Threats affecting France

CVE-2025-66379 is a high-severity vulnerability in Pexip Infinity versions before 39.0, caused by improper input validation in the media implementation. A remote attacker can send a specially crafted media stream to trigger a reachable assertion failure, causing the software to abort and resulting in a denial of service (DoS). The vulnerability requires no authentication or user interaction and can be exploited over the network. While it does not impact confidentiality or integrity, it severely affects availability. No known exploits are currently reported in the wild. European organizations using Pexip Infinity for video conferencing and collaboration services are at risk of service disruption. Mitigation involves promptly upgrading to version 39.0 or later once available and implementing network-level protections to restrict untrusted media streams. Countries with significant adoption of Pexip Infinity, such as the UK, Germany, France, and the Nordics, are most likely to be affected due to their extensive use of unified communications platforms.

EPSS 0.4%VulnerabilityCWE-617Germany+2

A remote code execution (RCE) vulnerability was discovered in the CurseForge launcher involving an unauthenticated local WebSocket API accessible from the browser. This flaw allowed attackers to execute arbitrary code on the local machine without authentication. The vulnerability has been patched, and no known exploits are currently in the wild. The issue primarily affects users of the CurseForge launcher, a popular mod management tool for games. Due to its local nature and requirement for local access, exploitation complexity is moderate. European organizations using the CurseForge launcher, especially in gaming or software development sectors, could be impacted if the vulnerability is exploited. Mitigation involves applying the official patch promptly and restricting local WebSocket API access. Countries with significant gaming communities and software development industries, such as Germany, France, and the UK, are more likely to be affected. The severity is assessed as medium given the local attack vector and absence of authentication requirements but no remote network exploitation. Defenders should prioritize patching and monitor local WebSocket interfaces for unauthorized access attempts.

Vulnerability#netsec#redditGermany+2

A sophisticated campaign by the Chinese APT group Silver Fox is targeting Indian entities with authentic-looking Income Tax phishing lures. The attack leverages a complex kill chain involving DLL hijacking and the modular Valley RAT to ensure persistence. The campaign uses a multi-stage infection process, starting with a malicious email containing a PDF decoy. The payload is delivered through an NSIS installer, which drops a legitimate Thunder.exe binary and a malicious libexpat.dll for DLL hijacking. The final stage involves the Valley RAT, which uses a two-stage configuration loading mechanism and implements a 3-tier C2 communication loop. The RAT's modular plugin architecture allows for dynamic capability extension and persistence through registry-based storage.

Malware#phishing#indiaUnited Kingdom+7

MacSync is a newly identified macOS stealer malware that uses a signed application to bypass Apple’s Gatekeeper security mechanism. By leveraging a valid developer signature, it evades macOS’s built-in protections designed to prevent untrusted software execution. Although no known exploits are currently active in the wild, the malware’s ability to stealthily exfiltrate sensitive data poses a high risk. The threat primarily targets macOS systems and can compromise confidentiality by stealing user information. European organizations using macOS devices are at risk, especially those in sectors with high-value intellectual property or sensitive data. Mitigation requires strict application whitelisting, monitoring for unusual data exfiltration, and verifying app signatures beyond Gatekeeper’s default checks. Countries with significant macOS adoption and critical technology sectors, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s stealth, ease of bypassing Gatekeeper, and potential data loss, the severity is assessed as high. Defenders should prioritize detection of signed but suspicious applications and enforce multi-layered endpoint security controls.

Malware#infosecnews#redditGermany+5

The FBI has seized a domain used to store bank credentials stolen from U. S.victims, disrupting a cybercriminal operation targeting financial data. This action highlights ongoing threats involving the theft and centralized storage of sensitive banking information. Although the immediate impact is focused on U. S.victims, European organizations could be indirectly affected due to potential cross-border data flows and similar attack methodologies. The threat underscores the importance of monitoring for credential theft and securing banking access points. No direct exploits or vulnerabilities are detailed, but the high severity reflects the critical nature of stolen financial credentials. Defenders should prioritize detection of credential theft, implement multi-factor authentication, and monitor for suspicious domain activity.

News#infosecnews#redditGermany+8

Central computer systems at French national postal service La Poste were knocked offline Monday in DDoS attack. The post Pro-Russian Hackers Claim Cyberattack on French Postal Service appeared first on SecurityWeek .

News#dosFrance+4

The Evasive Panda APT group conducted highly-targeted campaigns from November 2022 to November 2024, employing adversary-in-the-middle attacks and DNS poisoning techniques. They developed a new loader that evades detection and uses hybrid encryption for victim-specific implants. The group utilized fake updaters for popular applications to deliver malware, including a multi-stage shellcode execution process. A secondary loader, disguised as a legitimate Windows library, was used to achieve stealthier loading. The attackers employed a custom hybrid encryption method combining DPAPI and RC5 to secure payloads. Victims were detected in Türkiye, China, and India, with some systems compromised for over a year. The campaign showcases the group's advanced capabilities and continuous improvement of tactics.

