I have already talked about various React2Shell exploit attempts we have observed in the last weeks. But new varieties of the exploit are popping up, and the most recent one is using this particular version of the exploit:
A recent critical cybersecurity threat highlights how misconfigured network devices have become a significant attack vector targeting critical infrastructure, with Russia reportedly pivoting to exploit these weaknesses. The threat involves attackers leveraging improperly secured network equipment to gain unauthorized access, potentially disrupting essential services. Although no known exploits are currently active in the wild, the risk remains high due to the critical nature of affected systems and the ease with which misconfigurations can be exploited. European critical infrastructure entities, especially those relying on legacy or poorly managed network devices, face elevated risks. Mitigation requires thorough configuration audits, network segmentation, and enhanced monitoring tailored to detect anomalous device behavior. Countries with significant industrial control systems and critical infrastructure sectors, such as Germany, France, and the UK, are particularly vulnerable given their technological landscape and geopolitical relevance. The threat severity is assessed as critical due to the potential for widespread disruption, ease of exploitation, and the high-value nature of targeted assets. Defenders should prioritize immediate configuration reviews and implement strict access controls to mitigate this emerging risk.
The ClickFix attack is a social engineering malware campaign that tricks users into installing the DarkGate malware by presenting a fake browser fix prompt. This malware installation method relies on deceiving users rather than exploiting technical vulnerabilities. DarkGate is a known malware family capable of data theft and remote access, posing risks to confidentiality and system integrity. The attack does not currently have known exploits in the wild but is considered medium severity due to its potential impact and user interaction requirement. European organizations are at risk primarily through end-user exposure to malicious web content or phishing campaigns. Mitigation requires user education, strict browser security policies, and endpoint detection capabilities. Countries with high internet usage, significant business sectors reliant on browser-based workflows, and historical malware targeting are more likely to be affected. Given the attack vector and impact, the threat severity is assessed as medium. Defenders should focus on awareness, monitoring, and blocking suspicious browser prompts or downloads.
Parked domains are increasingly being weaponized through direct search advertising, posing significant risks to users. The investigation found that over 90% of visits to parked domains led to scams, malware, or unwanted content. Three key actors were identified: one using lookalike domains and mail collection, another employing sophisticated 'double fast flux' techniques, and a third exploiting DNS configuration typos. These actors actively profile visitors and selectively redirect traffic to malicious advertisers. The complexity of the advertising ecosystem makes it difficult to trace the origin of threats. Recent policy changes and the rise of AI may inadvertently increase risks associated with parked domains.
RansomHouse, a ransomware-as-a-service operated by the Jolly Scorpius group, has upgraded its encryption capabilities with a new version of its Mario ransomware component. This upgrade introduces a sophisticated two-stage encryption process, enhanced memory management, and dynamic file processing, making the ransomware more efficient and harder to analyze. The attack chain involves MrAgent managing deployments and Mario performing file encryption, primarily targeting virtualized environments such as ESXi servers. Although no known exploits are currently in the wild, the improvements signal a trend toward more resilient ransomware variants. European organizations using virtualized infrastructure are at risk, especially those with ESXi deployments. The threat requires no known CVE but poses a medium severity risk due to its complexity and potential impact on availability and data confidentiality. Mitigation should focus on securing virtualization platforms, monitoring for indicators of compromise, and implementing robust backup and recovery strategies. Countries with high virtualization adoption and critical infrastructure reliance on virtual environments are most likely to be affected.
The trucking industry group has released its 2026 Transportation Industry Cybersecurity Trends Report. The post NMFTA Warns of Surge and Sophistication of Cyber-Enabled Cargo Theft appeared first on SecurityWeek .
The Askul data breach resulted from a ransomware attack that exposed over 700,000 records, compromising sensitive information. This incident highlights the growing threat of ransomware targeting corporate networks and the consequential data leaks. The breach likely involved unauthorized access followed by data exfiltration before encryption. European organizations, especially those with supply chain or business ties to Askul, may face indirect impacts such as data privacy concerns and regulatory scrutiny. Mitigation requires enhanced ransomware defenses, including network segmentation, robust backup strategies, and continuous monitoring for anomalous activity. Countries with significant logistics, retail, or supply chain sectors, such as Germany, France, and the UK, are more likely to be affected due to their economic ties and market penetration of similar services. Given the high volume of exposed records and the nature of ransomware attacks, the severity is assessed as high. Defenders should prioritize incident response readiness and data protection measures to mitigate similar threats.
