Cybercriminals impersonating financial institutions have targeted individuals, businesses, and organizations of different sizes. The post Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI appeared first on SecurityWeek .
A cyberattack targeted OnSolve CodeRED, a critical emergency alert system, causing emergency alerts to go dark. This disruption poses a severe risk to public safety by preventing timely dissemination of urgent warnings. The attack highlights vulnerabilities in emergency communication infrastructure. No specific technical details or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild at this time. The incident underscores the importance of securing alerting platforms to maintain public trust and safety. European organizations relying on similar alerting systems could face analogous risks. Immediate mitigation and resilience planning are essential to prevent similar outages. The attack's critical severity stems from its impact on availability and potential to endanger lives. Defenders should prioritize securing emergency communication systems and establishing robust incident response protocols.
ASUS has disclosed a critical authentication bypass vulnerability affecting its AiCloud routers. This flaw allows attackers to circumvent authentication mechanisms, potentially granting unauthorized access to router management interfaces. Exploitation could lead to full control over the device, enabling attackers to manipulate network traffic, steal sensitive data, or deploy further attacks within the network. No known exploits are currently reported in the wild, but the severity and nature of the flaw demand immediate attention. European organizations using ASUS AiCloud routers are at risk, especially those in sectors relying heavily on secure network infrastructure. Mitigation requires prompt firmware updates once available, network segmentation, and enhanced monitoring of router access logs. Countries with high ASUS router market penetration and critical infrastructure reliance on such devices are more likely to be impacted. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation without authentication, and broad potential scope, this vulnerability is assessed as critical severity. Defenders should prioritize patching and implement compensating controls to reduce exposure until updates are deployed.
This report discusses concerns about Huawei and Chinese surveillance activities as highlighted by Bruce Schneier, a well-known security expert. It is a security news article rather than a direct vulnerability or exploit. The content focuses on geopolitical and supply chain risks related to Huawei's telecommunications equipment and potential surveillance implications. There are no specific technical vulnerabilities, exploits, or affected software versions detailed. The threat is medium severity due to the potential impact on confidentiality and national security, but lacks direct exploitability information. European organizations using Huawei infrastructure may face risks of unauthorized data access or espionage. Mitigation involves careful supply chain risk management, network segmentation, and enhanced monitoring of Huawei equipment. Countries with significant Huawei infrastructure deployment and geopolitical tensions with China, such as Germany, France, and the UK, are most likely affected. The threat is indirect, stemming from surveillance concerns rather than technical exploits, requiring strategic and policy-level responses.
The OnSolve CodeRED platform has been targeted by the Inc Ransom ransomware group, resulting in disruptions and a data breach. The post Ransomware Attack Disrupts Local Emergency Alert System Across US appeared first on SecurityWeek .
Fake Battlefield 6 game downloads are being distributed to spread malware and steal player data. These malicious downloads impersonate the highly anticipated game to lure victims into installing harmful software. The malware aims to compromise user confidentiality by harvesting sensitive information from infected systems. While no known exploits or vulnerabilities in Battlefield 6 itself are involved, the threat leverages social engineering and fake distribution channels. European gamers and organizations with gaming communities may be targeted, especially where Battlefield 6 has significant popularity. The threat requires user interaction to download and execute the fake installer, limiting automated spread but increasing risk through deception. Mitigation involves educating users on verifying legitimate sources, employing endpoint protection with malware detection, and monitoring network traffic for suspicious activity. Countries with large gaming populations and strong Battlefield fanbases, such as the UK, Germany, France, and the Nordics, are more likely to be affected. Given the medium severity rating and the nature of the attack, defenders should prioritize awareness and technical controls to prevent infection and data theft.
A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finger protocol, and anti-analysis checks. They utilize multiple domains for payload delivery and command and control. The group's infrastructure overlaps with previous campaigns from 2024, suggesting an evolution of tactics rather than a new actor. NetMedved's operations involve social engineering, custom obfuscation, and abuse of legitimate tools to evade detection and maintain persistence on compromised systems.
