Threats affecting Germany

CVE-2025-43706 is a high-severity vulnerability affecting multiple Samsung Exynos processors used in mobile devices, wearables, and modems. The flaw arises from incorrect handling of RRC (Radio Resource Control) packets at the L2 layer, which can be exploited remotely without authentication or user interaction to cause a Denial of Service (DoS). This vulnerability impacts the availability of affected devices by potentially crashing or disabling network connectivity. Although no known exploits are currently reported in the wild, the ease of exploitation and broad device usage pose a significant risk. European organizations relying on Samsung-based mobile and IoT devices could face operational disruptions, especially in sectors dependent on continuous connectivity. Mitigation requires close collaboration with device manufacturers for firmware updates and network-level protections. Countries with high Samsung device penetration and advanced mobile infrastructure, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the vulnerability’s characteristics, the severity is assessed as high, emphasizing the need for proactive defense measures.

EPSS 0.3%VulnerabilityCWE-400Germany+4

CVE-2025-49495 is a high-severity buffer overflow vulnerability in the WiFi driver of Samsung Mobile Processors Exynos 1380, 1480, 2400, and 1580. It arises from improper handling of NL80211 vendor commands, allowing an attacker with local access to potentially execute arbitrary code or cause denial of service without requiring user interaction or privileges. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using devices with these Exynos processors, especially in sectors relying on mobile communications, may face risks if unpatched. Mitigation involves applying vendor patches once available, restricting local access to WiFi driver interfaces, and monitoring for anomalous device behavior. Countries with high Samsung mobile device penetration and critical infrastructure reliance on mobile connectivity, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation and broad impact, the threat severity is high.

EPSS 0.2%VulnerabilityCWE-120Germany+2

CVE-2025-52515 is a medium severity vulnerability affecting the issimian device driver in Samsung Mobile and Wearable Processors (Exynos 1330, 1380, 1480, 2400, 1580, 2500). It arises from a race condition causing out-of-bounds memory access, resulting in denial of service (DoS). The vulnerability requires local access with high attack complexity and no privileges or user interaction. While it does not impact confidentiality or integrity, it can disrupt device availability. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using devices with these processors, especially in sectors relying on mobile and wearable technology, could face operational disruptions. Mitigation involves monitoring for vendor patches, restricting local access to trusted users, and applying strict device usage policies. Countries with high Samsung device adoption and advanced mobile infrastructure, such as Germany, France, and the UK, are most likely affected. The vulnerability’s medium severity reflects its limited scope and exploitation difficulty but notable impact on availability.

EPSS <0.1%VulnerabilityCWE-362Germany+2

Introduction&#xd;

Phishing#webGermany+5

ThreatFox IOCs for 2026-01-04

Indicator#type:osint#tlp:whiteGermany+5

The ShinyHunters threat actor claims to have breached US cybersecurity firm Resecurity, allegedly gaining internal access as evidenced by screenshots shared publicly. This breach involves unauthorized access to sensitive internal systems of a cybersecurity company, which could expose confidential client data and internal security methodologies. Although detailed technical specifics and affected versions are not disclosed, the breach is considered high severity due to the nature of the victim and potential data sensitivity. No known exploits or patches are currently available, and the discussion around this incident remains minimal. European organizations relying on Resecurity’s services or sharing threat intelligence with them could face indirect risks from this breach. Mitigation requires heightened vigilance around any data or communications linked to Resecurity, enhanced monitoring for suspicious activity, and verification of the integrity of shared threat intelligence. Countries with strong cybersecurity sectors and significant use of Resecurity’s services, such as the UK, Germany, and France, are more likely to be impacted. Given the breach involves unauthorized internal access without known exploitation details, the suggested severity is high due to potential confidentiality and integrity impacts and the strategic importance of the victim. Defenders should prioritize incident response readiness and scrutinize any data originating from Resecurity until further details emerge.

Breach#infosecnews#redditGermany+4

The RondoDox botnet is actively exploiting the React2Shell vulnerability to compromise thousands of unpatched devices. This threat leverages a known code execution flaw to hijack vulnerable systems, primarily targeting those that have not applied available patches. While exploitation in the wild is not yet widely confirmed, the botnet's activity indicates a growing risk of large-scale device compromise. European organizations with unpatched infrastructure are at risk of device hijacking, leading to potential service disruption and data integrity issues. The threat is medium severity but could escalate if exploitation becomes widespread. Mitigation requires immediate patching of affected systems and enhanced network monitoring for unusual botnet-related traffic. Countries with high IoT and enterprise device usage, especially those with historically targeted sectors, are more likely to be affected. The threat does not require user interaction but targets unpatched systems, increasing its potential impact. Defenders should prioritize vulnerability management and incident response readiness to mitigate this evolving botnet threat.