The malware provides full device control and real-time surveillance capabilities like those of advanced spyware. The post New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps appeared first on SecurityWeek .
Hackers claim to have stolen 94GB of Pornhub Premium users' watch histories, potentially exposing sensitive personal data related to adult content consumption. Although the claim originates from a Reddit post linking to a third-party news site, there is minimal technical detail or confirmation of the breach. The data allegedly includes detailed user activity logs, which could lead to privacy violations and reputational damage for affected individuals. There is no evidence of known exploits in the wild or patches available. The impact on European organizations is indirect but significant for privacy compliance and user trust, especially given GDPR regulations. Mitigation focuses on monitoring for data leaks, enhancing user data protection, and preparing incident response plans. Countries with higher Pornhub usage and strong privacy enforcement, such as Germany, France, and the UK, are more likely to be affected. Given the sensitivity of the data and potential privacy impact, the severity is assessed as medium. Defenders should prioritize data leak detection and user notification readiness.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting multiple Fortinet products to its Known Exploited Vulnerabilities catalog. Although no specific CVSS score or detailed technical information is provided, the flaw is considered medium severity and currently has no known exploits in the wild. This vulnerability impacts Fortinet devices, which are widely used for network security, including firewalls and VPNs, making it a relevant concern for organizations relying on these products. European organizations using Fortinet products should be aware of this addition to CISA's catalog and prioritize monitoring and patching once updates become available. The threat does not require user interaction but may allow unauthorized access or disruption if exploited. Countries with significant Fortinet deployments and critical infrastructure reliance on these devices are at higher risk. Immediate mitigation steps include reviewing Fortinet advisories, applying patches promptly, and enhancing network monitoring for suspicious activity. Given the medium severity and lack of known exploits, the threat should be taken seriously but does not currently represent an urgent crisis.
The Chinese Ink Dragon threat group has been identified as operating covertly within European government networks, engaging in a cyber espionage campaign. This activity involves persistent unauthorized access, likely aimed at intelligence gathering and strategic advantage. The campaign is considered high severity due to the sensitive nature of the targets and the potential impact on government confidentiality and operations. Although specific technical details and indicators of compromise are limited, the threat actor’s presence in critical government infrastructure poses significant risks. European organizations, especially government entities, face risks including data exfiltration, disruption of services, and compromise of sensitive information. Mitigation requires targeted network monitoring, enhanced threat hunting, and strict access controls tailored to government environments. Countries with high government digitalization and geopolitical relevance to China are most at risk. Given the stealth and persistence of the group, the threat is assessed as high severity, reflecting the potential for substantial confidentiality and integrity impacts without requiring user interaction. Defenders should prioritize detection and response capabilities focused on advanced persistent threat behaviors.
LKQ said the personal information of thousands of individuals was compromised as a result of the hacker attack. The post Auto Parts Giant LKQ Confirms Oracle EBS Breach appeared first on SecurityWeek .
SoundCloud has suffered a significant cyberattack resulting in a data breach that affects approximately 20% of its user base. The breach was publicly disclosed via Reddit and reported by hackread.com, highlighting the compromise of user data. Although specific technical details and exploited vulnerabilities have not been disclosed, the incident is classified as high severity due to the scale of affected users and potential data exposure. There is no indication that known exploits are currently in the wild, and the discussion level remains minimal. European organizations and users of SoundCloud may face risks related to personal data exposure and potential follow-on phishing or credential stuffing attacks. Mitigation focuses on user awareness, enhanced monitoring, and SoundCloud implementing stronger security controls and transparent communication. Countries with high SoundCloud user penetration and strong digital music markets, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the breach scale and potential impact on confidentiality and integrity of user data, the suggested severity is high. Defenders should prioritize incident response, user notification, and proactive threat hunting to mitigate further risks.
