Dozens of Venezuelan nationals have been charged by the US for their role in ATM jackpotting attacks. The post 2 Venezuelans Convicted in US for Using Malware to Hack ATMs appeared first on SecurityWeek .
CVE-2026-0778 is a high-severity vulnerability in the Enel X JuiceBox 40 electric vehicle charging stations, specifically in the Telnet service running on TCP port 2000. The flaw is due to missing authentication, allowing network-adjacent attackers to execute arbitrary code remotely without any credentials or user interaction. Exploitation results in full compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to installations running version 4.2.7. European organizations using these charging stations could face operational disruptions and potential lateral movement into broader networks. Mitigations include network segmentation, disabling Telnet if possible, restricting access to port 2000, and monitoring for unusual activity. Countries with high EV adoption and deployments of Enel X JuiceBox 40, such as Germany, France, Italy, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and critical impact, this vulnerability demands urgent attention from defenders.
This intelligence report emphasizes the importance of understanding one's own network environment and not ignoring reconnaissance events in cybersecurity. It highlights the increasing sophistication of bad actors in reconnaissance, both in network scanning and social engineering, aided by AI tools. The report warns against dismissing reconnaissance alerts in favor of focusing solely on attack signals, stressing that initial access brokers excel at understanding target environments. Recent vulnerability discoveries in various software applications are mentioned, along with key security headlines including phishing campaigns, ransomware attacks, and nation-state hacking activities. The report also provides information on prevalent malware files and upcoming security events.
CVE-2025-67652 is a medium severity vulnerability affecting AutomationDirect CLICK Programmable Logic Controllers (PLCs), specifically versions C0-0x, C0-1x, and C2-x. The vulnerability arises from improper handling of credentials within project files, allowing an attacker with access to these files to impersonate users, escalate privileges, or gain unauthorized access to connected systems. Exploitation requires local access to the project file and low complexity attack conditions, with no user interaction needed. The vulnerability impacts confidentiality significantly but has limited effect on integrity and no impact on availability. No public exploits are currently known. European organizations using these PLCs in industrial control environments could face risks of unauthorized access and potential lateral movement within their networks. Mitigation requires strict access controls on project files, encryption of sensitive data, and monitoring for unauthorized access. Countries with significant industrial automation sectors and AutomationDirect market presence, such as Germany, France, Italy, and the UK, are most likely to be affected.
This comprehensive analysis covers cyber threats and security issues in the financial industry, both in Korea and globally. It examines malware and phishing cases, lists top malware strains, and provides statistics on leaked Korean accounts. Key issues on the deep and dark web are highlighted, including a major database leak from Indonesia's largest bank, exposing sensitive financial data of approximately 3 million customers. A ransomware attack on a leading African financial services company by INC Ransom group is also detailed, with 100GB of data reportedly stolen. The report emphasizes the potential for widespread damage and chain attacks, urging proactive measures among financial institutions and related companies.
Hackers bypass the FortiCloud SSO login authentication to create new accounts and change device configurations. The post New Wave of Attacks Targeting FortiGate Firewalls appeared first on SecurityWeek .
A comprehensive analysis of a Potentially Unwanted Application (PUA) identified as HEURRemoteAdmin.GoToResolve.gen reveals its association with the GoTo Resolve Unattended Access application. While digitally signed by GoTo Technologies USA, LLC, the sample exhibits behaviors typical of PUAs, including silent installation, background thread execution, and persistent presence on the system. The application's use of the Restart Manager library, often seen in ransomware and wiper malware, raises concerns. Although no direct malicious payload was observed, the remote access capabilities present a significant security risk, potentially allowing unauthorized system control or deployment of secondary malware. The sample's detection by UltraAV further supports its classification as a security threat, warranting removal unless explicitly authorized and managed within organizational security policies.
CVE-2025-27377 is a medium-severity vulnerability in Altium Designer version 24.9.0 involving improper validation of self-signed server certificates during cloud connections. This flaw allows an attacker capable of man-in-the-middle (MITM) attacks to intercept or manipulate network traffic, potentially exposing authentication credentials or sensitive design data. Exploitation requires network access and user interaction, with a higher attack complexity. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality but not integrity or availability. European organizations using Altium Designer for PCB design and engineering could face data exposure risks, especially in countries with significant electronics and manufacturing sectors. Mitigation involves avoiding untrusted networks, using VPNs, monitoring network traffic for anomalies, and applying vendor patches once available. Countries like Germany, France, Italy, and the UK are most likely affected due to their strong electronics industries and Altium user base.
PurpleBravo, a North Korean state-sponsored threat group, targets software developers through fake recruitment efforts, particularly in cryptocurrency and software development sectors. Their toolkit includes BeaverTail, PyLangGhost, and GolangGhost, designed for stealing browser credentials and cryptocurrency information. The group has affected 3,136 IP addresses, mainly in South Asia and North America, compromising 20 organizations across various industries. PurpleBravo's tactics include using fictitious personas, malicious GitHub repositories, and sophisticated malware to infiltrate IT services companies, posing a significant supply-chain risk. The group shows overlap with PurpleDelta, another North Korean threat actor, sharing infrastructure and operational patterns. PurpleBravo's focus on the IT sector in South Asia presents an overlooked threat to organizations outsourcing IT services.
By integrating identity threat detection with MFA, organizations can protect sensitive data, maintain operational continuity, and reduce risk exposure. The post Why Identity Security Must Move Beyond MFA appeared first on SecurityWeek .
LockBit, originating as ABCD ransomware in 2019, has evolved to version 5.0 in September 2025. After a period of inactivity, it resumed operations in December 2025 with a reduced affiliate sign-up fee. LockBit 5.0, nicknamed ChoungDong, consists of a Loader and Ransomware component. The Loader decrypts and executes the payload in memory, while the Ransomware uses ChaCha20 and Curve25519 for encryption. This update significantly enhances evasion techniques and attack efficiency, introducing features like Mutex, Execution Delay, and Wiper. The group's history includes affiliation with the Maze cartel, independent operations, and continuous upgrades. Mitigation strategies involve monitoring process behavior, applying security patches, and preparing for swift responses using provided IoCs and MITRE ATT&CK techniques.
A 2025 study analyzing 6 billion stolen passwords reveals that user password behavior remains stagnant, with common weak passwords like '123456', 'admin', and 'password' dominating. This widespread use of easily guessable passwords continues to expose organizations to credential-based attacks. Although no specific software vulnerability is identified, the persistence of weak passwords significantly increases risks of unauthorized access and data breaches. European organizations remain vulnerable due to reliance on password authentication and insufficient enforcement of strong password policies. Mitigation requires enforcing multi-factor authentication, implementing password blacklists, and user education to reduce weak password usage. Countries with large digital economies and high internet penetration, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the ease of exploitation and potential for broad impact, the threat severity is assessed as high. Defenders must prioritize strengthening authentication controls and monitoring for credential abuse to mitigate this ongoing risk.
KRVTZ IDS alerts from January 21, 2026, report network reconnaissance targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands. Additional suspicious scanning includes anomalous HTTP user-agent strings and attempts to access sftp-config.json files to discover exposed credentials. No active exploitation or public patches are currently reported. European organizations, especially in critical infrastructure, finance, and government sectors, are at increased risk. The threat level is medium due to the potential impact if exploited combined with ease of reconnaissance. Defenders should prioritize patching when available, restrict access, and secure credentials to mitigate risk.
Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