CISA has described the techniques used by attackers and pointed out that the focus is on high-value individuals. The post CISA Warns of Spyware Targeting Messaging App Users appeared first on SecurityWeek .
The Everest ransomware group has claimed a significant breach of Spain’s national airline, Iberia, reportedly stealing 596 GB of data. This incident involves ransomware activity combined with data exfiltration, indicating a double-extortion tactic where attackers encrypt systems and threaten to leak stolen data. The breach highlights vulnerabilities in critical infrastructure sectors such as aviation, which are highly sensitive and impactful. Although no specific exploited vulnerabilities or affected software versions are disclosed, the attack's scale and target underscore a high-risk scenario. European organizations, especially in Spain and neighboring countries, face increased risks from similar ransomware operations targeting critical transport and infrastructure sectors. Mitigation requires tailored incident response plans, enhanced network segmentation, and proactive threat hunting focused on ransomware behaviors. Spain is the most directly affected country, but given Iberia's international operations, other European countries with strong aviation ties may also be at risk. The threat is assessed as high severity due to the large data theft, potential operational disruption, and the critical nature of the airline sector. Defenders must prioritize monitoring for ransomware indicators, securing remote access, and ensuring robust data backup and recovery capabilities.
ToddyCat, a threat actor, has developed new hacking tools designed to steal Outlook emails and Microsoft 365 access tokens. These tools enable attackers to gain unauthorized access to sensitive email communications and cloud resources by compromising authentication tokens. The threat is considered high severity due to the potential for extensive data exposure and lateral movement within compromised environments. Although no known exploits in the wild have been reported yet, the tools represent a significant risk to organizations relying on Microsoft 365 services. European organizations using Outlook and Microsoft 365 are particularly at risk, especially those in countries with high adoption of these platforms. Mitigation requires targeted detection of token theft, enhanced monitoring of Microsoft 365 account activities, and strict access controls. Countries such as the United Kingdom, Germany, France, and the Netherlands are likely to be most affected due to their widespread use of Microsoft cloud services and strategic importance. The threat is assessed as high severity given the impact on confidentiality and integrity, ease of exploitation once initial access is gained, and the broad scope of affected systems without requiring user interaction. Defenders should prioritize monitoring for unusual token usage patterns and implement conditional access policies to reduce risk.
A recently reported security issue involves code beautifiers—tools used to format source code—accidentally exposing sensitive credentials from banks, government agencies, and technology organizations. These tools, when processing code, can inadvertently reveal secrets such as API keys, passwords, and tokens embedded in the code or configuration files. Although no known exploits are currently active in the wild, the exposure risk is high due to the sensitive nature of the leaked information. The threat primarily arises from the improper handling or display of code snippets by beautifiers, which may not sanitize or mask confidential data. European organizations using such tools in their development or code review processes could face significant confidentiality breaches. Mitigation requires careful auditing of code before formatting, implementing automated secret detection, and restricting access to formatted code outputs. Countries with large financial sectors, government digital services, and advanced tech industries are more likely to be impacted. Given the ease of exploitation and the criticality of exposed data, the threat severity is assessed as high. Defenders should prioritize securing development pipelines and educating developers about secret management best practices.
A phone phishing attack led to the compromise of a system containing information about alumni, donors, students, staff, and other individuals. The post Alumni, Student, and Staff Information Stolen From Harvard University appeared first on SecurityWeek .
This threat concerns the use of scam phone numbers employed in phishing attempts to defraud individuals. Attackers use deceptive phone numbers to trick victims into divulging sensitive information or transferring money. Although widespread and impactful on individuals, this threat does not target specific software vulnerabilities or systems. European organizations may face indirect risks through social engineering attacks on employees, potentially leading to credential compromise or financial loss. The threat is medium severity due to its social engineering nature, requiring user interaction but having broad potential impact. Mitigation involves employee training, verification procedures for unsolicited calls, and use of call-blocking technologies. Countries with high mobile phone usage and significant financial sectors, such as the UK, Germany, France, and the Netherlands, are more likely to be affected. Overall, defenders should focus on awareness, verification, and technical controls to reduce risk from scam phone number phishing attacks.
