP attachments, which when opened, deploy the backdoor enabling remote code execution (RCE). Although currently focused on Russian firms, the technique and malware could potentially spread to other regions. The backdoor abuses . NET capabilities and CAPI functions to evade detection and maintain persistence. No known public exploits or patches exist yet, and the threat is considered high severity due to its RCE capabilities and targeted nature. European organizations with business ties or supply chains linked to Russian auto or e-commerce sectors should be vigilant. Mitigation requires enhanced email filtering, user training against phishing, and monitoring for unusual . NET process behavior and cryptographic API usage.
The U.S.is the top target for cyberattacks, with criminals and foreign adversaries targeting companies, governments and organizations. The post Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US appeared first on SecurityWeek .