Campaign#aitm attacks#dns poisoningTurkey+5

Researchers reported serious vulnerabilities in Eurostar's AI chatbot, but instead of addressing the issues, Eurostar allegedly accused the researchers of blackmail. The vulnerabilities reportedly affect the chatbot's security, potentially exposing sensitive information or enabling malicious manipulation. No specific technical details or affected versions have been disclosed publicly. There are no known exploits in the wild at this time, and the discussion around this issue remains minimal. The incident highlights challenges in responsible vulnerability disclosure, especially involving AI-based systems. European organizations using similar AI chatbot technologies should be aware of potential risks. The severity is assessed as high due to the nature of the vulnerabilities and the lack of transparent remediation. Defenders should monitor for updates and engage in proactive security assessments of AI chatbot implementations. Countries with significant AI adoption and critical transport infrastructure are likely to be most impacted.

Tool#infosecnews#redditFrance+4

A novel cryptanalysis approach called the Kaoru Method proposes linearizing SHA-256's modular addition by modeling it as fractional modular arithmetic, enabling the reconstruction of a Universal Carry Map that removes modular barriers. This method simplifies differential cryptanalysis by making carry behavior predictable rather than noisy, potentially undermining SHA-256's assumed non-linearity. While no direct exploits or collisions have been demonstrated yet, this theoretical framework could pave the way for future attacks on SHA-256's compression function. The research is recent and experimental, with code and theory publicly released for validation. European organizations relying on SHA-256 for integrity, authentication, or digital signatures should monitor developments closely. Immediate practical exploitation is not confirmed, but the cryptographic assumptions underlying many security protocols could be challenged if this method matures. Mitigations include diversifying cryptographic algorithms, preparing for post-quantum or alternative hash adoption, and engaging with cryptographic research communities. Countries with strong tech sectors and critical infrastructure relying heavily on SHA-256, such as Germany, France, and the UK, are most likely to be affected. The threat severity is assessed as medium given the theoretical nature, no known exploits, and the foundational importance of SHA-256.

Campaign#netsec#redditGermany+7

A historic data breach involving the Bitfinex cryptocurrency exchange has potentially exposed user email addresses from over a year ago. Despite government attempts to notify victims, Bitfinex reportedly denied facilitating outreach. Security researchers claim possession of leaked data from 2016-era crypto exchanges, which could help victims recover significant lost funds, including a forfeiture of 113,000 Bitcoins. The breach relates to multiple exchanges active in 2016, highlighting a broad impact on the crypto ecosystem. No known active exploits are reported, but the availability of user emails poses risks of phishing and targeted scams. The threat primarily affects users of cryptocurrency exchanges, with European organizations potentially impacted due to market penetration of these platforms. Mitigation requires coordinated victim notification, enhanced email security, and user awareness to prevent secondary attacks. Countries with significant crypto adoption and regulatory interest in digital assets are most likely to be affected. Given the medium severity and lack of direct exploitation, the threat remains serious but manageable with proactive measures.

Breach#netsec#redditGermany+6

ThreatFox IOCs for 2025-12-24

Indicator#type:osint#tlp:whiteGermany+5

CVE-2025-68696 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting httparty versions 0.23.2 and earlier. This flaw allows attackers to make unauthorized requests from the vulnerable server to internal or external systems, potentially exposing sensitive data such as API keys. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. It has been patched in later versions of httparty. European organizations using vulnerable versions of httparty in their API integrations or web applications face risks of data leakage and internal network reconnaissance. No known exploits are currently reported in the wild, but the ease of exploitation and potential impact warrant immediate remediation. Organizations should upgrade to patched versions and audit internal API usage to mitigate risk. Countries with significant software development sectors and high adoption of Ruby-based tools, such as Germany, the UK, and France, are most likely to be affected.

EPSS 0.3%VulnerabilityCWE-918Germany+2

A recently analyzed multi-stage macOS infostealer malware has been identified, highlighting a complex attack targeting macOS users. This malware operates in multiple stages to evade detection and exfiltrate sensitive information from infected systems. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential to compromise confidentiality. European organizations using macOS devices should be aware of this threat, especially those in sectors with high-value data. Mitigation requires enhanced endpoint monitoring, restricting execution of unknown binaries, and user education on phishing and suspicious downloads. Countries with significant macOS market share and advanced tech sectors, such as Germany, the UK, France, and the Nordics, are more likely to be targeted. Given the malware’s complexity and potential impact on data confidentiality without requiring user interaction post-infection, the suggested severity is medium. Defenders should prioritize detection capabilities for multi-stage macOS malware and implement strict application control policies.

