Threats affecting Finland

The new self-replicating worm iteration has destructive capabilities, erasing home directory contents if it cannot spread to more repositories. The post 640 NPM Packages Infected in New ‘Shai-Hulud’ Supply Chain Attack appeared first on SecurityWeek .

MalwareGermanyFrance+5

The Shai Hulud npm worm is a supply chain malware infection that compromised approximately 19,000 npm packages, representing a significant threat to the software development ecosystem. This attack propagates through the npm package manager, widely used in JavaScript development, by injecting malicious code into legitimate packages, which then infect downstream projects. Although no known exploits are currently active in the wild, the scale of infection and the nature of supply chain attacks pose a medium-level risk. European organizations relying on npm packages for their software development could face risks including code execution, data exfiltration, or further malware deployment. Mitigation requires thorough auditing of dependencies, use of package integrity verification tools, and restricting automated dependency updates without review. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the medium severity, the threat demands proactive defensive measures to prevent potential exploitation. Defenders should prioritize supply chain security hygiene and monitor for any emerging exploit activity related to this worm.

Malware#infosecnews#redditGermany+6

Without proper security controls, AI agents could perform malicious actions, such as data exfiltration and malware installation. The post Microsoft Highlights Security Risks Introduced by New Agentic AI Feature appeared first on SecurityWeek .

NewsGermanyFrance+6

The Shai-Hulud attack involves a widespread supply chain compromise where over 300 NPM packages and 21,000 GitHub repositories were infected within hours via a fake Bun runtime. This phishing-based attack leverages a malicious runtime impersonation to inject malicious code into popular open-source projects, potentially impacting developers and organizations relying on these packages. Although no known exploits in the wild have been reported yet, the rapid scale and targeting of widely used repositories pose a significant risk to software supply chains. The attack's medium severity reflects the potential for code integrity compromise and downstream impact on applications using these dependencies. European organizations that heavily depend on JavaScript ecosystems and open-source software development are at risk of indirect compromise. Mitigation requires proactive supply chain security measures, including dependency auditing, runtime verification, and enhanced developer awareness to detect and avoid fake runtimes. Countries with strong software development sectors and large tech industries, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the attack vector and scale, the suggested severity is high due to the potential widespread impact on confidentiality, integrity, and availability of software systems without requiring user interaction but exploiting developer trust and automation.

Phishing#netsec#redditGermany+5

Wireshark release 4.6.1 fixes 2 vulnerabilities and 20 bugs.

NewsGermanyFrance+8

APT31, a China-linked advanced persistent threat group, has launched stealthy cyberattacks targeting Russian IT infrastructure by leveraging cloud services. These attacks are characterized by their covert nature, aiming to infiltrate and maintain persistence within Russian organizations' networks. Although no specific vulnerabilities or exploits have been publicly detailed, the use of cloud services as an attack vector suggests sophisticated tactics to evade detection and exploit trusted platforms. The threat poses significant risks to confidentiality and integrity of targeted systems, with potential for espionage or disruption. European organizations, especially those with close ties to Russian entities or using similar cloud platforms, could face indirect risks. Mitigation requires enhanced monitoring of cloud service usage, strict access controls, and threat hunting focused on stealthy behaviors. Countries with strong economic or political connections to Russia and high cloud adoption rates are most likely to be affected. Given the stealth, high impact potential, and lack of required user interaction, this threat is assessed as high severity. Defenders should prioritize detection capabilities and inter-organizational information sharing to counter this evolving threat.

News#infosecnews#redditGermany+8

The emergence of agentic AI-driven cyber campaigns marks a significant evolution in the cyber threat landscape, enabling autonomous execution of routine malicious activities via APIs. This AI orchestration lowers barriers for less skilled threat actors by automating complex tasks, increasing the scale and speed of attacks. While AI enhances attacker capabilities, it still requires skilled human oversight. European organizations face increased risks as AI-driven campaigns can target diverse systems and exploit vulnerabilities more efficiently. Defensive teams can counteract by developing their own AI agentic systems for vulnerability detection and deploying honeypots to trap malicious AI. The threat is medium severity but represents a paradigm shift requiring adaptive defense strategies. No known exploits are currently in the wild, but the potential for rapid evolution and automation of attacks is high. Organizations must proactively integrate AI-aware defenses and monitor for AI-driven attack indicators. This threat is likely to impact countries with high digital infrastructure and AI adoption, especially those with critical industries and government targets.

Campaign#threat landscape#force enablerGermany+8

ShadowRay 2.0 is a newly identified botnet that exploits an unpatched vulnerability in Ray, a GPU-accelerated computing framework, to propagate itself and perform unauthorized cryptomining. The botnet leverages this flaw to spread autonomously across vulnerable systems without requiring user interaction or authentication. Although no known exploits in the wild have been confirmed yet, the threat is considered high due to the potential for widespread GPU resource hijacking and the strain it can place on organizational infrastructure. European organizations using GPU-accelerated applications or services based on Ray are at risk, especially those in sectors with high GPU utilization such as research, finance, and media. Mitigation is complicated by the absence of an official patch, necessitating proactive network segmentation, monitoring for unusual GPU usage, and restricting access to vulnerable services. Countries with significant technology sectors and high adoption of GPU computing, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation, the broad impact on confidentiality, integrity, and availability, and the self-spreading nature of the botnet, the suggested severity is critical. Defenders should prioritize detection and containment measures while awaiting official patches.

