Threats affecting Italy

Danielle Hillmer allegedly concealed the fact that her employer’s cloud platform did not meet DoD requirements. The post Former Accenture Employee Charged Over Cybersecurity Fraud appeared first on SecurityWeek .

NewsGermanyFrance+4

Eleven companies took part in the evaluations and several have boasted 100% detection and coverage rates. The post MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations appeared first on SecurityWeek .

NewsGermanyFrance+6

WIRTE is a malware campaign that uses AshenLoader sideloading techniques to deploy the AshTag espionage backdoor. This attack vector involves abusing AshenLoader, a known malware loader, to stealthily install AshTag, which is designed for espionage activities. The threat is considered high severity due to its potential for covert data exfiltration and persistence within targeted environments. Although no known exploits in the wild have been reported yet, the combination of loader sideloading and a backdoor indicates a sophisticated threat. European organizations, especially those in critical infrastructure and government sectors, could face significant risks from espionage and data breaches. Mitigation requires advanced detection of loader sideloading behaviors and thorough endpoint monitoring. Countries with high adoption of Windows environments and strategic geopolitical importance are most at risk. The threat is assessed as high severity given its espionage nature, ease of sideloading exploitation, and potential impact on confidentiality and integrity without requiring user interaction. Defenders should prioritize monitoring for AshenLoader activity and implement strict application control policies to prevent unauthorized DLL sideloading.

Malware#infosecnews#redditGermany+7

In April 2025, hackers stole personal information belonging to patrons and employees and their family members. The post Pierce County Library Data Breach Impacts 340,000 appeared first on SecurityWeek .

Breach#rceGermany+6

A large-scale phishing campaign targeted approximately 6,000 firms with 40,000 e-signature phishing emails impersonating SharePoint and DocuSign services over a two-week period. The emails aim to trick recipients into interacting with malicious links or attachments under the guise of legitimate e-signature requests. This campaign exploits the widespread use of popular collaboration and document signing platforms to increase the likelihood of successful credential theft or malware deployment. No specific software vulnerabilities are exploited, but the threat relies on social engineering and user interaction. The campaign's medium severity reflects the potential for credential compromise and subsequent unauthorized access to corporate resources. European organizations using SharePoint and DocuSign are at risk, especially those with high volumes of document workflows. Mitigation requires targeted user awareness training, enhanced email filtering, and verification procedures for e-signature requests. Countries with significant adoption of Microsoft 365 and DocuSign, such as the UK, Germany, France, and the Netherlands, are more likely to be affected. The threat does not require software vulnerabilities or exploits but depends on phishing success, making it moderately severe. Defenders should prioritize detection of phishing emails mimicking trusted e-signature services and enforce multi-factor authentication to reduce impact.

Phishing#infosecnews#redditGermany+5

Security firms have seen cryptocurrency miners, Linux backdoors, botnet malware, and various post-exploitation implants in React2Shell attacks. The post Wide Range of Malware Delivered in React2Shell Attacks appeared first on SecurityWeek .

Malware#linuxGermany+6

Ashen Lepus, a Hamas-affiliated threat group, has developed a new malware suite named AshTag targeting governmental and diplomatic entities primarily in the Middle East, with recent expansion to Oman and Morocco. The malware employs a sophisticated multi-stage infection chain using decoy PDFs and RAR archives to deliver payloads. AshTag features enhanced custom payload encryption, infrastructure obfuscation, and in-memory execution to evade detection. The group updated its command and control (C2) infrastructure to blend with legitimate traffic, complicating network defense efforts. This espionage campaign focuses on intelligence gathering from diplomatic and governmental targets. Although no known exploits are reported in the wild, the malware leverages multiple advanced techniques including process injection, persistence mechanisms, and credential harvesting. The threat poses a medium severity risk due to its targeted nature, complexity, and potential impact on confidentiality and integrity of sensitive information. European organizations with diplomatic ties or interests in the Middle East should be vigilant, especially in countries with strategic geopolitical connections to the region. Mitigation requires tailored detection of multi-stage infection vectors, enhanced network traffic analysis for C2 anomalies, and strict email attachment policies. Countries like France, Germany, and the UK are more likely to be affected due to their diplomatic presence and intelligence interests in the Middle East.

