Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.
A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption function and diverse decoy behaviors. Infrastructure overlaps and Korean language comments link this activity to Kimsuky. The threat actor employs sophisticated phishing techniques and leverages QR codes to redirect victims to malicious downloads. The malware requests extensive permissions and implements keylogging, audio recording, and data exfiltration. Multiple C&C servers were identified, some hosting Naver and Kakao phishing sites.
The Urban VPN browser extension and related extensions from the same publisher have been found to covertly harvest AI chat conversations from millions of users. Hidden scripts injected into AI chat services intercept all prompts and responses, capturing conversation content, timestamps, and session metadata. This data is sent back to Urban VPN’s servers regardless of whether the VPN is active, and users cannot opt out except by uninstalling the extension. The data collection feature was silently introduced via an auto-update in July 2025, affecting over 8 million installs. Despite advertising an “AI protection” feature, the extension fails to prevent data exfiltration and merely warns users about data sharing. Users who have used these extensions with AI chat services should consider their interactions compromised and remove the extension immediately.
The e-commerce and logistics company was targeted by the RansomHouse ransomware group in October. The post 700,000 Records Compromised in Askul Ransomware Attack appeared first on SecurityWeek .
This discussion highlights a technique used by headless bots to evade detection by mimicking WebView browser behaviors, specifically by exploiting inconsistencies in Sec-Fetch headers and Client Hints. The technique allows automated tools to appear as legitimate WebView clients, complicating bot detection mechanisms that rely on these HTTP header signals. While not a vulnerability or exploit itself, this method can be leveraged by attackers to bypass security controls designed to block automation and scraping. The threat is primarily relevant to web application defenders who rely on Sec-Fetch and Client Hints for bot mitigation. There is no known exploit in the wild, and the discussion is based on a recent Reddit post linking to a blog analysis. European organizations with web-facing services that use these headers for bot detection may face increased risk of automated abuse. Mitigation requires enhancing detection beyond header inspection, including behavioral analysis and fingerprinting. Countries with large digital economies and advanced web services are more likely to be impacted. The severity is assessed as medium due to the indirect nature of the threat and the requirement for sophisticated bot implementation.
A high-severity authentication bypass vulnerability affecting Fortinet FortiGate devices using SAML SSO has been reported and is under active attack. The flaw allows attackers to bypass SAML-based authentication, potentially gaining unauthorized access without valid credentials. Although no CVE or patch information is currently available, the threat is considered high priority due to the critical role FortiGate devices play in network security. European organizations relying on FortiGate for perimeter defense and VPN access are at risk of compromise, data breaches, and network infiltration. Mitigation requires immediate review of SAML configurations, monitoring for suspicious authentication attempts, and applying any forthcoming vendor advisories. Countries with high Fortinet market penetration and strategic infrastructure are most vulnerable. The ease of exploitation and impact on confidentiality and integrity justify a high severity rating. Defenders must prioritize detection and containment while awaiting official patches.
European authorities have dismantled a call center fraud ring operating in Ukraine that targeted European victims. This criminal operation used call centers to conduct fraudulent activities, likely involving social engineering and financial scams. While no specific technical vulnerabilities or exploits are detailed, the disruption of this organized crime group highlights ongoing risks from call center fraud schemes. The threat primarily impacts European organizations and individuals susceptible to social engineering attacks. The operation's takedown reduces immediate risk but underscores the need for vigilance against similar fraud tactics. Ukrainian-based fraud rings have historically targeted European countries due to geographic proximity and language capabilities. The threat does not involve software vulnerabilities but represents a significant social engineering and financial fraud risk. European entities should enhance awareness and detection of call center fraud attempts. Countries with strong economic ties and large populations are more likely to be targeted.
Key Findings Introduction Check Point Research tracks a sustained, highly capable espionage cluster, which we refer to as Ink Dragon, and is referenced in other reports as CL-STA-0049, Earth Alux, or REF7707. This cluster is assessed by several vendors to be PRC-aligned. Since at least early 2023, Ink Dragon has repeatedly targeted government, telecom, and […] The post Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation appeared first on Check Point Research .
Askul, a company presumably operating in Japan, has confirmed a ransomware attack resulting in the theft of approximately 740,000 customer records. The attack involved unauthorized access and data exfiltration, typical of ransomware incidents where attackers encrypt data and demand ransom while threatening or executing data leaks. Although no specific technical details about the ransomware variant or exploitation vectors are provided, the breach's scale and data sensitivity classify this as a high-severity incident. European organizations should be aware of similar ransomware threats targeting customer data, as such attacks can disrupt operations and lead to regulatory penalties under GDPR. Mitigation should focus on robust backup strategies, network segmentation, continuous monitoring for unusual activity, and incident response preparedness. Countries with significant business ties to Japan or with large multinational corporations using similar supply chains may be more exposed. Given the data theft and ransomware nature, the suggested severity is high due to the impact on confidentiality and availability, ease of exploitation by ransomware actors, and the broad scope of affected data.
Google plans to discontinue its Dark Web Monitoring tool in February 2026. This tool currently helps users and organizations detect if their credentials or sensitive data have been exposed on dark web forums and marketplaces. The shutdown means users will lose a valuable resource for early detection of data breaches involving their information. While this is not a direct vulnerability or exploit, the removal of this monitoring capability could increase risk exposure if alternative solutions are not adopted. European organizations relying on this service may face challenges in timely breach detection, potentially impacting incident response. The threat landscape remains unchanged, but the reduction in monitoring tools could indirectly elevate risk. Organizations should proactively seek replacement services and enhance internal monitoring to compensate. Countries with high digital adoption and strong regulatory requirements for data protection are likely to be most affected. Overall, this event represents a strategic shift in available cybersecurity resources rather than an active exploit or vulnerability.