Botnet#infosecnews#redditGermany+7

During the Christmas holiday period, thousands of exploit attempts targeting ColdFusion servers were detected, indicating heightened attacker activity against this platform. Although no specific affected versions or CVEs were detailed, the volume and timing suggest attackers are actively scanning and attempting to exploit known or unknown vulnerabilities in ColdFusion installations. No confirmed exploits in the wild have been reported yet, but the high number of attempts raises concern for organizations running ColdFusion, especially those with exposed or unpatched systems. European organizations using ColdFusion for web applications or internal services could face increased risk of compromise, data breaches, or service disruption. Mitigation requires immediate review of ColdFusion server configurations, patching to the latest supported versions, and enhanced monitoring for suspicious activity. Countries with significant ColdFusion usage in government, finance, or critical infrastructure sectors, such as Germany, France, and the UK, are likely more exposed. Given the ease of exploitation attempts and potential impact on confidentiality and availability, the threat severity is assessed as high. Defenders should prioritize detection and response capabilities to mitigate potential exploitation during this period of increased attacker activity.

Vulnerability#infosecnews#redditGermany+2

MuddyWater, an Iran-aligned cyberespionage group, has been targeting critical infrastructure in Israel and Egypt with custom malware and improved tactics. The campaign uses previously undocumented tools like the Fooder loader and MuddyViper backdoor to enhance defense evasion and persistence. Fooder masquerades as a Snake game and uses game-inspired techniques to hinder analysis. MuddyViper enables system information collection, file manipulation, and credential theft. The group also employs browser-data stealers and reverse tunneling tools. This campaign demonstrates MuddyWater's evolution towards more sophisticated and refined approaches, though traces of operational immaturity remain. The group continues to pose a significant threat, particularly to government, military, telecommunications, and critical infrastructure sectors in the Middle East.

Malware#iran#defense evasionIsrael+5

ESET researchers have uncovered a new China-aligned APT group named LongNosedGoblin targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs a varied custom toolset of C#/.NET applications and abuses Group Policy for lateral movement. Key tools include NosyHistorian for collecting browser history, NosyDoor backdoor using cloud services as C&C, and NosyStealer for exfiltrating browser data. The attackers also utilize techniques like AppDomainManager injection and AMSI bypassing. LongNosedGoblin has been active since at least September 2023, showing ongoing campaigns throughout 2024 and 2025. The research provides detailed analysis of the group's malware and tactics, including potential sharing of the NosyDoor backdoor among multiple China-aligned actors.

Malware#nosyhistorian#southeast asiaJapan+5

The deal involved aerospace and defense specialist Emcore Corp.selling its computer chips and wafer fabrication operation. The post President Trump Orders Divestment in $2.9 Million Chips Deal to Protect US Security Interests appeared first on SecurityWeek .

NewsGermanyFrance+3

The Kermit exploit reportedly undermines police AI systems responsible for maintaining record integrity, potentially allowing adversaries to challenge or manipulate official records. Originating from a Reddit InfoSec news post and linked to flyingpenguin.com, the exploit is classified as a high-severity vulnerability but lacks detailed technical disclosure or known active exploitation. The threat primarily targets AI-driven law enforcement record systems, raising concerns about data integrity and trustworthiness in legal and administrative processes. European organizations relying on similar AI record-keeping or law enforcement technologies could face risks of data tampering or evidentiary challenges. Mitigation requires focused validation of AI system inputs, enhanced audit trails, and collaboration with AI vendors to patch vulnerabilities. Countries with advanced law enforcement AI deployments and significant digital record infrastructures, such as Germany, France, and the UK, are most likely to be affected. Given the high potential impact on data integrity and the absence of known exploits or detailed technical data, the suggested severity is high. Defenders should prioritize monitoring for related exploit attempts and strengthen AI system security controls.

Vulnerability#infosecnews#redditGermany+2

ThreatFox IOCs for 2026-01-03

Indicator#type:osint#tlp:whiteGermany+4

A ransomware attack on Covenant Health resulted in a data breach affecting over 478,000 individuals. The attack involved malware that encrypted or compromised sensitive health data, leading to significant exposure of personal information. Although no specific exploited vulnerabilities or affected software versions are detailed, the breach highlights the ongoing risk ransomware poses to healthcare organizations. There is no indication of known exploits in the wild beyond this incident. The breach underscores the importance of robust cybersecurity measures in protecting sensitive health data. European healthcare organizations face similar risks due to comparable threat landscapes and regulatory environments. Mitigation requires targeted strategies including network segmentation, advanced endpoint detection, and incident response readiness. Countries with large healthcare sectors and high adoption of similar IT infrastructure are most at risk. The severity is assessed as high due to the scale of data exposure, potential for patient harm, and operational disruption. Defenders should prioritize proactive ransomware defenses and comprehensive data protection protocols.

