RedVDS enables threat actors to set up servers that can be used for phishing, BEC attacks, account takeover, and fraud. The post RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement appeared first on SecurityWeek .
Key findings Introduction In December 2025, a previously unknown Ransomware-as-a-Service (RaaS) operation calling itself Sicarii began advertising its services across multiple underground platforms. The group’s name references the Sicarii, a 1st-century Jewish assassins group that opposed Roman rule in Judea. From its initial appearance, the Sicarii ransomware group distinguished itself through unusually explicit and persistent use of Israeli […] The post Sicarii Ransomware: Truth vs Myth appeared first on Check Point Research .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
A threat actor breached Betterment’s systems, accessed customer information, and sent scam crypto-related messages. The post Robo-Advisor Betterment Discloses Data Breach appeared first on SecurityWeek .
KRVTZ IDS alerts from January 14, 2026, report automated network reconnaissance and brute force attempts targeting Postfix mail servers. Multiple IP addresses were identified attempting SASL authentication brute forcing, with these attempts detected and blocked. One IP was also flagged for spam activity blocked via DNSBL. These activities represent the reconnaissance phase of attacks, aiming to discover valid credentials or vulnerable configurations. No specific vulnerabilities or exploits are associated, and no patches are available or needed. The threat is low severity due to the lack of successful compromises and absence of denial-of-service indicators. However, persistent brute forcing could lead to credential compromise if defenses are weak. The threat primarily affects European organizations running Postfix servers, with countries like Germany, France, and the UK most likely impacted. Effective monitoring, strong authentication policies, and dynamic IP blocking are critical to mitigating this threat.
A new Magecart network has been uncovered, targeting major payment networks including American Express, Diners Club, Discover, and Mastercard. The campaign, active since January 2022, uses web-skimming techniques to steal credit card information from online shoppers. The attackers inject malicious JavaScript code into compromised e-commerce websites, creating fake payment forms that capture and exfiltrate sensitive data. The skimmer employs sophisticated obfuscation techniques and mimics legitimate payment processes to avoid detection. Victims are unaware of the theft, as the malware allows the real transaction to proceed after capturing the data. The campaign demonstrates advanced knowledge of e-commerce platforms and continues to pose a significant threat to online retailers and consumers worldwide.
The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks. The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek .
The law firm Fried Frank seems to be informing high-profile clients about a recent data security incident. The post After Goldman, JPMorgan Discloses Law Firm Data Breach appeared first on SecurityWeek .
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
CVE-2025-59922 is a medium-severity SQL Injection vulnerability affecting multiple versions of Fortinet FortiClientEMS. It allows an authenticated attacker with at least read-only admin permissions to execute unauthorized SQL commands via crafted HTTP/HTTPS requests. Exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. No user interaction is required, but authentication with elevated privileges is necessary. There are no known exploits in the wild yet, and no patches have been linked at the time of publication. European organizations using FortiClientEMS for endpoint management are at risk, especially in countries with high Fortinet market penetration. Mitigation requires strict access control, monitoring for unusual SQL activity, and prompt application of vendor patches once available. The vulnerability’s CVSS score is 6.8, reflecting significant impact but requiring authenticated access. Countries like Germany, France, the UK, and the Netherlands are likely most affected due to their extensive use of Fortinet products and critical infrastructure reliance on endpoint security management.
This analysis examines a multi-stage Windows malware campaign called SHADOW#REACTOR. The infection chain uses obfuscated VBS, PowerShell downloaders, and text-based payloads to deliver a Remcos RAT backdoor. Key features include fragmented text staging, .NET Reactor protection, reflective loading, and MSBuild abuse as a living-off-the-land binary. The campaign leverages complex obfuscation and in-memory execution to evade detection while establishing persistent remote access. Defensive recommendations focus on script execution monitoring, LOLBin abuse detection, and enhanced PowerShell logging to counter the sophisticated evasion techniques employed.
VoidLink is an advanced malware framework designed for Linux systems, focusing on cloud and container environments. It includes custom loaders, implants, rootkits, and modular plugins for long-term access. The framework employs a flexible architecture with a Plugin API inspired by Cobalt Strike. VoidLink uses multiple security mechanisms, including runtime code encryption and adaptive behavior based on the detected environment. Developed by Chinese-affiliated developers, it demonstrates high technical expertise across multiple programming languages. The framework includes cloud-focused capabilities, credential harvesting, and various command-and-control channels. While its intended use remains unclear, VoidLink appears to be positioned for potential commercial use.
The 44-year-old individual planted remote access malware on a logistics firm’s systems, with help from employees. The post Dutch Port Hacker Sentenced to Prison appeared first on SecurityWeek .
Hackers stole complete customer information, including contact details, national identity numbers, and payment details. The post Spanish Energy Company Endesa Hacked appeared first on SecurityWeek .
According to the World Economic Forum's Global Cybersecurity Outlook 2026 report, cyber fraud has surpassed ransomware as the top concern for CEOs, while ransomware remains the primary worry for CISOs. This shift highlights evolving threat landscapes where financial deception and fraud schemes increasingly threaten organizational leadership. Although no specific vulnerability or exploit details are provided, the medium severity rating reflects the significant but indirect risk posed by cyber fraud activities. European organizations face heightened risks due to their economic stature and digital integration, necessitating tailored fraud detection and prevention strategies. Mitigation requires advanced fraud analytics, employee training focused on social engineering, and enhanced transactional monitoring beyond traditional ransomware defenses. Countries with large financial sectors and digital economies, such as the UK, Germany, France, and the Netherlands, are particularly susceptible. Given the broad impact potential and the complexity of fraud schemes, the suggested severity is medium. Defenders should prioritize adaptive fraud risk management alongside ransomware preparedness to address this emerging CEO-level concern effectively.
Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
CVE-2026-0503 is a medium-severity vulnerability in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) caused by missing authorization checks. It allows an attacker with some privileges to extract hardcoded clear-text credentials and bypass password authentication by manipulating user parameters. Successful exploitation enables unauthorized access to modify or delete change pointer information within EHS objects, potentially impacting downstream systems. The vulnerability affects multiple SAP_APPL and S4CORE versions and does not impact system availability. No known exploits are currently reported in the wild. The CVSS score is 6.4, reflecting a network attack vector with low complexity but requiring privileges and no user interaction. European organizations using affected SAP versions, especially in manufacturing, chemicals, and pharmaceuticals, should prioritize patching and access control reviews. Countries with high SAP adoption and critical industrial sectors like Germany, France, and the Netherlands are most at risk. Mitigations include applying SAP patches when available, restricting user privileges, monitoring EHS object changes, and auditing credential storage and access patterns.