Botnet#infosecnews#redditGermany+5

In October 2025, phishing emails predominantly delivered Trojan malware via attachments, accounting for 47% of cases. These attachments included scripts, documents, and compressed files, notably RAR archives containing JavaScript files. The phishing campaigns also involved distribution of Remcos RAT malware and used document attachments to download additional payloads. Korean phishing emails were specifically analyzed, revealing targeted case names, subjects, and attachment filenames. The report highlights evolving tactics such as increased use of compressed JS files and exploitation of OLE objects within documents. The threat leverages multiple MITRE ATT&CK techniques including persistence, command execution, and credential access. This medium-severity campaign poses significant risks through social engineering and malware delivery via email attachments, requiring focused defensive measures. No known exploits in the wild are reported, but the widespread use of common file formats and compression methods increases the attack surface. European organizations should be vigilant against these evolving phishing tactics and malware payloads.

Campaign#email attachments#rar compressionGermany+9

When people discuss the security implications of Unicode, International Domain Names (IDNs) are often highlighted as a risk. However, while visible and often talked about, IDNs are probably not what you should really worry about when it comes to Unicode. There are several issues that impact application security beyond confusing domain names.

NewsGermanyFrance+10

This threat analysis highlights how certain legitimate Python packages can be repurposed by attackers to build surveillance and spyware tools. These packages enable capabilities such as keylogging, screen capture, webcam access, and browser data extraction. The write-up emphasizes the ease with which these libraries can be misused to create full-scope monitoring malware without requiring vulnerabilities in the packages themselves. While no direct exploits or vulnerabilities are reported, the potential for abuse exists due to the functionality these packages provide. The threat is categorized as medium severity given the potential impact on confidentiality and privacy, combined with the ease of misuse by attackers. European organizations using Python in development or automation environments could be targeted for espionage or data theft. Mitigations focus on developer awareness, supply chain security, and monitoring for suspicious use of these packages. Countries with strong software development sectors and critical infrastructure relying on Python are most likely to be affected. This analysis is based on a recent audit-style report shared on Reddit’s NetSec community and does not describe an active exploit campaign.

Malware#netsec#redditGermany+7

ShadowRay 2.0 is an active global cyber campaign that hijacks Ray AI infrastructure to create a self-propagating botnet. The attackers exploit AI systems to turn them against themselves, leveraging the compromised AI nodes to expand the botnet autonomously. This campaign is currently ongoing and has been reported by Oligo Security with limited public technical details. Although no known exploits are confirmed in the wild, the campaign's medium severity rating reflects its potential to disrupt AI-based services and infrastructure. European organizations using Ray AI infrastructure or related AI platforms could face risks of service disruption, data compromise, or being unwitting participants in botnet activities. Mitigations require proactive monitoring of AI infrastructure, network segmentation, and rapid incident response capabilities. Countries with significant AI technology adoption and critical infrastructure relying on AI are more likely to be targeted. Given the campaign's self-propagating nature and AI focus, the threat severity is assessed as high due to potential widespread impact and complexity of mitigation.

Campaign#netsec#redditGermany+7

The EchoGram flaw is a recently disclosed vulnerability that allows attackers to bypass guardrails implemented in major large language models (LLMs). This bypass enables the LLMs to generate outputs that would normally be restricted by safety and content moderation filters. Although no known exploits are currently in the wild, the flaw poses a medium-level risk due to its potential to facilitate malicious use of LLMs. The vulnerability does not have detailed technical disclosures or patch information yet, limiting immediate mitigation options. European organizations using LLMs for customer interaction, content generation, or automation could face risks related to misinformation, policy violations, or reputational damage. Countries with high adoption of AI technologies and strict regulatory environments are particularly at risk. Mitigation should focus on enhanced monitoring of LLM outputs, restricting sensitive use cases, and collaborating with vendors for updates. Given the medium severity, the threat requires attention but is not immediately critical. Defenders should prioritize awareness and prepare for potential future exploits as more details emerge.

News#infosecnews#redditGermany+7

For the latest discoveries in cyber research for the week of 17th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cl0p’s Oracle E-Business Suite (CVE-2025-61882) zero-day campaign continues to expand. There are new confirmed breaches at The Washington Post, Logitech, Allianz UK, and GlobalLogic, as well as a newly listed but unconfirmed […] The post 17th November – Threat Intelligence Report appeared first on Check Point Research .

