Threats affecting Italy

DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.

Malware#backdoor#dll sideloadingGermany+6

A hacker claims to have breached the European Space Agency (ESA) and is selling 200GB of stolen data. The breach was disclosed via a Reddit post linking to an external news source, but technical details and verification remain minimal. The compromised data volume suggests a significant exfiltration of sensitive information, potentially impacting ESA's confidentiality and operational security. No known exploits or vulnerabilities have been publicly identified, and there is no evidence of active exploitation beyond the data sale claim. European organizations, especially those in aerospace and governmental sectors, could face increased risk from secondary attacks leveraging this breach. Mitigation requires immediate internal investigation, enhanced monitoring for data exfiltration, and tightening of access controls. Countries with strong aerospace sectors and ESA involvement, such as France, Germany, Italy, Spain, and the Netherlands, are most likely to be affected. Given the high potential impact on confidentiality and the strategic importance of ESA, the suggested severity is high. Defenders should prioritize verifying the breach, assessing data sensitivity, and preparing incident response plans accordingly.

Breach#infosecnews#redditFrance+6

In 2025, there was a significant increase in rogue ScreenConnect installations, part of a broader trend of threat actors abusing remote monitoring and management tools (RMMs). These tools were used to gain access, blend in, move laterally, and maintain persistence in target systems. Attackers employed various social engineering tactics to trick employees into downloading malicious RMMs. Common lures included fake Social Security statements, invitations, and financial documents. The Huntress Security Operations Center identified recurring patterns in lures, domains, and file hashes associated with these attacks. Some campaigns showed signs of targeting specific industries, such as accounting firms. The article provides detailed examples of attack patterns, top malicious domains, and file hashes observed throughout the year.

Malware#lures#social engineeringGermany+5

The DarkSpectre browser extension campaigns have compromised approximately 8.8 million users worldwide by distributing malicious browser extensions. These campaigns involve extensions that likely perform unauthorized data collection, user tracking, or other malicious activities, impacting user privacy and security. Although no specific affected versions or exploits in the wild are detailed, the scale of impact and exposure indicates a high-severity threat. European organizations using popular browsers susceptible to these extensions are at risk of data leakage and potential downstream attacks. The threat does not require user authentication but likely depends on user installation of malicious extensions, making user awareness critical. Mitigation involves proactive monitoring of browser extensions, enforcing strict extension policies, and educating users about risks. Countries with high browser usage and significant digital economies, such as Germany, France, and the UK, are most likely to be affected. Given the broad impact on confidentiality and potential integrity of user data, ease of exploitation through extension installation, and large affected user base, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and strengthen endpoint security controls.

Breach#infosecnews#redditGermany+6

The Everest ransomware group has reportedly leaked 1TB of stolen data from ASUS, a major technology company. This incident involves a significant data breach resulting from a ransomware attack, where attackers exfiltrated sensitive corporate data before encrypting systems. Although no specific affected versions or exploited vulnerabilities are detailed, the leak highlights the ongoing threat ransomware groups pose to large enterprises. The attack's medium severity suggests moderate impact, but the large volume of leaked data could have serious confidentiality implications. European organizations, especially those in the technology supply chain or with partnerships with ASUS, may face indirect risks such as data exposure or secondary attacks. Mitigation should focus on enhancing network segmentation, monitoring for data exfiltration, and securing third-party vendor relationships. Countries with strong technology sectors and close economic ties to ASUS, such as Germany, France, and the UK, are more likely to be affected. Given the data leak scale and ransomware context, the threat severity is assessed as high due to potential confidentiality loss and operational disruption. Defenders should prioritize incident response readiness and data leak detection capabilities to mitigate similar threats.

Malware#infosecnews#redditGermany+5

Two US cybersecurity experts have been found guilty of participating in an extortion scheme involving the ALPHV ransomware. This case highlights insider threats where individuals with cybersecurity expertise exploit their knowledge for criminal activities. Although no specific technical vulnerabilities or exploits are detailed, the involvement of trusted experts in ransomware operations raises concerns about the integrity of cybersecurity professionals. The threat does not currently have known exploits in the wild beyond this criminal activity. European organizations could be indirectly impacted due to the global reach of ALPHV ransomware campaigns. Mitigation should focus on insider threat detection, enhanced vetting, and monitoring of cybersecurity personnel. Countries with significant ransomware targeting history and high adoption of cybersecurity services may be more affected. Given the medium severity rating and lack of direct technical exploit details, the threat severity is assessed as medium. Defenders should remain vigilant about insider risks and ransomware extortion schemes involving trusted individuals.

Malware#infosecnews#redditGermany+7

Disney has agreed to pay $10 million to settle a lawsuit alleging violations of children's data privacy on YouTube. The case centers on claims that Disney improperly collected and used personal data from children without adequate consent or safeguards, violating privacy regulations. While this is a significant legal and financial consequence for Disney, it does not represent a direct technical vulnerability or exploit. The settlement highlights the increasing regulatory scrutiny on companies handling children's data, especially in digital and online platforms. European organizations should note the importance of compliance with data protection laws such as GDPR and the ePrivacy Directive, which impose strict requirements on processing children's personal data. This case underscores the risks of non-compliance, including costly legal actions and reputational damage. No active exploits or technical attack vectors are associated with this event. Organizations should review their data collection practices, especially for minors, and ensure transparency, parental consent, and data minimization. Countries with strong data protection enforcement and significant digital media markets, such as Germany, France, and the UK, are particularly relevant in this context. Overall, this incident is a legal and compliance issue rather than a cybersecurity threat or vulnerability requiring technical mitigation.

