Threats affecting Italy

On February 24, 2022, a cyberattack exploited a VPN vulnerability in Viasat's KA-SAT satellite network, deploying AcidRain wiper malware. This attack disrupted satellite communications for thousands of users in Ukraine and disabled 5,800 wind turbines in Germany. The malware shares similarities with the VPNFilter malware family and targeted management systems to cause widespread operational disruption. Although impactful, the attack was less severe than other infrastructure attacks on Ukraine during the same period. The incident underscores the vulnerabilities in satellite network security and the critical need for robust defenses against sophisticated cyber threats targeting critical infrastructure. No known exploits are currently active in the wild, and the attack required access through a VPN vulnerability. European organizations relying on satellite communications and renewable energy infrastructure are particularly at risk. Mitigation requires patching VPN vulnerabilities, enhancing network segmentation, and monitoring for indicators of compromise related to AcidRain. Germany is notably affected due to the impact on its wind turbines, and other European countries with similar infrastructure and satellite dependencies should remain vigilant.

Malware#ukraine#wiperGermany+5

Scammers are exploiting WhatsApp's screen sharing feature to trick users into revealing one-time passwords (OTPs) and stealing funds. Attackers initiate screen sharing sessions under false pretenses, gaining real-time visibility into sensitive information such as OTPs used for two-factor authentication. This social engineering tactic bypasses technical controls by manipulating user trust and interaction. The threat primarily targets individuals but can have broader implications for organizations relying on WhatsApp for communication or authentication. No direct software vulnerability is exploited; rather, the attack leverages user behavior and the screen sharing capability. The ease of exploitation is moderate, requiring user interaction and deception. European organizations with employees or clients using WhatsApp are at risk, especially in countries with high WhatsApp penetration. Mitigation involves user education, strict policies on screen sharing, and alternative secure authentication methods. The threat is assessed as medium severity due to its impact on confidentiality and potential financial loss, despite requiring user cooperation.

News#infosecnews#redditGermany+7

Operation Endgame successfully dismantled three major malware threats: the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. Authorities seized 1025 servers linked to these operations and arrested one individual involved. These malware families were used for stealing sensitive information and controlling botnets for malicious activities. Although no active exploits are currently reported, the takedown disrupts ongoing cybercriminal campaigns. European organizations could have been targets due to the global reach of these malware strains. The medium severity reflects the moderate impact and complexity of these threats. Defenders should focus on monitoring for remnants of these malware, improving endpoint detection, and collaborating with law enforcement. Countries with high internet infrastructure and financial sectors are more likely to have been affected. The operation highlights the importance of international cooperation in combating cybercrime. Vigilance is still required as threat actors may attempt to rebuild or pivot to new malware.

Malware#infosecnews#redditGermany+6

Law enforcement recently dismantled a cybercriminal operation involving Rhadamanthys, VenomRAT, and Elysium malware, resulting in over 1,000 servers being taken down. An individual linked to VenomRAT's operation was arrested in Greece, highlighting the transnational nature of this threat. VenomRAT is a remote access trojan (RAT) known for enabling attackers to execute remote code, steal data, and maintain persistent access. The takedown disrupts ongoing malicious activities but also underscores the prior widespread compromise of servers. European organizations, especially those with exposed servers or weak endpoint defenses, remain at risk from similar RAT-based campaigns. Mitigation requires targeted detection of RAT behaviors, network segmentation, and incident response readiness. Countries with significant law enforcement cooperation and high internet infrastructure usage, such as Greece, Germany, France, and the UK, are most likely affected or targeted. Given the medium severity rating and lack of known exploits in the wild, the threat is serious but currently contained. Defenders should remain vigilant for RAT indicators and maintain robust security hygiene to prevent future infections.

Malware#rceGreece+6

Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .

AnalysisGermanyFrance+9

A large-scale spam campaign involving tens of thousands of malicious NPM packages has been identified, distributing a self-replicating worm. The campaign appears to be orchestrated by an Indonesian threat actor, inferred from code comments and the random naming of packages. These malicious packages propagate by infecting other packages or systems, potentially compromising software supply chains. Although no known exploits in the wild have been reported yet, the widespread nature of the packages poses a significant risk. The threat primarily targets the JavaScript ecosystem, specifically developers and organizations relying on NPM packages. European organizations using NPM packages in their development workflows could face supply chain contamination, leading to data breaches, system compromise, or further malware propagation. Mitigation requires proactive package vetting, dependency auditing, and restricting automated package installations. Countries with strong software development sectors and high NPM usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium severity and the potential for widespread impact without requiring user interaction, the threat should be taken seriously and addressed promptly.

MalwareGermanyFrance+5

The UK National Health Service (NHS) is investigating claims of a hack involving Oracle E-Business Suite (EBS), with hackers naming over 40 alleged victims. The incident is under scrutiny by the NHS and the UK National Cyber Security Centre. While specific technical details and affected versions are not disclosed, the attack reportedly targets Oracle EBS, a widely used enterprise resource planning platform. No known exploits are currently confirmed in the wild, and the severity is assessed as medium. This situation highlights potential risks to sensitive healthcare and administrative data managed through Oracle EBS systems. European organizations using Oracle EBS, especially in healthcare and critical infrastructure sectors, should be vigilant. Immediate mitigation steps include enhanced monitoring, access control reviews, and collaboration with cybersecurity authorities. The UK and other European countries with significant Oracle EBS deployments are most likely to be impacted. Given the lack of detailed exploit information, the suggested severity is medium due to potential data confidentiality and integrity risks without confirmed active exploitation.

