The LSASS Dump via Windows Error Reporting is a recently discussed security concern involving the potential dumping of the Local Security Authority Subsystem Service (LSASS) process memory through Windows Error Reporting mechanisms. This technique could allow attackers to extract sensitive credentials stored in LSASS, such as plaintext passwords, hashes, or Kerberos tickets, facilitating lateral movement and privilege escalation within compromised networks. Although no known exploits are currently active in the wild, the medium severity rating reflects the risk posed by this method if weaponized. European organizations using Windows environments are at risk, especially those with high-value targets and critical infrastructure. Mitigation requires advanced monitoring of Windows Error Reporting activities, restricting access to LSASS memory, and employing credential protection technologies. Countries with significant Windows enterprise deployments and strategic importance in cybersecurity, such as Germany, France, and the UK, are more likely to be affected. Given the potential impact on confidentiality and the moderate ease of exploitation, the suggested severity is medium. Defenders should prioritize detection of anomalous error reporting behavior and enforce strict access controls on LSASS memory to reduce risk.
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Britain’s domestic intelligence agency warned that Chinese nationals were ”using LinkedIn profiles to conduct outreach at scale” on behalf of the Chinese Ministry of State Security. The post MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn appeared first on SecurityWeek .
The Inc Ransom group has taken credit for the hack, claiming to have stolen several terabytes of data. The post Pennsylvania Attorney General Confirms Data Breach After Ransomware Attack appeared first on SecurityWeek .
This report highlights potential pitfalls in email parsing implementations, specifically drawing lessons from Jakarta Mail, a widely used Java email library. While no specific vulnerabilities or exploits are currently documented, the discussion underscores risks inherent in improper handling of email primitives that could lead to security issues such as injection, spoofing, or denial of service. The threat is rated medium severity due to the subtlety of parsing errors and their potential impact on confidentiality and integrity. European organizations relying on Jakarta Mail or similar email processing libraries should review their email handling code to avoid these gotchas. Mitigations include adopting strict input validation, updating to the latest library versions, and employing defense-in-depth strategies for email processing. Countries with significant Java development ecosystems and critical infrastructure sectors, such as Germany, France, and the UK, are more likely to be affected. Given the absence of known exploits and the complexity of exploitation, the suggested severity is medium. Defenders should prioritize awareness and code audits to preemptively address these parsing issues before they can be exploited.
Microsoft Azure recently mitigated an extremely large-scale Distributed Denial of Service (DDoS) attack reaching 15.72 Tbps, orchestrated by the Aisuru botnet. This attack represents one of the largest volumetric DDoS campaigns observed to date, leveraging a vast network of compromised devices to overwhelm Azure's infrastructure. Although no specific vulnerabilities were exploited, the attack demonstrates the increasing scale and sophistication of botnet-powered DDoS threats. European organizations relying on cloud services like Azure could face indirect impacts such as service degradation or collateral damage during such attacks. Mitigation requires advanced DDoS protection, traffic filtering, and collaboration with cloud providers. Countries with high Azure adoption and critical digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the attack's scale, ease of execution via botnets, and potential for widespread disruption, the threat severity is assessed as high. Defenders should focus on enhancing network resilience, deploying multi-layered DDoS defenses, and maintaining incident response readiness.
UNC1549, an Iranian-linked threat group, has been targeting aerospace, aviation, and defense industries since mid-2024. They employ sophisticated initial access techniques, including exploiting third-party relationships and targeted phishing. The group uses custom malware like TWOSTROKE, LIGHTRAIL, and DEEPROOT for persistence, and tools like DCSYNCER.SLICK and CRASHPAD for privilege escalation. UNC1549 demonstrates advanced lateral movement, reconnaissance, and defense evasion tactics. They extensively use SSH reverse tunnels and Azure infrastructure for command and control. The group's primary objective appears to be espionage, focusing on data collection and leveraging compromised organizations to target others in the same sector.
CVE-2025-63512 is a medium-severity SQL Injection vulnerability found in the kishan0725 Hospital Management System v4, specifically in the admin-panel1.php file within the deleting doctor functionality. The vulnerability arises because the application does not properly sanitize or parameterize the 'demail' parameter before using it in a dynamic SQL query. This flaw allows unauthenticated remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access or modification. Although no known exploits are currently reported in the wild, exploitation could compromise the confidentiality and integrity of sensitive healthcare data. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. European healthcare organizations using this system are at risk, especially those with limited security controls around legacy or niche hospital management software. Mitigation involves applying secure coding practices such as prepared statements and input validation, and monitoring for suspicious database activity. Countries with significant healthcare infrastructure and adoption of such systems, including Germany, France, Italy, Spain, and the UK, are most likely to be affected. Given the potential impact on sensitive patient data and ease of exploitation, timely remediation is critical.
Microsoft recently mitigated the largest cloud-based Distributed Denial of Service (DDoS) attack ever recorded, peaking at 15.7 Tbps. This attack leveraged a massive botnet to overwhelm cloud infrastructure with traffic, aiming to disrupt service availability. Although no specific vulnerabilities or exploits were involved, the scale of the attack highlights the increasing capability of threat actors to launch volumetric DDoS attacks. European organizations relying on cloud services, especially those using Microsoft Azure, could face indirect impacts from such large-scale attacks. The mitigation demonstrates the importance of robust DDoS defenses and traffic filtering at cloud provider levels. No direct exploitation or data breach was reported, but service disruption risks remain significant. Countries with high cloud adoption and critical infrastructure dependent on cloud services are more likely to be affected. Mitigation requires advanced traffic monitoring, scalable scrubbing centers, and collaboration with cloud providers. Given the attack's scale and potential for service disruption, the severity is assessed as high despite no direct exploit or data compromise.
