JPCERT has confirmed active command injection attacks targeting Array AG Gateway devices. These attacks allow remote adversaries to execute arbitrary commands on vulnerable gateways, potentially leading to full system compromise. The threat is considered high severity due to the critical role these gateways play in network security and traffic management. Although no specific affected versions or patches have been disclosed yet, organizations using Array AG Gateways should be vigilant. The attacks do not currently have known public exploits but are actively observed in the wild. European organizations relying on these gateways for secure remote access and traffic control are at risk of confidentiality, integrity, and availability breaches. Immediate mitigation involves monitoring network traffic for anomalies, restricting access to management interfaces, and applying any forthcoming vendor advisories. Countries with significant deployments of Array AG Gateways and critical infrastructure sectors are more likely to be targeted. Given the ease of exploitation via command injection and the potential for broad impact, the suggested severity is high. Defenders should prioritize detection and containment efforts to prevent lateral movement and data exfiltration.
AutoIT3[1] is a powerful language that helps to built nice applications for Windows environments, mainly to automate tasks. If it looks pretty old, the latest version was released last September and it remains popular amongst developers, for the good… or the bad! Malware written in AutoIt3 has existed since the late 2000s, when attackers realized that the language was easy to learn (close to basic) but can also compiled into standalone PE files! From a malware point of view, such executables make an extended use of packed data, making them more stealthy.
Predator spyware has introduced a new infection vector enabling zero-click attacks, which do not require any user interaction to compromise a target device. This advancement increases the stealth and effectiveness of the spyware, allowing attackers to silently infiltrate devices and exfiltrate sensitive data. Although no known exploits are currently observed in the wild, the high severity rating reflects the potential risk posed by this novel attack method. European organizations, especially those in sectors with high-value targets such as government, defense, and critical infrastructure, could face significant confidentiality and integrity risks. Mitigation requires proactive monitoring for unusual device behavior, applying security updates promptly, and employing advanced endpoint detection solutions capable of identifying zero-click attack patterns. Countries with high adoption of mobile and IoT technologies, and those with strategic geopolitical importance, are more likely to be targeted. Given the ease of exploitation without user interaction and the potential for broad impact, this threat is assessed as high severity. Defenders should prioritize awareness and readiness to detect and respond to such sophisticated spyware threats.
The Qilin ransomware group has claimed responsibility for a data theft incident targeting the Church of Scientology. This ransomware variant is associated with encrypting victim data and exfiltrating sensitive information to extort victims. Although the technical details and exploitation methods remain sparse, the attack highlights ongoing risks of ransomware combined with data theft. No confirmed exploits or vulnerabilities have been publicly disclosed yet. The threat is assessed as medium severity due to the potential confidentiality impact and extortion risk, but limited public technical details and minimal discussion reduce immediate exploitation concerns. European organizations with similar profiles or using related infrastructure should remain vigilant. Mitigation should focus on robust backup strategies, network segmentation, and monitoring for ransomware indicators. Countries with higher exposure to ransomware attacks and significant presence of targeted organizations, such as the UK, Germany, and France, are more likely to be affected. Overall, defenders must prioritize detection and response capabilities to mitigate potential ransomware and data theft incidents.
The Ministry of Communications on had asked smartphone makers to install the government’s “Sanchar Saathi” app within 90 days and to prevent users from disabling it. The post India Rolls Back Order to Preinstall Cybersecurity App on Smartphones appeared first on SecurityWeek .
Second order prompt injection attacks targeting ServiceNow's Now Assist involve malicious inputs that are initially benign but later trigger harmful behavior when processed by the AI assistant. These attacks exploit the AI's prompt handling by injecting payloads that activate in subsequent interactions, potentially leading to unauthorized command execution or data leakage. Although no known exploits are currently in the wild, the medium severity rating reflects the risk posed by this novel attack vector. European organizations using ServiceNow Now Assist should be aware of this threat due to its potential impact on confidentiality and integrity. Mitigation requires careful input validation, monitoring AI outputs for anomalous behavior, and restricting AI assistant permissions. Countries with high ServiceNow adoption and critical infrastructure reliance on ITSM platforms, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the attack complexity and lack of authentication bypass, the suggested severity is medium. Defenders should prioritize understanding AI prompt injection risks and implement layered controls to reduce exposure.
Contractors with prior hacking records are accused of deliberately wiping 96 government databases, representing a significant insider threat. This incident highlights risks from trusted personnel with elevated access who misuse their privileges to cause data destruction. The attack impacts government data availability and potentially integrity, disrupting public services and administrative functions. No specific technical details or exploited vulnerabilities have been disclosed, but the scale suggests access to critical infrastructure and sensitive systems. European government entities could face similar risks if contractors with insufficient vetting or monitoring are employed. The threat underscores the importance of strict access controls, continuous monitoring, and thorough background checks for contractors. Given the lack of detailed exploit information, the severity is assessed as high due to the direct impact on data availability and trust in government operations. Countries with large government IT infrastructures and reliance on external contractors are most at risk. Immediate mitigation should focus on limiting contractor privileges, implementing robust audit trails, and enhancing insider threat detection capabilities.