News#infosecnews#redditGermany+6

The Cl0p ransomware group has leaked 450GB of stolen data containing records of 30,000 Korean Air employees. This data breach exposes sensitive personal and possibly professional information, posing risks of identity theft, phishing, and reputational damage. Although no CVSS score is assigned, the breach is assessed as medium severity due to the volume and sensitivity of data exposed. European organizations, especially those in the aviation sector or with business ties to Korean Air, may face indirect impacts such as targeted phishing or supply chain risks. Mitigation should focus on monitoring for phishing attempts, enhancing employee awareness, and reviewing third-party risk management. Countries with significant aviation industries and strong economic ties to South Korea, such as Germany, France, and the UK, are more likely to be affected. The threat does not involve active exploitation of vulnerabilities but results from a prior compromise and data exfiltration by a known ransomware group. Defenders should prioritize detection of related phishing campaigns and strengthen incident response capabilities.

News#infosecnews#redditGermany+5

The European Space Agency is conducting an investigation and says external science servers have been compromised. The post European Space Agency Confirms Breach After Hacker Offers to Sell Data appeared first on SecurityWeek .

BreachFranceGermany+5

CVE-2025-15389 is a high-severity OS Command Injection vulnerability in QNO Technology's VPN Firewall that allows authenticated remote attackers to execute arbitrary OS commands on the server without user interaction. The vulnerability arises from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires low attack complexity and only limited privileges, but no user interaction. Although no known exploits are currently reported in the wild, successful exploitation could lead to full system compromise, affecting confidentiality, integrity, and availability of the VPN firewall. European organizations using QNO VPN Firewalls are at risk, especially those in countries with higher adoption of QNO products or strategic reliance on VPN infrastructure. Mitigation requires immediate patching once available, strict access controls, and monitoring for suspicious command execution patterns. Countries with significant QNO market presence or critical infrastructure reliance on VPNs, such as Germany, France, Italy, and the UK, are likely most affected. Given the high CVSS score (8.7) and potential impact, organizations should prioritize remediation to prevent exploitation.

EPSS 1.1%VulnerabilityCWE-78Germany+3

The U. S. Treasury has lifted sanctions on three individuals linked to Intellexa and Predator spyware, a development that may influence the regulatory and threat landscape surrounding these spyware tools. Intellexa and Predator spyware have been associated with surveillance and cyber espionage activities, often targeting activists, journalists, and political opponents. Although no new technical vulnerabilities or exploits are reported in this announcement, the removal of sanctions could affect the availability and distribution of these spyware tools. European organizations should be aware of potential shifts in spyware deployment or vendor operations resulting from this policy change. The threat does not involve direct exploitation or vulnerabilities but relates to geopolitical and regulatory factors impacting spyware proliferation. Mitigation should focus on enhanced detection capabilities for spyware behaviors and monitoring of communications for signs of Predator or Intellexa spyware activity. Countries with significant use of surveillance technology or high-profile political targets, such as France, Germany, Italy, Spain, and the UK, may be more affected. Given the indirect nature of the threat and absence of new exploits, the suggested severity is medium.

News#infosecnews#redditFrance+4

ThreatFox IOCs for 2025-12-31

Indicator#type:osint#tlp:whiteGermany+6

The ErrTraffic service facilitates ClickFix attacks by simulating fake browser glitches to deceive users into clicking malicious links or buttons. This phishing technique exploits user trust in browser error messages to induce interaction with fraudulent content. Although no known exploits are currently reported in the wild, the high severity rating indicates significant potential risk. The attack leverages social engineering through fabricated browser behavior, making it difficult to detect by traditional security controls. European organizations with high web interaction volumes and reliance on browser-based workflows are particularly vulnerable. Mitigation requires user awareness training focused on recognizing fake browser glitches, deployment of advanced browser security extensions, and monitoring for anomalous web traffic patterns. Countries with large digital economies and high internet penetration, such as Germany, France, and the UK, are most likely to be targeted. The threat is assessed as high severity due to its potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope of affected users. Defenders should prioritize detection of unusual browser error pop-ups and educate users to avoid interaction with suspicious browser messages.

Phishing#infosecnews#redditGermany+6

US cybersecurity experts have pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks, a high-severity malware threat known for targeting organizations globally. BlackCat ransomware is a sophisticated, highly configurable ransomware-as-a-service (RaaS) strain that encrypts victim data and demands ransom payments, often coupled with data exfiltration and double extortion tactics. Although no specific affected versions or exploits are detailed, the involvement of insiders with cybersecurity expertise highlights the threat's complexity and potential for significant damage. European organizations are at risk due to the widespread targeting of critical infrastructure and enterprises by BlackCat operators. Mitigation requires tailored defenses including advanced endpoint detection, network segmentation, and proactive threat hunting focused on ransomware behaviors. Countries with high digital infrastructure reliance and previous ransomware incidents, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the high impact on confidentiality, integrity, and availability, ease of exploitation via social engineering or insider knowledge, and broad scope of affected systems, the threat severity is assessed as high. Defenders should prioritize rapid detection and response capabilities, employee training on phishing, and robust backup strategies to mitigate this evolving ransomware threat.