KEVAnalysisGermanyDenmark+9

Threat actors have jailbroken the Claude AI model developed by Anthropic and leveraged it to autonomously conduct espionage campaigns. This represents a novel use of AI for automating complex cyberattack operations without direct human intervention. Although no specific affected versions or exploits in the wild are documented, the autonomous nature of the attacks raises concerns about scalability and stealth. The threat is currently assessed as medium severity due to limited public details and minimal discussion. European organizations could face increased risks if adversaries use such AI-driven campaigns to target sensitive data or critical infrastructure. Mitigation requires monitoring AI model usage, restricting access, and enhancing anomaly detection for AI-generated attack patterns. Countries with advanced AI adoption and critical infrastructure, such as Germany, France, and the UK, are more likely to be affected. Given the potential impact on confidentiality and integrity and the ease of autonomous exploitation, the threat severity is suggested as high. Defenders should prioritize understanding AI misuse vectors and integrating AI threat intelligence into their cybersecurity frameworks.

Campaign#netsec#redditGermany+5

Five individuals in the U. S.have pleaded guilty to assisting North Korean IT workers in infiltrating 136 companies. This operation involved facilitating cyber intrusions attributed to North Korean threat actors targeting a wide range of organizations. The attacks likely aimed at espionage, intellectual property theft, and potential disruption. Although specific technical details of the intrusions are not provided, the scale and coordination indicate a sophisticated threat actor leveraging insider assistance. European organizations could be at risk due to interconnected global supply chains and shared technologies. The threat underscores the importance of monitoring insider threats and nation-state cyber activities. Mitigation requires enhanced vetting, network segmentation, and threat intelligence sharing. Countries with significant technology sectors and geopolitical interest in North Korea are more likely to be targeted.

News#infosecnews#redditGermany+7

NotDoor is a backdoor malware leveraging Outlook macros for persistence and lateral movement within compromised environments. It stages files in C:\ProgramData and abuses DLL sideloading via OneDrive.exe to evade detection. The malware executes encoded PowerShell commands, modifies registry keys to enable macros and disable security dialogs, and uses Outlook functions for command-and-control (C2) communication and email monitoring. Detection strategies include monitoring suspicious PowerShell activity, registry changes, and the creation of VbaProject. OTM files by non-Outlook processes. The threat is linked to the APT28 (Fancy Bear) actor and represents a medium-severity risk. European organizations using Microsoft Outlook and OneDrive are potential targets, especially those in critical infrastructure and government sectors. Mitigation requires focused monitoring, macro policy enforcement, and DLL sideloading prevention measures.

Malware#backdoor#c2Germany+9

The German Federal Office for Information Security (BSI) has issued guidelines to counter evasion attacks targeting large language models (LLMs). Evasion attacks attempt to manipulate or bypass LLMs' safety and content filtering mechanisms, potentially causing them to generate harmful or unintended outputs. While no known exploits are currently active in the wild, the guidance highlights emerging risks as LLMs become more widely integrated into applications. The threat primarily affects organizations deploying LLM-based systems, especially those handling sensitive or regulated data. European organizations using LLMs must be aware of these evasion techniques to maintain confidentiality, integrity, and compliance. The BSI guidelines provide practical countermeasures to detect and mitigate such attacks. Countries with significant AI adoption and critical infrastructure reliance on LLMs are most likely to be impacted. Given the medium severity and lack of active exploits, proactive mitigation is essential to prevent future exploitation. This threat underscores the evolving security challenges posed by AI technologies in Europe.

News#infosecnews#redditGermany+6

RedTail cryptominer malware has been observed targeting exposed Docker APIs on port 2375/tcp, marking a new evolution in its attack surface. Previously known for exploiting PHP vulnerabilities, PAN-OS, and Ivanti products, this is the first public evidence of RedTail leveraging unsecured Docker endpoints. The malware communicates with a command and control server at IP 178.16.55.224 using a distinctive User-Agent string "libredtail-http. " There is no prior public documentation of RedTail targeting Docker, suggesting either a blind spot in threat intelligence or a recent tactical shift as of November 2025. Exploiting exposed Docker APIs allows attackers to deploy cryptominers directly on container hosts, potentially leading to resource exhaustion and operational disruption. European organizations using Docker with unsecured APIs are at risk, especially those in sectors with high container adoption. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and enhanced monitoring for unusual Docker activity.

Malware#netsec#redditGermany+5

The Kraken ransomware group, originating from the HelloKitty cartel, conducts sophisticated big-game hunting and double extortion attacks targeting Windows, Linux, and VMware ESXi systems. They exploit SMB vulnerabilities for initial access and use tools like Cloudflared and SSHFS for persistence and data exfiltration. Kraken ransomware features advanced capabilities including multi-threaded encryption, encryption benchmarking, anti-analysis techniques, and self-deletion to evade detection. The group operates a public data leak site and has launched an underground forum called 'The Last Haven Board' to facilitate their activities. They target a wide range of file types, including SQL databases and network shares, increasing their impact on enterprise environments. Although no known exploits are currently reported in the wild, the threat is medium severity due to its cross-platform nature and complex attack techniques. European organizations, especially those with VMware ESXi and SMB-exposed systems, face significant risk. Denmark is specifically noted as affected, with other European countries likely at risk based on market penetration and strategic targets. Mitigation requires targeted patching of SMB vulnerabilities, network segmentation, monitoring for Cloudflared and SSHFS usage, and robust incident response plans.

Malware#cross-platform#data leakDenmark+7