Threats affecting Italy

Other noteworthy stories that might have slipped under the radar: surge in Palo Alto Networks scanning, WEL Companies data breach impacts 120,000 people, AI second-order prompt injection attack. The post In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring appeared first on SecurityWeek .

BreachGermanyFrance+4

The ShinyHunters threat actor has reportedly breached Gainsight applications hosted on Salesforce, claiming to have accessed data from top 1000 firms globally. This breach involves unauthorized access to sensitive corporate data, potentially including customer and business information managed within Gainsight's customer success platform integrated with Salesforce. Although technical details are limited and no confirmed exploits are currently observed in the wild, the breach is rated high severity due to the scale and sensitivity of the data involved. European organizations using Gainsight and Salesforce for customer relationship and success management are at risk of data exposure and subsequent targeted attacks. Mitigation requires immediate review of access controls, monitoring for unusual activity within Gainsight and Salesforce environments, and enhanced incident response readiness. Countries with significant Salesforce and Gainsight market penetration, such as the UK, Germany, France, and the Netherlands, are likely most affected. The threat is assessed as high severity given the potential impact on confidentiality and integrity, ease of exploitation through compromised SaaS platforms, and the broad scope of affected enterprises. Defenders should prioritize verifying the breach impact, securing credentials, and applying any forthcoming patches or security advisories from Gainsight and Salesforce.

Breach#infosecnews#redditGermany+6

The ToddyCat APT group has developed advanced tools and techniques to covertly access corporate email data by targeting both on-premises Outlook OST files and Microsoft 365 cloud environments. Their toolkit includes PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and methods to steal OAuth tokens from Microsoft 365 processes. They leverage SMB for remote file access, dump process memory, and search for access tokens to bypass security monitoring. These tactics enable stealthy data theft of sensitive email content and credentials. Detection guidance is available for each technique to help defenders identify and mitigate these intrusions. The threat is assessed as medium severity due to the complexity and targeted nature of the attacks, with no known exploits in the wild yet. European organizations using Microsoft 365 and Outlook are at risk, especially those with valuable email communications and cloud integrations.

Campaign#browser#oauthGermany+7

APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads. The post Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks appeared first on SecurityWeek .

MalwareGermanyFrance+5

From time to time, it can be instructive to look at generic phishing messages that are delivered to one&#x27s inbox or that are caught by basic spam filters. Although one usually doesn&#x27t find much of interest, sometimes these little excursions into what should be a run-of-the-mill collection of basic, commonly used phishing techniques can lead one to find something new and unusual. This was the case with one of the messages delivered to our handler inbox yesterday…

PhishingGermanyFrance+6

Since November 19, 2025, a suspicious PDF editor named 'ConvertMate' has been identified as a malicious vector infiltrating environments. Although it appears as a legitimate PDF converter, it performs unauthorized external connections, host queries, and creates artifacts indicative of compromise. It executes a PowerShell script that installs a scheduled task to repeat its malicious behavior every 24 hours. This activity closely resembles the earlier 'PDFEditor' campaign, with both files signed by the same entity, suggesting a coordinated threat actor. Immediate isolation and removal of 'ConvertMate' and related artifacts are critical. End-user training to recognize suspicious files and ads is also recommended. The threat does not require user interaction beyond initial download and installation, and no known exploits are publicly reported yet. The medium severity reflects its persistence and stealth but limited current exploitation scope.

Malware#scheduled tasks#malicious vectorGermany+5

The emergence of agentic AI-driven cyber campaigns marks a significant evolution in the cyber threat landscape, enabling autonomous execution of routine malicious activities via APIs. This AI orchestration lowers barriers for less skilled threat actors by automating complex tasks, increasing the scale and speed of attacks. While AI enhances attacker capabilities, it still requires skilled human oversight. European organizations face increased risks as AI-driven campaigns can target diverse systems and exploit vulnerabilities more efficiently. Defensive teams can counteract by developing their own AI agentic systems for vulnerability detection and deploying honeypots to trap malicious AI. The threat is medium severity but represents a paradigm shift requiring adaptive defense strategies. No known exploits are currently in the wild, but the potential for rapid evolution and automation of attacks is high. Organizations must proactively integrate AI-aware defenses and monitor for AI-driven attack indicators. This threat is likely to impact countries with high digital infrastructure and AI adoption, especially those with critical industries and government targets.