Malware#netsec#redditGermany+8

This entry describes a guide focused on preventing common enterprise social engineering attacks, particularly phishing. It is not a report of a new vulnerability or active exploit but rather educational content aimed at raising awareness and improving defenses. The threat category is phishing, which remains a significant risk vector for enterprises worldwide. The guide likely covers attack types such as spear phishing, pretexting, baiting, and others, along with prevention strategies. No specific affected software versions or exploits in the wild are reported. The severity is assessed as medium, reflecting the ongoing risk of social engineering but without immediate technical exploit details. European organizations remain vulnerable to social engineering due to human factors and the widespread use of email and communication platforms. Mitigation requires targeted user training, phishing simulations, and robust verification procedures. Countries with large enterprise sectors and high digital adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the nature of social engineering, the threat is moderate in severity but can lead to significant breaches if successful.

Phishing#netsec#redditGermany+5

A data breach involving Red Hat's GitLab instance has exposed personal data of approximately 21,000 Nissan customers. The breach was reported via Reddit's InfoSecNews community and linked to a news article on securityaffairs.com. Although technical details about the breach vector or exploited vulnerabilities are not provided, the incident is classified as high severity due to the exposure of sensitive customer information. No known exploits are currently active in the wild, and the discussion level around this breach remains minimal. The breach highlights risks associated with third-party code repositories and development platforms. European organizations, especially those in automotive sectors or with customer data stored in similar environments, could face increased risk. Mitigation requires enhanced access controls, monitoring of repository activity, and incident response readiness. Countries with significant automotive industries and strong Nissan market presence, such as Germany, France, and the UK, are likely to be most impacted. Given the data exposure and potential for identity theft or fraud, the suggested severity is high.

Breach#infosecnews#redditGermany+5

CVE-2025-12839 is a high-severity heap-based buffer overflow vulnerability in the Academy Software Foundation's OpenEXR library version 3.4.0. It arises from improper validation of user-supplied data length during EXR file parsing, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious EXR file or visiting a crafted webpage. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently in the wild. European organizations using OpenEXR in media, visual effects, or related industries should prioritize patching and implement strict file validation and sandboxing. Countries with strong media production sectors like the UK, Germany, and France are most likely affected.

EPSS 0.2%VulnerabilityCWE-122Germany+2

CVE-2025-13715 is a high-severity remote code execution vulnerability in Tencent FaceDetection-DSFD's resnet endpoint caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses significant risks to affected systems. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction. European organizations using Tencent FaceDetection-DSFD should prioritize patching and implement strict input validation and network segmentation to mitigate risks. Countries with significant technology sectors and Tencent product usage, such as Germany, France, and the UK, are likely to be most affected. Immediate attention is warranted to prevent potential exploitation in sensitive environments.

EPSS 0.4%VulnerabilityCWE-502Germany+2

CVE-2025-13709 is a high-severity remote code execution vulnerability in Tencent TFace's restore_checkpoint function caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected systems. The CVSS score is 7.8, reflecting high impact on confidentiality, integrity, and availability. European organizations using Tencent TFace, especially in sectors relying on AI and facial recognition technologies, should prioritize patching and implement strict input validation and network segmentation. Countries with strong technology sectors and high adoption of Tencent products, such as Germany, France, and the UK, are most likely to be affected. Immediate mitigation and monitoring are recommended to prevent potential exploitation.

EPSS 0.5%VulnerabilityCWE-502Germany+2

CVE-2025-14929 is a high-severity vulnerability in Hugging Face Transformers affecting the X-CLIP checkpoint conversion process. It arises from improper validation of user-supplied data during deserialization, enabling remote code execution if a user opens a malicious file or visits a crafted webpage. Exploitation requires user interaction but no prior authentication. The vulnerability impacts confidentiality, integrity, and availability by allowing arbitrary code execution within the affected process context. No known exploits are currently in the wild. European organizations using vulnerable versions of Hugging Face Transformers, especially in AI/ML workflows, face significant risk. Mitigation involves avoiding untrusted checkpoint files, applying patches when available, and implementing strict input validation and sandboxing. Countries with strong AI sectors and extensive use of Hugging Face tools, such as Germany, France, the UK, and the Netherlands, are most likely affected.

EPSS 0.4%VulnerabilityCWE-502#brew-mlx-lm-cve-2025-14929Germany+3

CVE-2025-14920 is a high-severity remote code execution vulnerability in the Hugging Face Transformers library, specifically affecting the Perceiver model deserialization process. The flaw arises from improper validation of user-supplied model files, allowing deserialization of untrusted data. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage. Successful exploitation enables attackers to execute arbitrary code with the privileges of the current user. Although no known exploits are reported in the wild, the vulnerability poses significant risks to confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8, reflecting its high impact and relatively low complexity to exploit. European organizations using Hugging Face Transformers in AI/ML workflows, especially those processing untrusted or external model files, are at risk. Mitigation involves strict validation of model inputs, restricting model file sources, and applying patches once available. Countries with strong AI development sectors and extensive use of open-source ML frameworks, such as Germany, France, and the UK, are most likely affected.

EPSS 0.4%VulnerabilityCWE-502Germany+2