NewsGermanyFrance+5

Synnovis, a pathology services provider, suffered a ransomware attack that disrupted operations at several London hospitals and resulted in the theft of patient information. The attack caused significant operational interruptions in healthcare delivery, impacting critical diagnostic services. Although no specific vulnerability or exploit details have been disclosed, the incident highlights the risk ransomware poses to healthcare infrastructure. There is no evidence of known exploits in the wild or available patches, and the attack appears targeted at healthcare service providers. The breach of patient data raises concerns about confidentiality and regulatory compliance under GDPR. European healthcare organizations should prioritize securing their IT environments to prevent similar disruptions. Mitigation should focus on network segmentation, robust backup strategies, incident response readiness, and enhanced monitoring for ransomware indicators. Given the critical nature of healthcare services and the sensitivity of patient data, the suggested severity of this threat is high. The United Kingdom is the most directly affected country, with potential risks extending to other European nations with similar healthcare service providers and infrastructure. Defenders must be vigilant about ransomware threats targeting healthcare and ensure comprehensive cybersecurity hygiene to mitigate impact.

MalwareGermanyFrance+6

A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.

News#infosecnews#redditGermany+9

SysLeaks for Attackers is a newly launched data leak search service aimed at penetration testers and red teamers, providing access to leaked usernames, email addresses, plaintext passwords, and platform information tied to domain names. The service requires users to register with company emails from offensive security firms and excludes leaks from the last 14 days to give affected companies a grace period. Although it is in beta with usage limits, it aggregates leaked credentials that could be exploited for credential stuffing, phishing, or lateral movement. While no direct exploits or vulnerabilities are reported, the availability of such a service increases the risk of targeted attacks using real leaked credentials. European organizations could be impacted if their domains appear in the database, especially in countries with high adoption of targeted sectors or where offensive security firms operate extensively. Mitigation should focus on enhanced credential hygiene, monitoring for leaked credentials, and restricting access to sensitive systems. Given the nature of the service and its potential to facilitate attacks, the suggested severity is medium.

Breach#netsec#redditGermany+6

When I&#x27m teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[2]. Let&#x27s have a look at the infection path.

NewsGermanyFrance+6

ThreatFox IOCs for 2025-11-13

Indicator#type:osint#tlp:whiteGermany+9

A security issue has been identified in mPDF, a widely used open-source PHP library for generating PDFs from HTML, with approximately 70 million installs. Due to quirks in its logic and the use of regex, it is possible to craft inputs that trigger unintended web requests, even when inputs are sanitized. This behavior can potentially lead to remote code execution (RCE) scenarios. Although no known exploits are currently active in the wild and no patches have been released, the threat is considered medium severity. European organizations using mPDF in web applications that process user-generated HTML content are at risk, especially those lacking additional input validation or network restrictions. Mitigations include applying strict input validation beyond mPDF’s internal sanitization, isolating PDF generation processes, and monitoring outbound web requests from servers. Countries with significant PHP development ecosystems and large web hosting industries, such as Germany, France, and the UK, are more likely to be affected. Given the potential for RCE without user interaction and the widespread use of mPDF, the suggested severity is high. Defenders should prioritize reviewing mPDF usage and implement compensating controls until an official patch is available.

News#netsec#redditGermany+5

This report discusses the manual creation of . NET serialization gadgets, which are components that can be exploited in deserialization attacks to execute arbitrary code. While no specific vulnerabilities or exploits are currently known in the wild, the technique highlights potential risks in . NET applications that use insecure deserialization. The threat is of medium severity due to the complexity of exploitation and the need for specific conditions. European organizations using . NET frameworks in their applications should be aware of this emerging technique and review their deserialization practices. Mitigations include avoiding deserialization of untrusted data, implementing strict input validation, and employing secure coding practices. Countries with significant . NET development ecosystems and critical infrastructure relying on .

News#netsec#redditGermany+8

Introduction

MalwareGermanyFrance+8

Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.

Phishing#infosecnews#redditGermany+9

NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .

NewsGermanyFrance+8

Behavioral detection allows defenders to recognize activity patterns like privilege escalation, credential theft, and lateral movement—often ahead of encryption or data exfiltration. The post How TTP-based Defenses Outperform Traditional IoC Hunting appeared first on SecurityWeek .

NewsGermanyFrance+5

Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.

News#infosecnews#redditGermany+9

North Korean threat actors have launched an Android spyware campaign leveraging popular applications such as KakaoTalk and Google Find Hub to infiltrate devices. This campaign involves the deployment of spyware targeting Android users, exploiting the trust and widespread use of these applications to facilitate espionage activities. While no specific affected versions or exploits are detailed, the campaign's medium severity suggests moderate impact potential. European organizations using Android devices and communication platforms like KakaoTalk may face confidentiality risks. The attack requires targeted delivery, likely through social engineering or malicious payloads embedded in these apps or their ecosystems. Mitigation involves enhanced monitoring of Android app behavior, restricting app permissions, and user awareness training focused on suspicious links or app requests. Countries with significant Android and KakaoTalk usage, such as Germany, France, and the UK, are more likely to be affected. Given the espionage nature and potential data exfiltration, the threat is assessed as medium severity due to moderate impact and exploitation complexity. Defenders should prioritize detection of anomalous app activity and implement strict mobile device management policies.

Campaign#infosecnews#redditGermany+5