Campaign#threat landscape#force enablerGermany+8

Four individuals have been indicted for allegedly conspiring to smuggle supercomputers and Nvidia chips to China, violating export controls. This case highlights the risks associated with unauthorized transfer of advanced computing technology that could be used for military or intelligence purposes. While not a direct cyberattack or vulnerability, the smuggling of such hardware can enable adversaries to enhance their cyber capabilities or develop advanced AI and cryptographic systems. European organizations involved in high-performance computing, semiconductor manufacturing, or supply chain security should be aware of the geopolitical and regulatory implications. The threat underscores the importance of strict export compliance and monitoring of hardware shipments. Countries with significant semiconductor industries or advanced research institutions are particularly sensitive to such activities. Mitigation involves enhanced supply chain audits, collaboration with customs and law enforcement, and rigorous internal controls on hardware exports. Given the indirect but strategic impact, the severity is assessed as high due to potential national security and economic consequences. European countries with strong tech sectors and export activities, such as Germany, France, and the Netherlands, are most likely to be affected. This incident serves as a reminder that cybersecurity extends beyond software vulnerabilities to include hardware and supply chain integrity.

News#infosecnews#redditGermany+4

ThreatFox IOCs for 2025-11-21

Indicator#type:osint#tlp:whiteGermany+4

Thailand’s Cyber Crime Investigation Bureau said an FBI tip that the “world-class hacker” was traveling to Thailand led to his arrest in Phuket. The post Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island appeared first on SecurityWeek .

NewsGermanyFrance+5

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

Malware#ethereum#123 stealerGermany+6

A hacker claims to have stolen 2.3TB of data from Almavia, an Italian rail group. The breach was publicly disclosed via Reddit and reported by BleepingComputer, highlighting a significant data exfiltration incident. Although technical details about the attack vector or exploited vulnerabilities are not provided, the volume of data stolen suggests a serious compromise of Almavia's systems. There is no evidence of known exploits in the wild or patches available at this time. The incident poses a high risk to confidentiality and potentially to operational integrity if critical rail infrastructure data was accessed. European organizations, especially those in Italy and neighboring countries with similar rail infrastructure providers, should be alert to potential follow-on attacks or data misuse. Mitigation should focus on immediate forensic investigation, network segmentation, enhanced monitoring, and credential audits. Given the lack of detailed technical information, the severity is assessed as high due to the scale of data loss and potential impact on critical infrastructure. Italy is the most directly affected country, with possible implications for other European nations reliant on interconnected rail systems or supply chains.

Campaign#infosecnews#redditItaly+4

Salesforce is investigating a data breach involving Gainsight, a customer success platform, which has resulted in the theft of customer data. The breach reportedly allowed unauthorized access potentially through a remote code execution (RCE) vulnerability, leading to exposure of sensitive information. Although no confirmed exploits are currently known in the wild, the incident is considered high severity due to the nature of the data involved and the trust placed in these platforms. European organizations using Salesforce and Gainsight services may face risks related to confidentiality breaches and regulatory compliance violations. Mitigation requires immediate review of third-party integrations, enhanced monitoring of access logs, and strict validation of vendor security postures. Countries with high adoption of Salesforce and cloud-based CRM solutions, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the breach involves data theft and potential RCE, the suggested severity is high. Defenders should prioritize incident response readiness, vendor communication, and data access audits to limit impact.

Breach#infosecnews#redditGermany+6

The Tsundere Botnet is a high-severity threat targeting Windows systems, expanding its reach by leveraging game-related lures and employing an innovative Ethereum blockchain-based command and control (C2) infrastructure. This botnet uses social engineering tactics centered around popular gaming to entice victims into executing malicious payloads, while its use of Ethereum for C2 communications complicates detection and takedown efforts. Although no known exploits are currently active in the wild, the botnet's architecture suggests a sophisticated and resilient threat capable of evading traditional security controls. European organizations, particularly those with significant gaming communities or Windows-based infrastructure, face risks including data theft, resource hijacking, and potential disruption of services. Mitigation requires targeted user awareness campaigns about gaming lure tactics, enhanced network monitoring for blockchain-based C2 traffic, and deployment of endpoint detection tools tuned to identify unusual behaviors associated with this botnet. Countries with large gaming markets and advanced IT sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the botnet's potential impact on confidentiality, integrity, and availability, combined with ease of exploitation through social engineering and no authentication barriers, the threat severity is assessed as high. Defenders should prioritize proactive detection and user education to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+7

