The OWASP Agentic AI Top 10 highlights the most critical security risks associated with agentic AI systems, reflecting real-world attack scenarios. These attacks exploit vulnerabilities in AI agents that operate autonomously or semi-autonomously, potentially leading to unauthorized actions, data breaches, or manipulation of AI behavior. Although no specific CVEs or exploits are currently documented in the wild, the high severity rating underscores the significant risk posed by these emerging threats. European organizations leveraging agentic AI technologies must be vigilant, as these systems can impact confidentiality, integrity, and availability of critical services. Mitigations require tailored security controls focusing on AI model governance, input validation, and monitoring of AI decision-making processes. Countries with advanced AI adoption and critical infrastructure integration, such as Germany, France, and the UK, are more likely to be affected. Given the complexity and novelty of agentic AI threats, the suggested severity is high, reflecting the potential for substantial operational and reputational damage if exploited. Defenders should prioritize understanding these AI-specific risks and implement robust AI security frameworks to mitigate emerging attack vectors.
A recent high-severity crypto theft campaign targeted Trust Wallet users, resulting in the draining of 2,596 wallets and a loss of approximately $7 million. The attack exploited vulnerabilities or weaknesses related to Trust Wallet, a widely used cryptocurrency wallet application. While specific technical details of the exploit are not disclosed, the campaign demonstrates significant financial impact and risk to users' digital assets. European organizations and individuals using Trust Wallet or related services are at risk of financial loss and reputational damage. The attack does not require user interaction beyond wallet usage, and the compromised wallets indicate a breach of confidentiality and integrity of user assets. Mitigation requires immediate wallet security hygiene, including private key management, use of hardware wallets, and vigilance against phishing or malicious apps. Countries with higher cryptocurrency adoption and Trust Wallet user bases, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the financial impact, ease of exploitation, and scope, the threat severity is assessed as high. Defenders should prioritize securing wallet credentials, monitoring for suspicious transactions, and educating users on safe crypto practices.
A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.
A MongoDB exploit targeting Ubisoft's Rainbow Six Siege players led to the temporary shutdown of the game. The exploit leveraged vulnerabilities in MongoDB instances related to player data or game infrastructure, causing significant disruption. Although no known exploits in the wild have been confirmed, the incident was severe enough to prompt Ubisoft to halt game operations. The attack highlights risks associated with improperly secured MongoDB deployments. European organizations connected to Ubisoft or using similar MongoDB configurations may face risks of data exposure or service disruption. Mitigation requires securing MongoDB instances with authentication, network restrictions, and regular patching. Countries with strong gaming markets and Ubisoft presence, such as France and Germany, are most likely affected. The threat is assessed as high severity due to potential data compromise and service availability impact without requiring user interaction. Defenders should prioritize immediate MongoDB security audits and incident response readiness.
It took Sax well over a year to complete its investigation after detecting hackers on its network. The post Top US Accounting Firm Sax Discloses 2024 Data Breach Impacting 220,000 appeared first on SecurityWeek .
A data breach at Korean Air has exposed personal data of thousands of its employees. The breach was reported via Reddit and covered by BleepingComputer, indicating a high-priority incident. Although technical details about the breach vector or exploited vulnerabilities are not disclosed, the exposure of employee data poses significant risks to confidentiality and privacy. There are no known exploits in the wild related to this breach, and no patches or affected software versions have been identified. European organizations, especially those with business ties or partnerships with Korean Air, may face indirect risks such as phishing or social engineering attacks leveraging leaked employee data. Mitigation should focus on monitoring for suspicious activity, enhancing employee awareness, and securing any interconnected systems. Countries with strong aviation sectors and close economic ties to South Korea, such as Germany, the UK, and France, are more likely to be affected. Given the breach involves sensitive employee data exposure without requiring user interaction for exploitation, the suggested severity is high. Defenders should prioritize incident response, data protection, and communication strategies to mitigate potential downstream impacts.
In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated with the HoneyMyte APT group. The attacks, which began in February 2025, primarily target government organizations in Southeast and East Asia, especially Myanmar and Thailand. The malware uses various techniques to evade detection, including API obfuscation, process protection, and registry key protection. The ToneShell backdoor communicates with command-and-control servers using fake TLS headers and supports remote operations such as file transfer and shell access.
A critical zero-day vulnerability has been discovered in XSpeeder devices, affecting approximately 70,000 units. The vendor has reportedly ignored alerts about this flaw, leaving these devices exposed to potential exploitation. Although no known exploits are currently observed in the wild, the vulnerability's critical nature suggests it could allow attackers to compromise device confidentiality, integrity, or availability. The lack of patches or vendor response increases the risk for organizations relying on these devices. European organizations using XSpeeder devices should urgently assess their exposure and implement compensating controls. Countries with higher adoption of these devices and strategic infrastructure relying on them are at greater risk. Immediate mitigation steps include network segmentation, monitoring for unusual activity, and restricting device access. Given the critical severity and vendor inaction, proactive defense is essential to prevent potential exploitation.
The ecommerce giant will provide purchase vouchers to the 33.7 million individuals impacted by the incident. The post Coupang to Issue $1.17 Billion in Vouchers Over Data Breach appeared first on SecurityWeek .
