Threats affecting France

The RondoDox botnet exploits a critical vulnerability known as React2Shell to compromise IoT devices and web servers. This flaw allows attackers to execute arbitrary code remotely, enabling the hijacking of vulnerable systems to incorporate them into the botnet. Although no specific affected versions or patches have been disclosed yet, the threat is considered critical due to the potential scale and impact. European organizations operating IoT infrastructure or web services are at risk, especially those with devices lacking timely security updates. The botnet could be leveraged for large-scale DDoS attacks, data exfiltration, or further network infiltration. Mitigation requires proactive network monitoring, segmentation of IoT devices, and rapid deployment of vendor patches once available. Countries with high IoT adoption and significant web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the ease of exploitation and critical impact on confidentiality, integrity, and availability, the suggested severity is critical. Defenders should prioritize detection and containment efforts immediately to prevent widespread compromise.

Botnet#infosecnews#redditGermany+5

ThreatFox IOCs for 2026-01-01

Indicator#type:osint#tlp:whiteGermany+4

DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.

Malware#backdoor#dll sideloadingGermany+6

A hacker claims to have breached the European Space Agency (ESA) and is selling 200GB of stolen data. The breach was disclosed via a Reddit post linking to an external news source, but technical details and verification remain minimal. The compromised data volume suggests a significant exfiltration of sensitive information, potentially impacting ESA's confidentiality and operational security. No known exploits or vulnerabilities have been publicly identified, and there is no evidence of active exploitation beyond the data sale claim. European organizations, especially those in aerospace and governmental sectors, could face increased risk from secondary attacks leveraging this breach. Mitigation requires immediate internal investigation, enhanced monitoring for data exfiltration, and tightening of access controls. Countries with strong aerospace sectors and ESA involvement, such as France, Germany, Italy, Spain, and the Netherlands, are most likely to be affected. Given the high potential impact on confidentiality and the strategic importance of ESA, the suggested severity is high. Defenders should prioritize verifying the breach, assessing data sensitivity, and preparing incident response plans accordingly.

Breach#infosecnews#redditFrance+6

In 2025, there was a significant increase in rogue ScreenConnect installations, part of a broader trend of threat actors abusing remote monitoring and management tools (RMMs). These tools were used to gain access, blend in, move laterally, and maintain persistence in target systems. Attackers employed various social engineering tactics to trick employees into downloading malicious RMMs. Common lures included fake Social Security statements, invitations, and financial documents. The Huntress Security Operations Center identified recurring patterns in lures, domains, and file hashes associated with these attacks. Some campaigns showed signs of targeting specific industries, such as accounting firms. The article provides detailed examples of attack patterns, top malicious domains, and file hashes observed throughout the year.

Malware#lures#social engineeringGermany+5

The DarkSpectre browser extension campaigns have compromised approximately 8.8 million users worldwide by distributing malicious browser extensions. These campaigns involve extensions that likely perform unauthorized data collection, user tracking, or other malicious activities, impacting user privacy and security. Although no specific affected versions or exploits in the wild are detailed, the scale of impact and exposure indicates a high-severity threat. European organizations using popular browsers susceptible to these extensions are at risk of data leakage and potential downstream attacks. The threat does not require user authentication but likely depends on user installation of malicious extensions, making user awareness critical. Mitigation involves proactive monitoring of browser extensions, enforcing strict extension policies, and educating users about risks. Countries with high browser usage and significant digital economies, such as Germany, France, and the UK, are most likely to be affected. Given the broad impact on confidentiality and potential integrity of user data, ease of exploitation through extension installation, and large affected user base, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and strengthen endpoint security controls.