Palo Alto Networks has conducted an analysis of malicious LLMs that help threat actors with phishing, malware development, and reconnaissance. The post WormGPT 4 and KawaiiGPT: New Dark LLMs Boost Cybercrime Automation appeared first on SecurityWeek .
The 'Hide the threat - GPO lateral movement' threat involves attackers leveraging Group Policy Objects (GPOs) within Windows Active Directory environments to move laterally and evade detection. This technique allows adversaries to manipulate GPOs to execute malicious code or gain elevated privileges across networked systems. Although no known exploits are currently in the wild, the method poses a medium-level risk due to its potential to bypass traditional security controls and persist undetected. European organizations relying heavily on Active Directory for identity and access management are particularly at risk. Mitigation requires enhanced monitoring of GPO changes, strict access controls, and auditing of privileged accounts. Countries with large enterprise sectors and extensive AD deployments, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of exploitation once access is gained and the broad impact on confidentiality and integrity, this threat is assessed as medium severity. Defenders should prioritize detection capabilities around GPO modifications and implement least privilege principles to reduce exposure.
Dartmouth College suffered a data breach following a ransomware extortion attack by the Clop group. The attack involved unauthorized access to sensitive institutional data, which the threat actors likely exfiltrated before demanding ransom. Although no specific technical details about the exploitation vector or affected systems were disclosed, the incident highlights the ongoing threat posed by Clop ransomware campaigns targeting educational institutions. The breach underscores the risk of data exposure and operational disruption in higher education environments. European organizations with similar profiles should be vigilant against such ransomware threats. Mitigation requires proactive detection, network segmentation, and robust incident response planning. Countries with significant academic and research institutions, such as the UK, Germany, and France, may be more exposed due to their extensive higher education sectors. Given the high potential impact on confidentiality and availability, ease of exploitation by sophisticated ransomware groups, and the broad scope of affected systems, this threat is assessed as high severity. Defenders should prioritize monitoring for ransomware indicators and ensure comprehensive backups and recovery capabilities.
CISA has issued a warning about active spyware campaigns targeting high-value users of Signal and WhatsApp messaging platforms. These campaigns aim to hijack accounts and compromise communications through sophisticated spyware infections. The threat actors focus on individuals with sensitive or strategic communications, leveraging vulnerabilities or social engineering to deploy spyware. This poses significant risks to confidentiality and privacy, especially for organizations relying on these encrypted messaging services. European organizations using Signal and WhatsApp for secure communications are at risk of espionage and data theft. The campaigns do not currently have known exploits in the wild but are considered high priority due to their targeted nature and potential impact. Mitigation requires enhanced user awareness, strict device hygiene, and monitoring for suspicious activity. Countries with high adoption of these messaging apps and strategic geopolitical interests are most vulnerable. The severity is assessed as high given the potential for significant confidentiality breaches and the difficulty in detecting spyware infections.
SitusAMC has confirmed a data breach that compromised customer information. The breach was publicly disclosed via a Reddit InfoSec News post linking to a security news website. Although technical details are limited and no specific vulnerabilities or exploits have been identified, the incident is classified as high severity due to the exposure of sensitive customer data. There is no evidence of known exploits in the wild or patches available at this time. European organizations using SitusAMC services may face risks related to data confidentiality and regulatory compliance. Mitigation should focus on immediate incident response, customer notification, and enhanced monitoring. Countries with significant real estate and mortgage service markets, such as the UK, Germany, and France, are likely most affected. Given the breach impacts confidentiality and involves sensitive personal data, with unknown exploitation complexity but confirmed data exposure, the suggested severity is high.
More than 100 alleged victims of the Oracle EBS campaign have been added to the Cl0p ransomware website. The post Canon Says Subsidiary Impacted by Oracle EBS Hack appeared first on SecurityWeek .