Hypervisors, the core components of virtualization environments, have become attractive targets for ransomware attacks due to their critical role in managing multiple virtual machines. Compromising a hypervisor can enable attackers to encrypt or disrupt numerous virtual machines simultaneously, amplifying the impact of ransomware campaigns. This threat highlights the increasing trend of ransomware actors focusing on virtualization infrastructure to maximize damage and ransom demands. European organizations relying heavily on virtualized environments, especially in sectors like finance, healthcare, and government, face elevated risks. The ease of exploitation depends on the presence of vulnerabilities or misconfigurations in hypervisor platforms, often requiring some level of access or privilege escalation. Mitigation involves rigorous patch management, network segmentation, strict access controls, and continuous monitoring of virtualization layers. Countries with high adoption of virtualization technologies and critical infrastructure sectors, such as Germany, France, and the UK, are particularly at risk. Given the potential for widespread disruption and data loss, this threat is assessed as high severity. Defenders should prioritize securing hypervisor environments to prevent ransomware from leveraging this attack vector.
A large-scale cryptomining campaign is leveraging compromised AWS IAM credentials to illicitly mine cryptocurrency. Attackers gain unauthorized access to AWS accounts by exploiting stolen or leaked IAM credentials, enabling them to deploy and run crypto mining workloads in the cloud environment. This results in increased cloud resource consumption, unexpected costs, and potential degradation of legitimate services. The campaign is ongoing and has been recently reported by a trusted cybersecurity news source, highlighting its high priority. No known public exploits or patches are currently associated with this campaign. European organizations using AWS cloud services are at risk, especially those with inadequate IAM credential management and monitoring. Attackers do not require user interaction once credentials are compromised, making the threat easier to exploit. Mitigation requires stringent IAM credential hygiene, continuous monitoring for anomalous cloud activity, and rapid incident response to unauthorized resource usage. Countries with significant AWS adoption and critical cloud infrastructure are more likely to be targeted. The threat severity is assessed as high due to the potential financial impact, ease of exploitation, and broad scope of affected systems.
The state of Texas has initiated legal action against certain television manufacturers accused of covertly capturing screenshots of users' viewing content without consent. This practice raises significant privacy and data protection concerns, as it involves unauthorized surveillance and potential sale of personal viewing data. Although no specific technical vulnerabilities or exploits have been disclosed, the incident highlights risks related to unauthorized data collection embedded within consumer electronics. European organizations and consumers could face similar privacy infringements if such practices are widespread or if devices with similar capabilities are marketed in Europe. The threat primarily impacts confidentiality and user privacy rather than direct system integrity or availability. Mitigation involves strict regulatory enforcement, consumer awareness, and scrutiny of device firmware and software for unauthorized data collection. Countries with high smart TV adoption and strong privacy regulations, such as Germany, France, and the UK, are particularly relevant in this context. Given the covert nature of the data collection and the potential for widespread privacy violations without user consent, the suggested severity is high. Defenders should focus on privacy audits, vendor transparency, and legal compliance to mitigate risks.
Amazon Threat Intelligence has reported that Russian GRU-affiliated hackers are shifting their tactics from exploiting software vulnerabilities to targeting misconfigured devices. This change indicates a preference for leveraging security weaknesses caused by improper configurations rather than relying on zero-day or known software flaws. Such misconfigurations can include exposed management interfaces, default credentials, or improperly secured network services. The threat is assessed as medium severity due to the moderate impact and the relative ease of exploitation without requiring sophisticated zero-day vulnerabilities. European organizations, especially those with extensive networked infrastructure and IoT deployments, may be at increased risk if devices are not properly secured. Countries with significant critical infrastructure and technology sectors, such as Germany, France, and the UK, could be primary targets. Mitigation requires focused efforts on device configuration management, continuous monitoring, and strict access controls rather than solely patch management. This shift in attacker behavior underscores the importance of comprehensive security hygiene beyond patching software vulnerabilities. Defenders should prioritize auditing device configurations, enforcing strong authentication, and segmenting networks to reduce exposure.
new phishing scam is exploiting Telegram’s built-in Mini Apps: fraudsters are running fake giveaways to steal accounts. Here’s how to protect yourself.