Princeton University has disclosed a data breach impacting its donors and alumni, exposing sensitive personal information. The breach was recently reported and is considered high priority due to the nature of the data involved. Although no specific technical details or exploited vulnerabilities have been publicly shared, the incident highlights risks to confidentiality and privacy. There is no evidence of known exploits in the wild related to this breach. European organizations connected to educational institutions or donor management systems should be aware of similar risks. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and improving incident response. Countries with strong academic ties to Princeton or significant donor communities may be more concerned. The severity is assessed as high given the potential impact on personal data confidentiality and the trust implications. Defenders should prioritize reviewing access controls, encryption practices, and communication protocols with stakeholders. This breach underscores the ongoing threat to institutions holding sensitive personal data.
A recent campaign titled 'N-able N-central: From N-days to 0-days' highlights the evolution of vulnerabilities in the N-able N-central platform, moving from known (N-day) to zero-day exploits. The threat was initially discussed on Reddit's NetSec community and linked to a Horizon3.ai blog post, indicating emerging research into this attack vector. Although no specific affected versions or exploits in the wild have been confirmed, the medium severity rating suggests a moderate risk. The campaign underscores the potential for attackers to leverage unpatched or newly discovered vulnerabilities in N-able N-central, a widely used remote monitoring and management tool. European organizations using this platform could face risks to confidentiality, integrity, and availability if exploited. Mitigation requires proactive vulnerability management, close monitoring of vendor advisories, and network segmentation to limit exposure. Countries with significant IT service provider markets and critical infrastructure relying on N-able N-central are more likely to be impacted. Given the lack of detailed technical data and confirmed exploits, the suggested severity is medium, reflecting moderate impact and exploitation complexity. Defenders should prioritize awareness and readiness to respond to emerging zero-day threats targeting this platform.
A threat actor gained initial access to a network via RDP using compromised credentials, likely obtained through an infostealer, data breach, or initial access broker. They quickly moved laterally to a domain controller, created multiple impersonation accounts with high privileges, and installed AnyDesk for persistence. Over nine days, the actor conducted extensive network reconnaissance using SoftPerfect NetScan and NetExec, mapped virtualization infrastructure, and browsed file shares. They exfiltrated sensitive data from multiple shares using temp.sh. On the final day, the actor connected to backup servers, deleted backup jobs, and deployed Lynx ransomware across multiple servers. The intrusion lasted 178 hours and leveraged compromised domain admin credentials throughout.
The Dragon Breath threat actor uses the RONINGLOADER malware to disable security tools on compromised systems and subsequently deploys the Gh0st RAT remote access trojan. This multi-stage attack allows adversaries to gain persistent, stealthy access to victim networks, enabling espionage, data theft, and further lateral movement. The threat is considered high severity due to its capability to bypass defenses and deploy a powerful RAT without requiring user interaction once initial compromise occurs. European organizations with exposed endpoints or insufficient endpoint detection and response (EDR) solutions are at risk. Mitigation requires proactive detection of RONINGLOADER activity, hardening endpoint security, and network segmentation to limit RAT deployment impact. Countries with significant use of Windows-based enterprise environments and critical infrastructure are most likely affected, including Germany, France, the UK, Italy, and the Netherlands. Given the stealth and persistence of Gh0st RAT and the disabling of security tools, the suggested severity is high. Defenders should prioritize monitoring for loader activity and RAT communications to prevent data exfiltration and maintain operational integrity.
Jaguar Land Rover experienced a significant cyberattack in September that caused major operational disruptions and financial losses estimated at £196 million. The attack's specifics remain undisclosed, but the impact highlights vulnerabilities in critical automotive manufacturing and supply chain systems. This incident underscores the increasing targeting of large industrial and automotive firms by cyber adversaries. European organizations, especially those in automotive and manufacturing sectors, face heightened risks from similar attacks that can disrupt production and cause substantial economic damage. Mitigation requires tailored cybersecurity strategies focusing on supply chain security, network segmentation, and incident response readiness. Countries with strong automotive industries, such as Germany, the UK, France, and Italy, are particularly at risk due to their strategic importance and market penetration of affected companies. Given the financial impact and operational disruption, the threat severity is assessed as high. Defenders should prioritize proactive threat hunting, enhanced monitoring, and collaboration with industry partners to mitigate such threats effectively.
The Everest ransomware group claims to have stolen data belonging to millions of Under Armour customers along with 345GB of internal company records. This incident involves a significant data breach combined with ransomware activity, where sensitive customer and corporate data have been exfiltrated. Although no CVSS score is provided, the threat is assessed as medium severity due to the impact on confidentiality and potential reputational damage. There is no indication of known exploits in the wild or specific affected software versions. European organizations, particularly those in countries with strong retail and sportswear markets, could be indirectly impacted through supply chain or customer data exposure. Mitigation should focus on enhancing data protection, monitoring for ransomware indicators, and ensuring robust incident response plans. Countries like Germany, the UK, France, Italy, and Spain are most likely to be affected due to their market size and economic ties with global retail brands. The threat does not require user interaction for data theft but likely involves some level of initial access, making it moderately difficult to exploit. Defenders should prioritize data encryption, network segmentation, and continuous monitoring to reduce risk.
The state-sponsored APT has been targeting the victims’ family members to increase pressure on their targets. The post Iranian Hackers Target Defense and Government Officials in Ongoing Campaign appeared first on SecurityWeek .
Names, addresses, email addresses, and phone numbers were compromised after an employee fell for a social engineering attack. The post DoorDash Says Personal Information Stolen in Data Breach appeared first on SecurityWeek .