The unquoted path vulnerability is a longstanding Windows flaw that can allow hidden code execution when executable paths containing spaces are not properly quoted. This misconfiguration can enable attackers to execute malicious code by placing executables in specific directories that Windows interprets incorrectly. Although decades old, this vulnerability remains relevant due to legacy software and improper system configurations. Exploitation does not require user interaction or authentication but depends on the presence of unquoted service paths. The threat is rated medium severity due to moderate impact and exploitation complexity. European organizations using Windows systems with legacy or improperly configured services are at risk, especially in countries with high Windows market penetration and critical infrastructure reliance on such systems. Mitigation requires auditing service paths, applying proper quoting, and enforcing secure software deployment practices. Countries like Germany, France, the UK, and Italy are likely most affected given their extensive Windows usage and critical infrastructure. Defenders should prioritize detection of unquoted paths and remediation to prevent potential code execution attacks.

Vulnerability#netsec#redditGermany+3

APT24, a Chinese threat actor, has conducted a three-year cyber espionage campaign using BADAUDIO, a highly obfuscated first-stage downloader. The group has evolved from broad strategic web compromises to more sophisticated tactics, including supply chain attacks and targeted phishing. They compromised a Taiwanese digital marketing firm, affecting over 1,000 domains. APT24 uses advanced techniques like control flow flattening, fingerprinting, and covert data exfiltration. The malware integrates with Cobalt Strike Beacon and employs DLL Search Order Hijacking for execution. The campaign demonstrates the actor's persistent and adaptive capabilities, highlighting the growing sophistication of Chinese cyber threats.

Campaign#badaudio#phishingGermany+7

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

Campaign#banking trojan#remote controlItaly+6

The Everest ransomware group claims to have breached Petrobras, a major Brazilian energy company, indicating a significant ransomware attack targeting critical infrastructure. Although details are limited and sourced primarily from Reddit and a news article, the incident highlights the ongoing threat ransomware poses to energy sector organizations globally. The attack could lead to data theft, operational disruption, and financial loss. European energy firms with similar profiles should be vigilant. Mitigation requires enhanced network segmentation, robust backup strategies, and proactive threat hunting. Countries with strong energy sectors and historical ransomware targeting, such as Germany, France, and the UK, are particularly at risk. Given the high potential impact on confidentiality, integrity, and availability, and the likely ease of exploitation by ransomware actors, this threat is assessed as high severity. Defenders must prioritize detection and response capabilities to mitigate potential ransomware intrusions.

Malware#infosecnews#redditGermany+7

A major TV streaming piracy service known as Photocall, which attracted approximately 26 million visits annually, has been shut down. This event represents a significant disruption to illicit content distribution channels but does not directly indicate a vulnerability or exploit affecting legitimate systems. The shutdown may reduce exposure to malware or legal risks associated with accessing pirated content. However, it does not constitute a direct cybersecurity threat to organizations. European organizations may see a marginal reduction in piracy-related risks but should remain vigilant against other piracy services. No technical exploit or vulnerability details are provided, and there is no evidence of active exploitation targeting enterprise environments. The event is primarily a law enforcement or intellectual property enforcement success rather than a direct cyber threat. Consequently, no specific mitigation beyond standard cybersecurity hygiene related to piracy avoidance is necessary. Countries with high piracy rates or large media industries might be more aware of this event, but no direct impact on critical infrastructure or enterprise systems is expected.

News#infosecnews#redditGermany+7

APT24, a known advanced persistent threat group, is shifting from traditional watering hole attacks to employing multi-vector attack strategies. This evolution involves leveraging multiple attack vectors simultaneously or sequentially to increase the likelihood of successful compromise. Although no specific vulnerabilities or exploits are detailed, the pivot indicates a more sophisticated and adaptable threat actor. European organizations, especially those in critical infrastructure and government sectors, may face increased risk due to the complexity and persistence of these attacks. The threat does not currently have known exploits in the wild, but the medium severity suggests moderate risk. Mitigation requires enhanced detection capabilities, cross-vector monitoring, and proactive threat hunting tailored to multi-vector tactics. Countries with significant digital infrastructure and geopolitical relevance in Europe, such as Germany, France, and the UK, are likely primary targets. Given the medium severity, the threat impacts confidentiality and integrity with moderate ease of exploitation and no requirement for user interaction. Defenders should focus on improving visibility across multiple attack surfaces and integrating threat intelligence feeds related to APT24 activity.

News#infosecnews#redditGermany+6