The French Interior Ministry has publicly disclosed that hackers breached its email servers, potentially compromising sensitive government communications. While detailed technical information about the breach is not available, the incident highlights a significant security failure within a critical government infrastructure. No known exploits or vulnerabilities have been reported in the wild related to this breach. The attack likely targeted confidential information, risking exposure of sensitive data and undermining trust in government cybersecurity. European organizations, especially governmental bodies, should be alert to similar threats. Mitigation requires enhanced email security protocols, continuous monitoring, and incident response readiness. Given the strategic importance of France and its government institutions, this breach may have wider geopolitical implications. Countries with close ties or similar infrastructure may also be at increased risk. The severity is assessed as medium due to the breach of confidentiality and potential for further exploitation, despite limited public technical details and no evidence of widespread exploitation.
The 700Credit data breach exposed sensitive personal information of approximately 5.6 million consumers, including Social Security Numbers (SSNs). This breach represents a significant compromise of confidential consumer data, potentially enabling identity theft and fraud. The breach was reported recently and has been classified as high severity due to the nature and volume of data exposed. There are no known exploits in the wild related to this breach, but the impact remains critical given the sensitivity of the information. European organizations that handle consumer credit data or have partnerships with 700Credit or similar entities could face indirect risks from this breach. Mitigation requires enhanced monitoring for fraudulent activities, notification to affected individuals, and strengthening data protection measures. Countries with large financial sectors and high consumer credit usage in Europe are more likely to be affected. The breach severity is assessed as critical due to the exposure of SSNs, the ease of exploitation by malicious actors, and the broad scope of affected individuals. Defenders should prioritize incident response, customer communication, and review of third-party data security practices.
DDoSia, a participatory DDoS tool created by Russian hacktivists in 2022, is operated by the pro-Russian group NoName057(16). It relies on volunteers to contribute network resources for attacks, primarily targeting Ukraine, European allies, and NATO states. Censys has monitored DDoSia since mid-2025, observing an average of 6 control servers with short lifespans. The tool uses a multi-layered control infrastructure, with systems typically hosted on VPS providers. Despite law enforcement disruption in July 2025, DDoSia quickly reconstituted and resumed operations. The infrastructure is characterized by rapid changes, with most servers active for less than 24 hours. Attacks focus on government, military, transportation, public utilities, financial, and tourism sectors.
Hackers have stolen Premium member activity data from PornHub and are extorting the company. The breach involves sensitive user information related to premium subscriptions, potentially exposing user privacy and leading to reputational damage. Although no known exploits are currently active in the wild, the incident highlights risks associated with data protection in adult content platforms. European organizations, especially those handling sensitive user data, should be aware of the implications of such breaches. The threat underscores the importance of securing user databases and monitoring for extortion attempts. Mitigation requires enhanced data security measures, incident response readiness, and user privacy protections. Countries with significant adult content market penetration and strong privacy regulations may be more affected. The severity is assessed as high due to the sensitive nature of the data, potential for user harm, and extortion risk. Defenders must prioritize protecting sensitive user data and preparing for extortion scenarios.
A widely used Chrome browser extension has been discovered intercepting millions of users' AI chat data, potentially exposing sensitive conversational information. This interception could lead to privacy violations and unauthorized data collection. The threat involves a malicious or compromised extension operating within users' browsers, capturing AI chat interactions without consent. Although no known exploits in the wild have been reported yet, the scale of affected users and the sensitivity of intercepted data elevate the risk. European organizations using this extension or similar AI chat tools via browsers are at risk of data leakage and privacy breaches. Attackers could leverage intercepted data for espionage, fraud, or further attacks. Mitigation requires immediate review and removal of suspicious extensions, enhanced monitoring of browser activity, and user awareness campaigns. Countries with high Chrome browser usage and significant AI adoption, such as Germany, France, and the UK, are most likely impacted. Given the ease of exploitation and potential confidentiality impact, the threat severity is assessed as high.
Google has linked multiple Chinese hacking groups to attacks leveraging the React2Shell vulnerability, a critical security flaw affecting systems that use the React2Shell component. These attacks are part of a broader campaign targeting organizations globally, with a high severity rating due to the potential for remote code execution and system compromise. Although no known exploits are currently in the wild, the association with state-sponsored groups increases the threat's credibility and urgency. European organizations using affected systems are at risk of espionage, data theft, and operational disruption. Mitigation requires immediate patching of vulnerable components, enhanced network monitoring for suspicious activity, and restricting exposure of vulnerable services. Countries with significant technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are likely to be primary targets. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize detection and response capabilities to mitigate potential intrusions linked to this campaign.
The 700Credit data breach has exposed sensitive information of approximately 5.8 million customers associated with vehicle dealerships. This breach potentially involves personal and financial data collected during credit checks and financing processes. Although specific technical details of the breach vector are not disclosed, the scale and nature of the compromised data pose significant risks of identity theft, financial fraud, and reputational damage. European organizations connected to vehicle financing or dealerships may face indirect impacts, especially if they share data or systems with affected U. S. -based entities. Mitigation requires enhanced monitoring for fraudulent activities, strict access controls, and thorough vendor risk assessments. Countries with substantial automotive markets and financial services sectors, such as Germany, France, and the UK, are more likely to be affected due to their economic ties and data exchange with U. S.
AI can be used by extremist groups to pump out propaganda or deepfakes at scale, widening their reach and expanding their influence. The post Militant Groups Are Experimenting With AI, and the Risks Are Expected to Grow appeared first on SecurityWeek .
