Names, Social Security numbers, ID numbers, and health information were stolen from a compromised email account. The post 146,000 Impacted by Delta Dental of Virginia Data Breach appeared first on SecurityWeek .
More than 1.6 Tb of data allegedly stolen from Cox was made public by the hackers. The post Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. […] The post 24th November – Threat Intelligence Report appeared first on Check Point Research .
CVE-2025-63434 is a high-severity vulnerability in the update mechanism of the Xtooltech Xtool AnyScan Android application (version 4.40.40 and prior). The app downloads and extracts update packages containing executable code without verifying their cryptographic integrity or authenticity. This flaw allows an attacker who can manipulate the update metadata to serve malicious packages that the app will accept and execute, resulting in arbitrary code execution. The vulnerability requires low privileges but no user interaction, making exploitation feasible in network-exposed environments. Although no known exploits are currently reported, the impact on confidentiality, integrity, and availability is severe. European organizations using this application, especially in automotive diagnostics or related fields, are at risk. Mitigation involves implementing cryptographic signature verification for update packages and restricting update metadata sources. Countries with significant automotive industries and high Android device usage, such as Germany, France, Italy, Spain, and the UK, are most likely to be affected.
CVE-2025-60916 is a reflected cross-site scripting (XSS) vulnerability found in the /overview/network/ endpoint of the Austrian Archaeological Institute's Openatlas software prior to version 8.12.0. The flaw allows attackers to inject malicious scripts via the 'charge' parameter, which are then executed in the context of a user's browser without requiring user interaction. This vulnerability has a medium severity rating with a CVSS score of 5.4, indicating limited impact on confidentiality and integrity but no impact on availability. Exploitation requires network access and low privileges but no user interaction. While no known exploits are currently reported in the wild, the vulnerability poses a risk of session hijacking, data theft, or unauthorized actions within the affected web application. European organizations using Openatlas, especially research institutions and cultural heritage entities, should prioritize patching and input validation to mitigate this threat. Countries with significant archaeological research infrastructure and Openatlas deployments, such as Austria, Germany, and Italy, are most likely to be affected.
A security analysis was conducted on over 3 million exposed databases using the Netlas platform, highlighting the widespread issue of unsecured database instances accessible on the internet. While no specific vulnerabilities or exploits were detailed, the exposure of such databases poses significant risks including data breaches and unauthorized access. The threat is categorized as medium severity due to the potential impact on confidentiality and integrity, despite the lack of active exploitation reports. European organizations using common database technologies and cloud services are at risk if their databases are misconfigured or left exposed. Mitigation requires proactive discovery of exposed assets, strict access controls, network segmentation, and continuous monitoring. Countries with high cloud adoption and digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the scale and nature of the exposure, the threat severity is assessed as medium. Defenders should prioritize identifying and securing exposed databases to prevent data leakage and unauthorized access.
Qilin ransomware is a recently identified ransomware threat investigated and reported by a trusted cybersecurity news source. Although technical details and indicators are limited, the ransomware is considered high severity due to its potential to encrypt data and disrupt operations. No known exploits in the wild have been confirmed yet, and minimal discussion exists in the InfoSec community. European organizations could face significant operational and financial impacts if targeted, especially those in critical infrastructure and industries with high ransomware exposure. Mitigation requires proactive network segmentation, robust backup strategies, and enhanced monitoring for ransomware behaviors. Countries with high digital infrastructure and ransomware incident history, such as Germany, France, the UK, Italy, and the Netherlands, are more likely to be affected. Given the lack of detailed exploitation data but the inherent destructive nature of ransomware, the threat severity is assessed as high. Defenders should prioritize early detection and incident response readiness to mitigate potential Qilin ransomware attacks.
Cox Enterprises has disclosed a data breach involving their Oracle E-Business Suite environment. The breach potentially exposed sensitive business and customer data managed within the Oracle ERP system. Although specific technical details and exploited vulnerabilities have not been publicly disclosed, the incident is classified as high severity due to the critical nature of the affected systems and the potential impact on confidentiality and business operations. No known exploits are currently reported in the wild, and the discussion around this breach remains limited. European organizations using Oracle E-Business Suite should be vigilant, as similar attacks could target their systems. Mitigation should focus on immediate forensic investigation, access control reviews, and enhanced monitoring of Oracle ERP environments. Countries with significant Oracle E-Business Suite deployments and critical infrastructure sectors relying on Oracle ERP are at higher risk. Given the sensitivity of ERP data and potential for operational disruption, the suggested severity of this breach is high.