Malware#espionage#ashenorchestratorFrance+6

GOLD SALEM is a financially motivated cybercrime group deploying Warlock ransomware through sophisticated tradecraft, including exploiting SharePoint vulnerabilities for initial access. Over six months and 11 incidents, they targeted IT, industrial, and technology sectors using ransomware variants such as Warlock, LockBit, and Babuk. Their operations involve advanced techniques like zero-day exploitation and repurposing legitimate tools (Velociraptor, VMTools AV killer, Cloudflared) to evade detection and maintain persistence. Executables are often named after victim organizations, indicating targeted attacks. While evidence suggests possible Chinese origins, the group primarily pursues financial gain. The threat poses a medium severity risk but demonstrates capabilities that could escalate impact if defenses are weak. European organizations in critical infrastructure and technology sectors should be vigilant against these tactics.

Malware#lockbit#cybercrimeGermany+9

A malicious campaign has compromised 19 Visual Studio Code extensions by embedding malware within dependency folders, specifically by modifying the legitimate npm package 'path-is-absolute'. Active since February 2025, the attackers disguise malicious binaries as PNG images within archives to evade detection. When VS Code starts, a JavaScript dropper decodes and executes two malicious binaries using living-off-the-land binaries, enabling stealthy execution. This attack leverages trusted components from the VS Code Marketplace, complicating detection and mitigation. Although no known exploits in the wild have been reported, the campaign demonstrates advanced evasion techniques and targets a widely used development environment. The malware involves a Rust-based trojan and employs multiple tactics such as code obfuscation, masquerading files, and abuse of legitimate binaries. European organizations using VS Code with affected extensions are at risk of compromise, data theft, or further lateral movement. Mitigation requires careful vetting of extensions, monitoring for suspicious activity, and restricting execution of untrusted binaries. Countries with strong software development sectors and high VS Code adoption are most likely to be impacted. Given the stealth, potential for privilege escalation, and broad impact, the threat severity is assessed as high.

Malware#rust trojan#vs codeGermany+9

CastleLoader malware has evolved to incorporate a Python-based loader to evade traditional security defenses. This technique leverages Python scripts to execute malicious payloads, complicating detection by conventional antivirus and endpoint protection solutions. While no known exploits are currently active in the wild, the adaptation indicates a shift towards more sophisticated evasion tactics. European organizations using environments where Python is prevalent or where endpoint security relies heavily on signature-based detection may face increased risk. The malware's medium severity reflects moderate impact potential and exploitation complexity. Defenders should focus on enhancing detection capabilities for script-based loaders, monitoring unusual Python execution, and applying behavioral analytics. Countries with high technology adoption and significant financial or industrial sectors are more likely targets. Proactive threat hunting and endpoint hardening are critical to mitigating this emerging threat vector.

Malware#infosecnews#redditGermany+7

ThreatFox IOCs for 2025-12-11

Indicator#type:osint#tlp:whiteGermany+5

DroidLock is a newly identified Android malware that locks infected devices and demands a ransom to restore access. It operates by taking control of the device's lock screen, effectively denying user access until payment is made. Although no specific affected Android versions are listed, the malware targets mobile users broadly. There are currently no known exploits in the wild beyond initial reports, and technical details remain limited. The malware represents a high-severity threat due to its potential to disrupt device availability and extort users. European organizations with employees using Android devices for business risk operational disruption and data access issues. Mitigation requires proactive mobile device management, user education on avoiding suspicious apps, and rapid incident response capabilities. Countries with high Android adoption and significant mobile workforce presence, such as Germany, France, the UK, Italy, and Spain, are most likely to be impacted. Given the ransomware nature, ease of exploitation via social engineering or malicious apps, and significant impact on availability and confidentiality, the threat severity is assessed as high. Defenders should prioritize detection of suspicious lock screen behavior and ensure robust backup and recovery procedures for mobile endpoints.

Malware#infosecnews#redditGermany+7

A torrent distribution of Leonardo DiCaprio’s movie "One Battle After Another" has been identified as a vector for the Agent Tesla malware. Agent Tesla is a well-known information stealer that targets credentials and sensitive data from infected systems. The malware is typically distributed via malicious downloads, including pirated content such as torrents. This threat poses a medium risk due to the potential for credential theft and data compromise, especially for users who download pirated media. European organizations could be impacted if employees or users inadvertently download such torrents on corporate or personal devices connected to corporate networks. Mitigation requires user education on the risks of pirated content, network monitoring for malware indicators, and endpoint protection with behavioral detection capabilities. Countries with high torrent usage and significant media consumption, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s capability to steal sensitive information and the ease of exploitation via social engineering, the suggested severity is medium. Defenders should prioritize awareness campaigns and technical controls to prevent infection and lateral movement within networks.

