For the latest discoveries in cyber research for the week of 3rd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Everest ransomware group has claimed responsibility for a series of attacks impacting AT&T, Dublin Airport, and Air Arabia. The ransomware gang exfiltrated sensitive data including 576,000 AT&T applicant records, 1.5 million […] The post 3rd November – Threat Intelligence Report appeared first on Check Point Research .
VulScan-MCP is an open-source Visual Studio Code extension designed to scan project dependencies for known CVEs using NVD and OSV databases. It integrates with VS Code and GitHub Copilot, allowing developers to query vulnerability status of their manifest files. The tool only reports confirmed CVEs, avoiding noise from deprecated or outdated packages, and provides remediation guidance without automatic patching. While it enhances visibility into dependency vulnerabilities, it is not itself a security threat or vulnerability. European organizations can benefit from improved dependency security management, but the tool's effectiveness depends on developer adoption and integration into secure development workflows. Countries with strong software development sectors and high VS Code usage are most likely to be impacted positively. Given this is a security tool rather than a threat, the severity assessment is not applicable. Defenders should consider integrating such tools to proactively identify and remediate dependency risks.
A large-scale attack infrastructure dubbed TruffleNet has been identified, built around the open-source tool TruffleHog. This infrastructure is used to systematically test compromised credentials and perform reconnaissance across AWS environments. The campaign involves over 800 unique hosts across 57 distinct Class C networks, characterized by consistent configurations and the use of Portainer. Alongside TruffleNet, adversaries are exploiting Amazon Simple Email Service (SES) to facilitate Business Email Compromise (BEC) campaigns. The attackers create email identities using compromised WordPress sites and conduct aggressive cloud reconnaissance. This activity highlights the evolving tactics of threat actors in exploiting cloud infrastructure at scale, combining credential theft, reconnaissance automation, and SES abuse to conduct high-volume fraud with minimal detection.
Oleksii Oleksiyovych Lytvynenko is now in the US after being held in custody in Ireland since 2023. The post Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges appeared first on SecurityWeek .
A Ukrainian suspect linked to the Conti ransomware group was extradited from Ireland to the United States. Conti ransomware is known for targeting organizations globally, encrypting data, and demanding ransom payments. While this extradition is a law enforcement action rather than a direct technical threat, it highlights ongoing efforts to disrupt ransomware operations. European organizations remain at risk from Conti and similar ransomware groups due to their widespread targeting of critical infrastructure and enterprises. The threat does not involve a new vulnerability or exploit but underscores the persistent ransomware threat landscape. No new technical exploit or malware variant details are provided. The severity is assessed as medium given the indirect nature of the event and no immediate technical exploitation. Defenders should remain vigilant against Conti ransomware tactics and maintain robust ransomware defenses. Countries with significant critical infrastructure and high ransomware targeting history, such as Germany, France, and the UK, are most relevant. This event signals continued international cooperation against ransomware criminals but does not change immediate technical risk posture.
The FCC is considering voting to eliminate existing telecom cybersecurity requirements, citing concerns over their effectiveness and legality. This regulatory rollback could weaken mandated security controls for telecommunications providers in the United States. Although this is not a direct technical vulnerability or exploit, the removal of these requirements may increase risks related to telecom infrastructure security. European organizations relying on transatlantic telecom services or interconnected networks could face indirect impacts due to potential degradation in US telecom security standards. The threat is primarily regulatory and policy-driven rather than a direct cyberattack. Mitigation involves monitoring regulatory developments, engaging with policymakers, and reinforcing internal telecom security measures independent of external mandates. Countries with strong telecom ties to the US or significant telecom infrastructure, such as the UK, Germany, and France, may be more affected. Given the indirect nature and absence of active exploits, the severity is assessed as medium. Defenders should focus on proactive risk management and maintaining robust security controls regardless of regulatory changes.
The packages deployed malicious code harvesting system information, credentials, tokens, API keys, and other sensitive information. The post 136 NPM Packages Delivering Infostealers Downloaded 100,000 Times appeared first on SecurityWeek .
Ten malicious npm packages have been discovered stealing developer credentials across Windows, macOS, and Linux platforms. These packages, once installed, exfiltrate sensitive authentication data, potentially compromising developer accounts and access to critical code repositories. The threat affects developers using npm, a widely adopted package manager in the JavaScript ecosystem, making it a significant risk for software supply chain security. Although no known exploits are currently active in the wild, the high severity rating underscores the potential damage if these packages are used in development environments. European organizations relying on npm for software development are at risk, especially those with large developer teams and open-source dependencies. Immediate mitigation involves auditing dependencies, removing suspicious packages, and enhancing credential security practices. Countries with strong technology sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. The threat is assessed as high severity due to the sensitive nature of stolen credentials, ease of exploitation via package installation, and broad platform coverage without requiring user interaction beyond installing the package.
Airstalk is a newly discovered Windows-based malware family used by a suspected nation-state actor, CL-STA-1009, in supply chain attacks targeting business process outsourcing companies. It exists in PowerShell and . NET variants, with the latter exhibiting advanced features such as multi-threaded command-and-control (C2) protocols, versioning, and signed binaries. The malware abuses the AirWatch API for mobile device management to covertly communicate with its C2 infrastructure. It exfiltrates sensitive browser data including cookies, history, and bookmarks, enabling extensive data theft. Its evasion techniques and adaptive behavior make it particularly dangerous in third-party vendor environments. No known public exploits exist yet, but the threat poses a medium severity risk with potential for significant impact on confidentiality and operational security. European organizations relying on outsourcing and mobile device management solutions are at elevated risk, especially in countries with strong BPO sectors. Mitigation requires enhanced supply chain security, monitoring of AirWatch API usage, and behavioral detection of anomalous PowerShell and . NET activities.