Breach#infosecnews#redditGermany+6

Hackers exploited a multisignature (multisig) wallet vulnerability in the Unleash Protocol, resulting in the theft of approximately $3.9 million. The attack involved hijacking control over the multisig wallet, which is designed to require multiple approvals for transactions, thereby bypassing its intended security. This incident highlights risks associated with multisig wallet management and governance in decentralized finance (DeFi) platforms. Although no specific CVEs or patches are currently available, the breach demonstrates a high-severity threat due to the large financial loss and potential for similar attacks on other DeFi protocols. European organizations involved in blockchain, cryptocurrency, or DeFi services could face significant financial and reputational damage if targeted. Mitigation requires robust multisig wallet security practices, including strict key management, enhanced access controls, and continuous monitoring for suspicious activity. Countries with active blockchain ecosystems and financial hubs, such as Germany, the Netherlands, Switzerland, and the UK, are most likely to be affected. Given the attack's impact on confidentiality, integrity, and availability of funds, ease of exploitation through governance compromise, and lack of user interaction, the suggested severity is high. Defenders should prioritize securing multisig wallets and governance processes to prevent similar hijacks.

News#infosecnews#redditGermany+4

The RondoDox botnet is actively exploiting a vulnerability known as React2Shell to compromise Next.js servers. This flaw allows attackers to breach server environments running Next.js, a popular React framework for server-side rendering. Although no CVSS score is assigned, the threat is rated high severity due to the potential for unauthorized access and control over affected servers. The exploitation enables attackers to deploy botnet activities, which can lead to data breaches, service disruption, and further lateral movement within compromised networks. European organizations using Next.js for web applications are at risk, especially those in countries with high adoption of modern web technologies. Mitigation requires immediate patching once available, network segmentation, and monitoring for unusual outbound traffic indicative of botnet command and control. Countries such as Germany, the United Kingdom, France, and the Netherlands are likely to be most affected due to their large tech sectors and extensive use of Next.

Breach#infosecnews#redditGermany+5

The Everest ransomware group has reportedly leaked 1TB of stolen data from ASUS, a major technology company. This incident involves a significant data breach resulting from a ransomware attack, where attackers exfiltrated sensitive corporate data before encrypting systems. Although no specific affected versions or exploited vulnerabilities are detailed, the leak highlights the ongoing threat ransomware groups pose to large enterprises. The attack's medium severity suggests moderate impact, but the large volume of leaked data could have serious confidentiality implications. European organizations, especially those in the technology supply chain or with partnerships with ASUS, may face indirect risks such as data exposure or secondary attacks. Mitigation should focus on enhancing network segmentation, monitoring for data exfiltration, and securing third-party vendor relationships. Countries with strong technology sectors and close economic ties to ASUS, such as Germany, France, and the UK, are more likely to be affected. Given the data leak scale and ransomware context, the threat severity is assessed as high due to potential confidentiality loss and operational disruption. Defenders should prioritize incident response readiness and data leak detection capabilities to mitigate similar threats.

Malware#infosecnews#redditGermany+5

A modified variant of the Shai-Hulud worm has been detected testing payloads on the npm registry, raising concerns about potential malware propagation through widely used JavaScript packages. Although no known exploits are currently active in the wild, the presence of this malware on a major package repository poses a significant risk to software supply chains. The worm’s modifications suggest an evolution in its capabilities, potentially increasing its stealth or infection vectors. European organizations relying on npm packages for development and production environments could face risks to their code integrity and operational availability if infected packages are introduced. Mitigation requires proactive monitoring of package dependencies, strict validation of third-party code, and enhanced supply chain security practices. Countries with large software development sectors and high npm usage, such as Germany, the United Kingdom, France, and the Netherlands, are more likely to be impacted. Given the high severity rating and potential for widespread impact, organizations should prioritize detection and prevention measures. The threat is assessed as high severity due to its potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted package repositories and no need for user interaction once dependencies are installed.