News#infosecnews#redditGermany+6

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

NANOREMOTE is a newly identified Windows backdoor malware closely related to the previously known FINALDRAFT malware family. It uniquely leverages the Google Drive API for stealthy data exfiltration and payload staging, complicating detection efforts. The malware communicates with a hardcoded IP over HTTP using encrypted and compressed JSON data and supports 22 command handlers for system reconnaissance, file operations, and command execution. Its modular design includes a task management system for file transfers and incorporates open-source components. NANOREMOTE’s similarity to FINALDRAFT indicates a shared codebase and development environment, suggesting ongoing evolution of this threat. Although no known exploits are reported in the wild yet, its capabilities pose a medium risk. Detection is challenging due to its use of legitimate cloud services for malicious activity. European organizations should be vigilant, especially those with Windows environments and reliance on Google Drive services.

Malware#command execution#file exfiltrationGermany+5

This threat involves a detailed guide posted on Reddit describing how to conduct a covert red team phishing campaign, including reconnaissance and adversary-in-the-middle (AITM) session capture techniques. Although it does not provide direct exploits or malware, it offers tactical knowledge that could be leveraged by threat actors to craft sophisticated phishing attacks. The post lacks specific details on creating a Microsoft 365 proxy configuration, leaving that as an exercise for readers, which may limit immediate exploitation. No known exploits are currently in the wild based on this information. The threat is categorized as medium severity due to its potential to facilitate targeted phishing campaigns that could compromise credentials and session integrity. European organizations, especially those heavily reliant on Microsoft 365 and similar cloud services, could be at risk if threat actors apply these techniques. Mitigation requires advanced phishing detection, user training focused on AITM attack vectors, and enhanced monitoring of session anomalies. Countries with high adoption of Microsoft 365 and significant exposure to APT activity, such as the UK, Germany, France, and the Netherlands, are more likely to be targeted. The threat does not require direct software vulnerabilities or exploits but depends on social engineering and technical interception methods, making it moderately difficult to execute but impactful if successful.

Phishing#netsec#redditGermany+5

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a significant threat due to its dual mission. The attack chain involves a fake Teams website, malicious ZIP files, and binary data retrieval from XML and JSON files. The malware exploits rundll32.exe for binary proxy execution and establishes C2 communication. Attribution to Silver Fox is based on overlapping infrastructure and links to previous campaigns. Organizations with global operations, especially in China, are advised to implement robust security measures and logging capabilities to defend against this evolving threat.

Malware#false flag#valleyratChina+6

SOAPwn is a security research finding that demonstrates exploitation techniques targeting . NET Framework applications using HTTP client proxies and WSDL (Web Services Description Language). The research reveals how attackers can leverage misconfigurations or vulnerabilities in HTTP proxy handling and WSDL processing to compromise . NET applications. Although no known exploits are currently observed in the wild, the threat highlights a medium-severity risk due to potential unauthorized access or code execution. European organizations using . NET Framework applications that consume SOAP services via HTTP proxies should be aware of this threat. Mitigations include careful configuration of HTTP clients, validation of WSDL inputs, and restricting proxy usage. Countries with significant . NET enterprise deployments and critical infrastructure relying on SOAP-based services are more likely to be impacted.

Tool#netsec#redditGermany+7

North Korean threat actors have been observed deploying EtherRAT malware through exploits targeting the React2Shell vulnerability. EtherRAT is a remote access trojan capable of data exfiltration and system control. The React2Shell vulnerability allows attackers to execute arbitrary code on affected systems, facilitating malware deployment without user interaction. Although no confirmed exploits in the wild have been reported yet, the combination of a known exploit vector and a sophisticated RAT indicates a credible medium-level threat. European organizations using vulnerable software stacks could face risks to confidentiality and integrity if targeted. Mitigation requires proactive patching of React2Shell vulnerabilities and enhanced network monitoring for unusual RAT activity. Countries with high adoption of affected technologies and strategic importance in geopolitical contexts are more likely to be targeted. Given the ease of exploitation and potential impact, the threat severity is assessed as medium. Defenders should prioritize vulnerability management and incident detection to reduce exposure.

Malware#infosecnews#redditGermany+7