Malware#infosecnews#redditGermany+7

A critical security threat has emerged involving over 10,000 Fortinet firewalls that are vulnerable to an actively exploited two-factor authentication (2FA) bypass. This vulnerability allows attackers to circumvent the additional security layer provided by 2FA, potentially gaining unauthorized access to firewall management interfaces. The exploitation of this flaw can lead to severe consequences including network compromise, data breaches, and disruption of services. European organizations using Fortinet firewalls are at significant risk, especially those in sectors with high reliance on secure perimeter defenses. The threat is rated high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation without requiring user interaction. Immediate mitigation steps include applying vendor patches once available, restricting administrative access via VPN or IP whitelisting, and enhancing network monitoring for suspicious activities. Countries with high Fortinet market penetration and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Defenders must prioritize this threat to prevent widespread compromise and maintain network security.

Breach#infosecnews#redditGermany+7

A hacker claims to have stolen over 3 million records from Tokyo FM, a major Japanese radio broadcaster, indicating a significant data breach. The breach was reported via Reddit and linked to an external news source, but technical details and affected systems remain undisclosed. No known exploits or patches have been identified yet. The breach poses a high risk to confidentiality due to the volume of data compromised, potentially including personal information of listeners or employees. European organizations may face indirect impacts through partnerships or data sharing with affected entities. Mitigation focuses on enhanced monitoring, incident response readiness, and reviewing data sharing agreements. Countries with strong media sectors and close business ties to Japan, such as Germany, the UK, and France, are more likely to be affected. Given the scale and nature of the breach, the suggested severity is high due to the potential for identity theft, reputational damage, and regulatory consequences. Defenders should prioritize verifying the breach scope, securing exposed systems, and preparing for possible secondary attacks leveraging stolen data.

Breach#infosecnews#redditGermany+4

The Transparent Tribe threat actor has launched new Remote Access Trojan (RAT) attacks targeting Indian government and academic institutions. These attacks involve sophisticated malware designed to gain persistent unauthorized access, enabling espionage and data exfiltration. Although primarily focused on Indian entities, the techniques and malware used could potentially be adapted to target organizations in Europe, especially those with geopolitical or academic ties to India. The threat is considered high severity due to the targeted nature and potential impact on confidentiality and integrity of sensitive data. No public CVSS score is available, but the threat is assessed as high severity given the ease of exploitation and significant impact. European organizations should be vigilant, particularly those collaborating with Indian counterparts or involved in related research fields. Mitigation requires advanced detection, network segmentation, and threat intelligence sharing. Countries with strong academic and governmental ties to India, such as the UK, Germany, and France, are more likely to be affected. Defenders must prioritize monitoring for RAT indicators, enforce strict access controls, and maintain updated endpoint protections to mitigate this threat.

News#infosecnews#redditGermany+4

The Kimwolf Botnet is a recently reported high-severity botnet threat that targets local networks. It is actively stalking local network environments to potentially compromise devices and expand its reach. While detailed technical specifics are limited, the botnet's presence on local networks suggests it may exploit network vulnerabilities or weak device security to propagate. There are no known exploits in the wild yet, but the threat is considered high priority due to its potential impact. European organizations could face risks including unauthorized access, data exfiltration, and disruption of network services. Mitigation requires enhanced local network monitoring, segmentation, and device hardening beyond generic advice. Countries with high IoT and networked device adoption, significant industrial infrastructure, or strategic geopolitical importance in Europe are more likely to be targeted. Given the botnet’s ability to infiltrate local networks without requiring user interaction or authentication, the suggested severity is high. Defenders should prioritize detection capabilities and proactive network hygiene to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+9

The VVS Discord Stealer is a malware strain designed to extract Discord user credentials and tokens. It employs Pyarmor, a Python obfuscation tool, to evade detection by security solutions and hinder analysis. Although no known exploits in the wild have been reported yet, its medium severity rating reflects the potential risk of credential theft and unauthorized account access. The malware primarily targets Discord users, which could include individuals and organizations using Discord for communication and collaboration. European organizations with significant Discord usage, especially in tech, gaming, and remote work sectors, may be at risk. Mitigation requires enhanced endpoint detection capabilities that can identify obfuscated Python malware, user education on phishing and suspicious downloads, and restricting Discord token storage or access. Countries with high Discord adoption and active gaming or tech communities, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the malware’s ability to compromise confidentiality without requiring user interaction beyond initial infection, the suggested severity is high. Defenders should prioritize monitoring for obfuscated Python malware and implement controls to protect Discord credentials.

Malware#infosecnews#redditGermany+5

Flock, a provider of AI-enabled surveillance cameras, has exposed its devices, potentially allowing unauthorized access to video feeds and sensitive data. This exposure raises concerns about privacy violations and unauthorized surveillance. The threat involves AI-powered cameras that may be accessible due to misconfigurations or vulnerabilities. Although no known exploits are currently in the wild, the medium severity rating reflects the potential risks to confidentiality and privacy. European organizations using Flock cameras could face data breaches and compliance issues under GDPR. Mitigation requires immediate review of device configurations, network segmentation, and strict access controls. Countries with higher adoption of smart surveillance and strong privacy regulations, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation through exposed devices and the sensitivity of surveillance data, the suggested severity is medium. Defenders should prioritize securing AI surveillance infrastructure to prevent unauthorized access and data leakage.

News#infosecnews#redditGermany+6