Malware#infosecnews#redditGermany+6

Two US cybersecurity experts have been found guilty of participating in an extortion scheme involving the ALPHV ransomware. This case highlights insider threats where individuals with cybersecurity expertise exploit their knowledge for criminal activities. Although no specific technical vulnerabilities or exploits are detailed, the involvement of trusted experts in ransomware operations raises concerns about the integrity of cybersecurity professionals. The threat does not currently have known exploits in the wild beyond this criminal activity. European organizations could be indirectly impacted due to the global reach of ALPHV ransomware campaigns. Mitigation should focus on insider threat detection, enhanced vetting, and monitoring of cybersecurity personnel. Countries with significant ransomware targeting history and high adoption of cybersecurity services may be more affected. Given the medium severity rating and lack of direct technical exploit details, the threat severity is assessed as medium. Defenders should remain vigilant about insider risks and ransomware extortion schemes involving trusted individuals.

Malware#infosecnews#redditGermany+7

The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets. The post Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist appeared first on SecurityWeek .

MalwareGermanyNetherlands+3

Disney has agreed to pay $10 million to settle a lawsuit alleging violations of children's data privacy on YouTube. The case centers on claims that Disney improperly collected and used personal data from children without adequate consent or safeguards, violating privacy regulations. While this is a significant legal and financial consequence for Disney, it does not represent a direct technical vulnerability or exploit. The settlement highlights the increasing regulatory scrutiny on companies handling children's data, especially in digital and online platforms. European organizations should note the importance of compliance with data protection laws such as GDPR and the ePrivacy Directive, which impose strict requirements on processing children's personal data. This case underscores the risks of non-compliance, including costly legal actions and reputational damage. No active exploits or technical attack vectors are associated with this event. Organizations should review their data collection practices, especially for minors, and ensure transparency, parental consent, and data minimization. Countries with strong data protection enforcement and significant digital media markets, such as Germany, France, and the UK, are particularly relevant in this context. Overall, this incident is a legal and compliance issue rather than a cybersecurity threat or vulnerability requiring technical mitigation.

News#infosecnews#redditGermany+6

IBM has disclosed a critical authentication bypass vulnerability affecting its API Connect product. This flaw allows attackers to circumvent authentication mechanisms, potentially gaining unauthorized access to API management functions. Although no known exploits are currently reported in the wild, the vulnerability's critical severity indicates a high risk of exploitation if left unpatched. The lack of detailed affected versions and patch information suggests that organizations using IBM API Connect should urgently monitor IBM advisories for updates. European organizations relying on IBM API Connect for managing APIs could face significant confidentiality and integrity risks, especially those in sectors with high API usage such as finance, telecommunications, and government. Mitigation requires immediate attention to IBM security bulletins, applying patches once available, and implementing compensating controls such as enhanced network segmentation and strict access controls. Countries with high adoption of IBM enterprise solutions and critical infrastructure reliant on API Connect are most at risk, including Germany, the United Kingdom, France, and the Netherlands. Given the ease of exploitation implied by an authentication bypass and the broad impact on API security, the suggested severity is critical. Defenders should prioritize detection of unusual API access patterns and prepare incident response plans accordingly.

Vulnerability#infosecnews#redditGermany+3

The Cl0p ransomware group has leaked 450GB of stolen data containing records of 30,000 Korean Air employees. This data breach exposes sensitive personal and possibly professional information, posing risks of identity theft, phishing, and reputational damage. Although no CVSS score is assigned, the breach is assessed as medium severity due to the volume and sensitivity of data exposed. European organizations, especially those in the aviation sector or with business ties to Korean Air, may face indirect impacts such as targeted phishing or supply chain risks. Mitigation should focus on monitoring for phishing attempts, enhancing employee awareness, and reviewing third-party risk management. Countries with significant aviation industries and strong economic ties to South Korea, such as Germany, France, and the UK, are more likely to be affected. The threat does not involve active exploitation of vulnerabilities but results from a prior compromise and data exfiltration by a known ransomware group. Defenders should prioritize detection of related phishing campaigns and strengthen incident response capabilities.

News#infosecnews#redditGermany+5

The European Space Agency is conducting an investigation and says external science servers have been compromised. The post European Space Agency Confirms Breach After Hacker Offers to Sell Data appeared first on SecurityWeek .