APT31, a China-linked advanced persistent threat group, has launched stealthy cyberattacks targeting Russian IT infrastructure by leveraging cloud services. These attacks are characterized by their covert nature, aiming to infiltrate and maintain persistence within Russian organizations' networks. Although no specific vulnerabilities or exploits have been publicly detailed, the use of cloud services as an attack vector suggests sophisticated tactics to evade detection and exploit trusted platforms. The threat poses significant risks to confidentiality and integrity of targeted systems, with potential for espionage or disruption. European organizations, especially those with close ties to Russian entities or using similar cloud platforms, could face indirect risks. Mitigation requires enhanced monitoring of cloud service usage, strict access controls, and threat hunting focused on stealthy behaviors. Countries with strong economic or political connections to Russia and high cloud adoption rates are most likely to be affected. Given the stealth, high impact potential, and lack of required user interaction, this threat is assessed as high severity. Defenders should prioritize detection capabilities and inter-organizational information sharing to counter this evolving threat.
An insider at CrowdStrike was terminated following a leak of sensitive information to the hacking group known as Scattered Lapsus Hunters. The leak represents an insider threat incident rather than a direct technical vulnerability or exploit. No specific technical details or affected software versions have been disclosed. There is no evidence of active exploitation or widespread impact beyond the insider leak event. The incident highlights risks related to insider threats and data confidentiality within cybersecurity firms. European organizations relying on CrowdStrike services should be aware of potential indirect impacts on trust and data security. Mitigation should focus on strengthening insider threat detection, access controls, and monitoring. Countries with significant CrowdStrike market presence and strategic cybersecurity sectors may be more concerned. Given the insider nature and limited technical details, the severity is assessed as medium. Defenders should prioritize insider risk management and verify the integrity of their threat intelligence sources.
Matrix Push C2 is a novel phishing attack technique that leverages browser notifications to conduct fileless, cross-platform attacks. It uses the browser's native notification system to deliver phishing content, bypassing traditional detection methods that rely on file-based indicators. This method enables attackers to target multiple operating systems without deploying malicious files, increasing stealth and persistence. The attack is categorized as high severity due to its potential to compromise user credentials and deliver malicious payloads via social engineering. European organizations are at risk, especially those with high browser usage and remote workforces. Mitigation requires disabling or restricting browser notifications, enhancing user awareness, and implementing advanced detection for anomalous notification behavior. Countries with significant digital infrastructure and high browser adoption, such as Germany, France, and the UK, are most likely to be affected. The attack does not require prior authentication but exploits user interaction, making social engineering a critical factor. Overall, defenders should prioritize monitoring browser notification usage and educating users on phishing risks associated with this vector.
APT-C-26 (Lazarus) has conducted a sophisticated attack campaign deploying customized monitoring software disguised as remote IT tools. The malware includes a registration program, daemon process, and DLL, leveraging Windows Shell extensions for persistence and creating a covert remote desktop environment. It employs advanced evasion techniques such as disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data and uploads it to a remote server, enabling persistent surveillance and remote control. This campaign targets various industries globally and is attributed to the North Korean Lazarus group. The attack does not require known exploits but uses stealthy persistence and privilege escalation tactics. European organizations face risks of espionage, data leakage, and operational disruption. Mitigation requires targeted detection of the specific malware components, strict control of remote IT access, and enhanced endpoint monitoring. Countries with high adoption of Windows enterprise environments and strategic industries are most at risk, including Germany, France, the UK, and the Netherlands.
CrowdStrike has identified an insider threat where an employee or trusted individual was caught providing sensitive information to external hackers. This insider activity poses a significant risk as it bypasses many traditional perimeter defenses and can lead to unauthorized access, data breaches, or further compromise. The threat highlights the importance of monitoring internal actors and implementing robust insider threat detection mechanisms. Although no specific exploited vulnerabilities or affected software versions are mentioned, the insider nature of the threat elevates its severity. European organizations, especially those with valuable intellectual property or critical infrastructure, could be impacted by similar insider risks. Mitigation requires a combination of technical controls, behavioral monitoring, and strict access management. Countries with advanced digital economies and strong cybersecurity sectors, such as Germany, the UK, and France, may be more likely targets due to the value of their data and strategic importance. Given the high potential impact on confidentiality and integrity, ease of exploitation by a trusted insider, and broad scope of affected organizations, this threat is assessed as high severity.
The Sturnus Android malware abuses accessibility features to read chats from popular messaging apps including WhatsApp, Telegram, and Signal. It leverages accessibility permissions to bypass normal app sandboxing and extract sensitive message content without user consent. While no known exploits in the wild have been reported yet, this malware poses a significant privacy risk by targeting encrypted messaging platforms. The malware's medium severity reflects its potential to compromise confidentiality but requires accessibility permission, which may limit widespread exploitation. European organizations using Android devices with these messaging apps are at risk, especially those with employees who may unknowingly grant accessibility access. Mitigation involves restricting accessibility permissions, monitoring app permissions closely, and educating users about granting such privileges. Countries with high Android adoption and significant use of encrypted messaging apps, such as Germany, France, and the UK, are most likely to be affected. Given the malware’s ability to access sensitive communications and the ease of exploitation once permissions are granted, the suggested severity is high. Defenders should prioritize detection of suspicious accessibility service usage and enforce strict mobile device management policies.