A significant data breach involving Ernst & Young's (EY) cloud environment resulted in a public exposure of a 4TB SQL Server backup. The leak was disclosed via a Neo Security Labs blog and discussed minimally on Reddit's NetSec subreddit. The exposed data volume suggests a large-scale compromise potentially containing sensitive corporate and client information. Although no known exploits are currently in the wild, the breach poses a medium severity risk due to the potential confidentiality impact and the scale of data involved. European organizations, especially those with close business ties or shared cloud infrastructure with EY, may face indirect risks from this exposure. Mitigation requires immediate audit of cloud storage permissions, encryption of backups, and enhanced monitoring for unauthorized access. Countries with significant EY presence and financial sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the nature of the breach—large data exposure without active exploitation—the suggested severity is medium. Defenders should prioritize verifying their own cloud security postures and reviewing third-party data handling agreements.
The Everest ransomware group has reportedly leaked sensitive records from AT&T, a major telecommunications carrier, and is demanding a $1 million ransom for passenger data related to Dublin Airport. This incident highlights the growing trend of ransomware actors targeting critical infrastructure and high-profile organizations to extract large ransoms. The leak of carrier records and airport passenger data poses significant risks to confidentiality and privacy. European organizations, especially those connected to aviation and telecommunications sectors, could face increased exposure to data breaches and operational disruptions. Mitigation requires targeted incident response, enhanced monitoring of sensitive data flows, and collaboration with law enforcement. Ireland is particularly at risk due to the direct targeting of Dublin Airport, while other European countries with major airports and telecom providers may also be affected. Given the medium severity rating and lack of known exploits in the wild, the threat is serious but not yet widespread. Defenders should prioritize securing access controls and data exfiltration detection to prevent similar attacks.
While reviewing malicious messages that were delivered to our handler inbox over the past few days, I noticed that the “subject” of one phishing e-mail looked quite strange when displayed in the Outlook message list…
BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.
Coveware has attributed the drop to large enterprises increasingly refusing to pay up and smaller amounts paid by mid-market firms. The post Ransomware Payments Dropped in Q3 2025: Analysis appeared first on SecurityWeek .
The Everest ransomware group claims to have stolen 1.5 million passenger records from Dublin Airport and 18,000 employee records from Air Arabia. This incident involves significant data exfiltration targeting critical transportation and airline sectors. Although no CVSS score is available, the breach impacts confidentiality and potentially operational integrity. The ransomware group has not yet released technical details or exploits, and discussion remains minimal. European organizations, especially in Ireland and countries with strong aviation ties, face heightened risk from similar attacks. The threat underscores the importance of securing sensitive personal and employee data against ransomware and data theft. Mitigation requires targeted data protection, network segmentation, and incident response readiness. Countries with major airports and airline operations are most vulnerable given the strategic value of such data. The severity is assessed as high due to the scale of data stolen and the critical infrastructure involved.
A new phishing campaign named CoPhish targets users of Copilot Studio agents to steal OAuth tokens, enabling attackers to hijack user sessions and access sensitive resources. This attack leverages social engineering to trick users into authorizing malicious OAuth applications or interacting with compromised Copilot Studio agents. The stolen tokens can grant attackers unauthorized access to cloud services and enterprise applications without needing user credentials. The campaign is recent and considered high severity due to the potential for widespread token theft and session hijacking. No known exploits in the wild have been reported yet, but the threat is credible given the trusted source and recent discovery. European organizations using Copilot Studio or similar OAuth-based integrations are at risk, especially those heavily reliant on cloud services. Mitigation requires targeted user awareness, strict OAuth app permission reviews, and enhanced monitoring of token usage. Countries with significant cloud adoption and technology sectors, such as Germany, the UK, France, and the Netherlands, are likely more exposed. The attack does not require system vulnerabilities but exploits user trust and OAuth token handling, making it relatively easy to execute. The suggested severity is high due to the impact on confidentiality and integrity without requiring credential theft or complex exploits.
Shortly after the browser was launched, numerous fraudulent domains and fake applications were discovered. The post Hackers Target Perplexity Comet Browser Users appeared first on SecurityWeek .
At the Pwn2Own Ireland event, hackers earned over $1 million by discovering and exploiting 73 zero-day vulnerabilities across various software and hardware targets. These zero-days represent previously unknown security flaws that could be leveraged for unauthorized access, data theft, or system compromise. Although no known exploits are currently active in the wild, the sheer volume and diversity of vulnerabilities highlight significant security risks. European organizations using affected products should be vigilant, as attackers could weaponize these zero-days before patches are widely deployed. Mitigation requires timely patching once updates are released, enhanced monitoring for unusual activity, and applying defense-in-depth strategies. Countries with high technology adoption and critical infrastructure reliant on the targeted systems are at greater risk. Given the high impact potential and ease of exploitation demonstrated in controlled environments, the threat severity is assessed as high. Defenders must prioritize awareness and readiness to respond to emerging exploits stemming from these zero-days.
A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.