BreachFranceGermany+5

CVE-2025-15389 is a high-severity OS Command Injection vulnerability in QNO Technology's VPN Firewall that allows authenticated remote attackers to execute arbitrary OS commands on the server without user interaction. The vulnerability arises from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires low attack complexity and only limited privileges, but no user interaction. Although no known exploits are currently reported in the wild, successful exploitation could lead to full system compromise, affecting confidentiality, integrity, and availability of the VPN firewall. European organizations using QNO VPN Firewalls are at risk, especially those in countries with higher adoption of QNO products or strategic reliance on VPN infrastructure. Mitigation requires immediate patching once available, strict access controls, and monitoring for suspicious command execution patterns. Countries with significant QNO market presence or critical infrastructure reliance on VPNs, such as Germany, France, Italy, and the UK, are likely most affected. Given the high CVSS score (8.7) and potential impact, organizations should prioritize remediation to prevent exploitation.

EPSS 1.1%VulnerabilityCWE-78Germany+3

The U. S. Treasury has lifted sanctions on three individuals linked to Intellexa and Predator spyware, a development that may influence the regulatory and threat landscape surrounding these spyware tools. Intellexa and Predator spyware have been associated with surveillance and cyber espionage activities, often targeting activists, journalists, and political opponents. Although no new technical vulnerabilities or exploits are reported in this announcement, the removal of sanctions could affect the availability and distribution of these spyware tools. European organizations should be aware of potential shifts in spyware deployment or vendor operations resulting from this policy change. The threat does not involve direct exploitation or vulnerabilities but relates to geopolitical and regulatory factors impacting spyware proliferation. Mitigation should focus on enhanced detection capabilities for spyware behaviors and monitoring of communications for signs of Predator or Intellexa spyware activity. Countries with significant use of surveillance technology or high-profile political targets, such as France, Germany, Italy, Spain, and the UK, may be more affected. Given the indirect nature of the threat and absence of new exploits, the suggested severity is medium.

News#infosecnews#redditFrance+4

CVE-2025-15387 is a high-severity vulnerability in QNO Technology's VPN Firewall caused by insufficient entropy in session token generation. This flaw allows unauthenticated remote attackers to perform brute-force attacks to obtain active user sessions and subsequently log into the system without credentials. The vulnerability does not require prior authentication or special privileges, and no user interaction is needed. Exploitation could lead to full compromise of VPN firewall devices, exposing sensitive network traffic and internal resources. Although no known exploits are currently in the wild, the ease of exploitation and critical impact on confidentiality, integrity, and availability make this a significant threat. European organizations using QNO VPN Firewalls are at risk, especially those in sectors with high reliance on secure remote access. Mitigation requires immediate implementation of patches once available, enhanced monitoring for brute-force attempts, and network segmentation to limit exposure. Countries with notable QNO market presence and strategic infrastructure, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize this vulnerability due to its potential to enable unauthorized access and lateral movement within networks.

EPSS 0.4%VulnerabilityCWE-331Germany+2

CVE-2025-2026 is a high-severity vulnerability affecting Moxa NPort 6100-G2/6200-G2 Series devices. It involves improper null termination in the device’s web API, allowing authenticated remote attackers with read-only web privileges to perform null byte injection. Exploiting this flaw can cause the device to reboot unexpectedly, leading to a denial-of-service (DoS) condition. The vulnerability requires no user interaction and has a CVSS score of 7.1, indicating significant risk. Although no known exploits are currently in the wild, the impact on availability is substantial for operational environments relying on these devices. European organizations using these serial device servers in industrial or critical infrastructure settings could face operational disruptions. Mitigation involves restricting access to the web API, applying vendor patches when available, and monitoring device behavior for unexpected reboots. Countries with strong industrial automation sectors and critical infrastructure deployments of Moxa products, such as Germany, France, and the UK, are most likely to be affected.

EPSS 0.4%VulnerabilityCWE-170Germany+2