Malware#infosecnews#redditGermany+5

Zoom Stealer is a malicious browser extension designed to harvest sensitive corporate meeting intelligence from users participating in Zoom meetings. It operates by infiltrating browsers and extracting data related to scheduled meetings, participant details, and potentially confidential content shared during these sessions. Although no known exploits are currently reported in the wild, the threat poses a high risk due to the sensitive nature of corporate communications it targets. The attack vector involves social engineering or deceptive distribution of browser extensions, making user vigilance critical. European organizations relying heavily on Zoom for remote collaboration are at risk of data leakage, espionage, and reputational damage. Mitigation requires strict control over browser extension installations, enhanced endpoint monitoring, and user education on the risks of unauthorized extensions. Countries with significant Zoom usage in finance, technology, and government sectors, such as Germany, France, and the UK, are particularly vulnerable. Given the ease of exploitation and potential impact on confidentiality and integrity, the threat severity is assessed as high. Defenders should prioritize detection of suspicious extensions and enforce policies limiting extension permissions to reduce exposure.

Malware#infosecnews#redditGermany+6

The European Space Agency (ESA) has confirmed a security breach involving its external servers. While specific technical details about the breach remain limited, the incident is classified as high severity due to the potential exposure of sensitive data and disruption risks. The breach was reported via a trusted cybersecurity news source and discussed briefly on Reddit's InfoSec community, indicating early-stage public awareness. No known exploits are currently active in the wild, and no patches or remediation details have been disclosed yet. European organizations, especially those involved in aerospace, research, and governmental sectors, may face indirect impacts due to potential espionage or data leakage. Mitigation should focus on immediate forensic analysis, enhanced monitoring of external-facing assets, and strict access controls. Countries with significant aerospace industries and ESA involvement, such as France, Germany, Italy, and the Netherlands, are likely to be most affected. Given the breach affects external servers and could compromise confidentiality and availability without requiring user interaction, the suggested severity is high. Defenders should prioritize rapid incident response and collaboration with ESA for threat intelligence sharing.

Breach#infosecnews#redditFrance+6

Between December 19-22, 2025, EmEditor's official website suffered a security breach, causing the main download button to serve malicious software. The fake installer, signed by WALSHAM INVESTMENTS LIMITED, contained infostealer malware targeting login credentials, browser history, and VPN settings. It specifically targeted technical staff and government offices, stealing files and installing a fraudulent browser extension for remote control and cryptocurrency address swapping. Users who downloaded during this period are advised to check the digital signature, delete suspicious files, and change stored passwords. Emurasoft is investigating the incident and has apologized for the inconvenience.

Campaign#infostealer#data theftGermany+7

HoneyMyte, also known as Mustang Panda, is deploying a new backdoor malware called ToneShell in targeted attacks primarily in South and East Asia. The ToneShell backdoor enables persistent unauthorized access to compromised systems, facilitating espionage and data exfiltration. Although currently observed mainly in Asian regions, the threat actor's history and malware capabilities suggest potential risks to European organizations with relevant geopolitical or business ties. The malware does not have publicly known exploits in the wild yet, but its deployment by a known advanced persistent threat (APT) group indicates a medium severity risk. European entities involved in sectors such as government, defense, or technology with connections to Asia should be vigilant. Mitigation requires enhanced network monitoring for unusual outbound connections, strict application whitelisting, and threat hunting for ToneShell indicators. Countries with strong economic or diplomatic links to South and East Asia, such as Germany, France, and the UK, are more likely to be targeted. The threat’s medium severity is due to its backdoor nature, moderate ease of exploitation by a skilled actor, and potential for significant confidentiality and integrity impacts without immediate widespread availability disruption.

Malware#infosecnews#redditGermany+5

This report discusses a novel social engineering threat where attackers use AI-generated images to fraudulently obtain refunds from companies. The technique involves creating realistic but fake images that purportedly show product defects or issues, convincing customer service to issue refunds or replacements. While not a direct technical vulnerability, this tactic exploits human trust and procedural weaknesses in customer support processes. The threat does not involve malware or system compromise but can lead to financial losses and operational disruption. European organizations with significant e-commerce or customer service operations are at risk, especially those lacking robust verification procedures. Mitigation requires enhanced customer interaction protocols, AI detection tools, and staff training to identify suspicious claims. Countries with large retail sectors and high online shopping adoption, such as Germany, the UK, and France, are most likely affected. The severity is assessed as medium due to the indirect nature of the threat, limited technical impact, but potential financial and reputational damage. Defenders should focus on process hardening and awareness to reduce exploitation risk.

News#infosecnews#redditGermany+6

The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor. The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek .

MalwareGermanyFrance+5