The Aisuru botnet recently launched the largest recorded DDoS attack, peaking at 29.7 Tbps, which was successfully mitigated by Cloudflare. This attack represents a significant escalation in volumetric DDoS capabilities, leveraging a large network of compromised devices to overwhelm targeted infrastructure. While no specific vulnerabilities or exploits were involved, the scale and sophistication of the botnet pose a serious threat to internet-facing services. European organizations, especially those with critical online infrastructure, could face service disruptions if targeted. Mitigation requires advanced DDoS protection services, network traffic filtering, and incident response preparedness. Countries with high internet infrastructure density and strategic digital assets, such as Germany, the UK, France, and the Netherlands, are likely to be primary targets. Given the attack's scale, ease of execution via botnet control, and potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize robust DDoS defenses and continuous monitoring to mitigate impact from similar future attacks.
SVG Clickjacking is a newly identified variant of the classic clickjacking attack that leverages Scalable Vector Graphics (SVG) elements to deceive users into interacting with hidden or disguised UI components. This technique exploits the unique properties of SVGs to craft more effective and stealthy clickjacking attacks. Although no known exploits are currently in the wild, the medium severity rating reflects the potential for significant user interaction deception without requiring authentication. European organizations that heavily rely on web applications rendering SVG content are at risk, especially those in sectors with high online user engagement. Mitigation requires specific attention to SVG handling in web applications, including strict Content Security Policies, frame busting techniques, and user interface design reviews to prevent overlay attacks. Countries with advanced digital economies and high web service usage, such as Germany, France, and the UK, are more likely to be affected due to their extensive web infrastructure and user base. Given the attack's reliance on user interaction and the absence of authentication bypass, the suggested severity is medium. Defenders should prioritize awareness and targeted mitigations to reduce the risk of this novel clickjacking method.
A medium-severity security flaw has been identified in the WebXR implementation affecting Chromium-based browsers, potentially impacting up to 4 billion users worldwide. The vulnerability relates to the WebXR API, which enables immersive virtual and augmented reality experiences in browsers. Although no known exploits are currently in the wild, the flaw could allow attackers to compromise user confidentiality or integrity if exploited. European organizations using Chromium browsers should prioritize updating their browsers to the latest versions once patches are available. The threat primarily affects countries with high Chromium browser usage and significant adoption of WebXR-enabled applications, such as Germany, France, and the UK. Mitigation involves prompt browser updates, disabling WebXR features where not needed, and monitoring for suspicious activity related to WebXR usage. Given the wide user base and potential impact on confidentiality and integrity, the suggested severity is medium. Defenders should remain vigilant and ensure timely patch management to reduce exposure.
The 25-page document outlines four principles for securely integrating AI with operational technology. The post Global Cyber Agencies Issue AI Security Guidance for Critical Infrastructure OT appeared first on SecurityWeek .
The Albiriox Android malware is a newly sold malicious software targeting banking customers and cryptocurrency holders. It primarily infects Android devices to steal sensitive financial information and potentially drain accounts. Although currently there are no known exploits in the wild and minimal public discussion, the malware’s focus on financial targets poses a medium-level threat. European organizations, especially those with employees or customers using Android devices for banking or crypto transactions, could face risks of data theft and financial loss. Mitigation requires enhanced mobile security hygiene, including restricting app installations, using mobile threat defense solutions, and monitoring for suspicious device behavior. Countries with high Android usage and significant banking and crypto sectors, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the malware’s financial targeting and potential for data compromise without requiring user interaction beyond initial infection, the suggested severity is medium. Defenders should prioritize detection and prevention on mobile endpoints to reduce exposure.
The compromised personal and financial information includes names, addresses, Social Security numbers, and card numbers. The post Marquis Data Breach Impacts Over 780,000 People appeared first on SecurityWeek .
How an attacker can find out the topic of your chats with an AI assistant without hacking your computer, and what you can do to guard against this threat
A malicious Visual Studio Code extension named 'prettier-vscode-plus' was discovered on the official VSCode Marketplace, impersonating the legitimate Prettier formatter. This extension served as the entry point for a multi-stage malware chain, starting with the Anivia loader, which decrypted and executed further payloads in memory. The final stage, OctoRAT, is a comprehensive remote access toolkit providing over 70 commands for surveillance, file theft, remote desktop control, persistence, privilege escalation, and harassment. The attack chain employs sophisticated techniques like AES encryption, process hollowing, and UAC bypass. The threat actor's GitHub repository showed active payload rotation to evade detection. This supply-chain attack highlights the evolving threats targeting developers and the abuse of trusted tools in their ecosystem.
GoldFactory is a malware campaign targeting Southeast Asia through modified banking applications, resulting in over 11,000 infections. The threat involves distributing trojanized versions of legitimate banking apps to steal credentials and potentially conduct fraudulent transactions. While primarily focused on Southeast Asia, the campaign poses risks to European organizations with ties to affected banks or users who might download compromised apps. The malware’s high infection count and use of trusted banking apps increase its potential impact. No CVSS score is available, but the threat is assessed as high severity due to its broad impact on confidentiality and financial integrity. Mitigation requires enhanced app vetting, user awareness, and network monitoring for suspicious banking app activity. European countries with significant banking and financial sectors and close economic ties to Southeast Asia are more likely to be affected. Immediate attention to app source verification and endpoint protection is critical to prevent spread and data theft.
This analysis explores the corporate structure and operations of Intellexa, a mercenary spyware vendor. It reveals new companies likely tied to Intellexa's network, particularly within a Czech cluster, and examines their roles in product shipment and potential infection vectors. The report traces Intellexa's activities across multiple countries, including new evidence of Predator spyware deployment in Iraq. It highlights the challenges in tracking such operations due to complex corporate structures and evolving techniques. The analysis also discusses broader trends in the spyware ecosystem, including geopolitical fragmentation, persistent facilitators, and expanding targeting beyond traditional victims to include corporate leaders.