Hackers stole names, addresses, Social Security numbers, ID numbers, and medical and health insurance information from Aflac’s systems. The post 22 Million Affected by Aflac Data Breach appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 29th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Romanian Waters, the country’s national water management authority, was hit by a ransomware attack that resulted in nearly 1,000 computer systems across national and regional offices being encrypted. The attack affected geographic […] The post 29th December – Threat Intelligence Report appeared first on Check Point Research .
The ‘download’ button on the official EmEditor website served a malicious installer. The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek .
The Evasive Panda cyberespionage campaign employs DNS poisoning techniques to deliver the MgBot backdoor malware. This campaign manipulates DNS responses to redirect victims to malicious servers, enabling stealthy installation of the backdoor without direct user interaction. MgBot provides persistent remote access, facilitating espionage activities by exfiltrating sensitive data and potentially enabling further network compromise. Although currently assessed as medium severity, the campaign’s use of DNS poisoning increases its stealth and difficulty to detect. European organizations, especially those in critical infrastructure and government sectors, face risks due to potential data breaches and operational disruptions. Mitigation requires enhanced DNS security measures, network monitoring for anomalous DNS activity, and endpoint detection capabilities tailored to identify MgBot behaviors. Countries with significant deployments of vulnerable DNS infrastructure and high-value targets, such as Germany, France, and the UK, are most likely to be affected. The threat’s exploitation does not require user interaction, increasing its risk profile. Defenders should prioritize DNS security hardening and incident response readiness to counter this evolving espionage threat.
A hacker named Lovely made public 2.3 million records representing Wired subscriber information. The post Hacker Claims Theft of 40 Million Condé Nast Records After Wired Data Leak appeared first on SecurityWeek .
The MongoBleed vulnerability is a high-severity flaw that leads to leakage of MongoDB secrets, exposing approximately 87,000 servers worldwide. This breach allows attackers to extract sensitive database credentials and potentially access confidential data. Although no known exploits are currently active in the wild, the scale of exposed servers and the nature of leaked secrets pose a significant risk. European organizations using MongoDB without adequate protections are vulnerable to unauthorized data access and potential data breaches. The threat primarily impacts confidentiality and integrity of data, with possible availability issues if attackers manipulate or delete data. Mitigation requires immediate auditing of MongoDB deployments, securing credentials, and applying any available patches or configuration changes to prevent unauthorized access. Countries with high MongoDB adoption and critical infrastructure relying on these databases are at greater risk. Given the ease of exploitation without authentication and the broad exposure, the severity is assessed as high. Defenders should prioritize monitoring for unusual database access patterns and enforce strict access controls to mitigate this threat.
Stolen LastPass backups reportedly enable ongoing cryptocurrency theft through 2025 by exposing sensitive credential data. The breach involves unauthorized access to backup data, potentially containing encrypted vault information that attackers can exploit to steal crypto assets. Although no known exploits are currently active in the wild, the threat persists due to the long-term validity of the stolen data. European organizations using LastPass for password management and crypto wallet credentials face risks of confidentiality breaches and financial losses. The threat severity is medium given the complexity of exploiting encrypted backups and the requirement for further decryption efforts. Mitigation requires immediate credential resets, enhanced multi-factor authentication, and monitoring of crypto transactions. Countries with high LastPass adoption and significant crypto markets, such as Germany, the UK, and the Netherlands, are most at risk. Defenders should prioritize securing password vaults, auditing access logs, and educating users on phishing risks related to credential theft. This threat underscores the importance of robust backup security and crypto asset protection strategies.
A hacker has claimed to leak a database belonging to WIRED containing approximately 2.3 million records. The breach was reported via a Reddit post in the InfoSecNews subreddit and covered by a trusted cybersecurity news source, BleepingComputer. Although the exact nature of the leaked data and the method of compromise are not detailed, the incident is classified as a high-severity data breach. There are no known exploits in the wild related to this breach, and technical details remain sparse. The leak potentially exposes sensitive information of users or subscribers associated with WIRED. European organizations may be indirectly impacted if their employees or partners' data is included or if they rely on WIRED’s services. Mitigation focuses on monitoring for data misuse, enhancing incident response, and reviewing third-party data sharing agreements. Countries with significant media consumption and digital engagement, such as the UK, Germany, and France, are more likely to be affected. Given the scale and sensitivity of the data leak, the suggested severity is high due to the potential confidentiality impact and the broad scope of affected individuals without requiring authentication or user interaction.
The Petlibro smart pet feeder has been found to expose user data to any requester without proper authentication or authorization controls. This vulnerability allows unauthorized parties to access sensitive information related to the device and potentially the user. Although no known exploits are currently active in the wild, the medium severity rating reflects the risk of privacy breaches and potential misuse of data. European organizations and consumers using Petlibro devices could face confidentiality risks. Mitigation requires device firmware updates, network segmentation, and strict access controls. Countries with higher smart pet device adoption and strong privacy regulations, such as Germany, France, and the UK, are more likely to be impacted. The threat is medium severity due to the ease of data access, lack of authentication, and potential privacy impact, but no direct system compromise or availability impact is reported. Defenders should prioritize securing IoT devices and monitoring network traffic for unauthorized access attempts.
