Threats affecting Netherlands

CISA has flagged a critical vulnerability in the ASUS Live Update utility following evidence of active exploitation. This flaw affects the ASUS Live Update software, which is used to deliver firmware and driver updates to ASUS devices. The vulnerability is considered critical due to its potential to allow attackers to execute arbitrary code with elevated privileges, potentially compromising system integrity and confidentiality. Although specific affected versions and technical details are not provided, the active exploitation indicates a high risk to users of ASUS hardware relying on this update mechanism. European organizations using ASUS devices are at risk, especially those in sectors with high-value targets. Mitigation requires immediate attention to update or disable the vulnerable update utility and monitor for suspicious activity. Countries with significant ASUS market penetration and strategic IT infrastructure, such as Germany, France, and the UK, are likely most affected. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation, and active exploitation evidence, the severity is assessed as critical. Defenders should prioritize patching, network segmentation, and endpoint monitoring to reduce exposure.

News#infosecnews#redditGermany+6

The Kimsuky threat actor is distributing the DocSwap Android malware through QR code phishing campaigns that impersonate legitimate delivery applications. This malware targets Android devices by tricking users into scanning malicious QR codes, leading to the installation of the malware under the guise of a delivery app. Once installed, DocSwap can potentially exfiltrate sensitive data and perform unauthorized actions on the infected device. The campaign leverages social engineering via QR codes, which are increasingly used in contactless interactions, making it a significant risk vector. European organizations, particularly those with employees or customers using Android devices and relying on delivery services, may be targeted. The threat is rated as high severity due to the malware’s capabilities and the ease of exploitation through user interaction. Mitigation requires targeted user awareness about QR code risks, deployment of mobile threat defense solutions, and strict app installation policies. Countries with high Android usage and significant logistics or delivery sectors, such as Germany, France, and the UK, are more likely to be affected. Given the lack of a CVSS score, the threat is assessed as high severity based on its impact and exploitation method.

Malware#infosecnews#redditGermany+6

France’s counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry The post France Probes ‘Foreign Interference’ After Remote Control Malware Found on Passenger Ferry appeared first on SecurityWeek .

Malware#remoteFrance+9

This threat concerns vulnerabilities in Object-Relational Mapping (ORM) frameworks that cause data leakage beyond intended query joins. The issue arises when ORM queries inadvertently expose more data than requested, potentially leaking sensitive information. Although no specific affected versions or exploits in the wild are reported, the medium severity rating indicates a notable risk. European organizations using ORM-based data access layers in their applications could face confidentiality breaches if attackers exploit these leaks. Mitigation requires careful query design, strict access controls, and thorough code reviews to prevent unintended data exposure. Countries with significant software development sectors and high ORM adoption, such as Germany, the UK, and France, are more likely to be impacted. Given the nature of the vulnerability—data leakage without authentication or active exploitation—the suggested severity is medium. Defenders should prioritize understanding ORM query behaviors and implement monitoring to detect anomalous data access patterns.

Breach#netsec#redditGermany+4

A 22-year-old individual was arrested in France following a hack targeting the French Interior Ministry's systems. While specific technical details of the breach are not disclosed, the incident highlights a successful compromise of a critical government entity. No known exploits or vulnerabilities have been publicly identified in relation to this attack. The severity is assessed as medium, reflecting potential risks to confidentiality and integrity of sensitive governmental data. European organizations, especially governmental bodies, should be vigilant about similar threats. Mitigation should focus on strengthening access controls, monitoring for anomalous activity, and incident response readiness. France is the primary affected country, with potential implications for other European nations due to interconnected governmental and security operations. Given the lack of detailed technical information, the threat's severity is rated medium based on the impact on a high-value target and the apparent unauthorized access. Defenders should prioritize securing critical infrastructure and sharing threat intelligence across European security agencies.

News#infosecnews#redditFrance+6

The XCTDH Crypto Heist Part 4 is a medium-severity cyber threat linked to North Korean actors targeting software supply chains and development tools. It involves compromising software dependencies and development environments to facilitate unauthorized access or manipulation, leveraging application layer protocols for communication or data exfiltration. Although no specific affected product versions or patches are identified, the threat highlights risks associated with supply chain attacks. European organizations relying on affected software development tools or dependencies could face risks of intellectual property theft, operational disruption, or unauthorized access. Mitigation requires enhanced supply chain security practices, including rigorous code and dependency auditing, network segmentation, and monitoring for anomalous application layer traffic. Countries with significant software development sectors and historical exposure to North Korean cyber activities, such as the UK, Germany, and France, are more likely to be impacted. Given the medium severity, the threat poses a moderate risk that demands proactive defense but does not indicate immediate critical exploitation. Defenders should prioritize supply chain security and monitor for related attack patterns to reduce exposure.

Unknown#misp-galaxy:country="north korea"#misp-galaxy:mitre-attack-pattern="compromise software dependencies and development tools - t1195.001"Germany+4

ThreatFox IOCs for 2025-12-18

Indicator#type:osint#tlp:whiteGermany+4

Recent research by ActiveFence evaluated seven major large language models (LLMs) for vulnerabilities related to hate speech, disinformation, fraud, and child safety. The study found that 44% of LLM outputs were risky, with 68% of unsafe outputs related to hate speech, indicating significant weaknesses in content moderation and abuse prevention. Fraud-related outputs were comparatively better managed, but hate speech and child safety remain critical gaps. No tested model was fully safe, highlighting systemic risks in current LLM deployments. This threat is not a traditional software vulnerability but an exploitation of AI model behavior that can propagate harmful content. European organizations using or deploying LLMs should be aware of these risks, especially in sectors sensitive to hate speech and child protection. Mitigation requires tailored content filtering, continuous red-teaming, and collaboration with specialized threat intelligence providers. Countries with high AI adoption and strict regulatory environments around hate speech and child safety are most likely to be affected. Given the broad impact on confidentiality, integrity of information, and potential societal harm, and the ease of exploitation via user prompts, this threat is assessed as high severity.

Tool#netsec#redditGermany+7

A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.

Campaign#pe injection#api tracingGermany+9

A malware campaign discovered on the NuGet package repository targets the cryptocurrency ecosystem by distributing 14 malicious packages impersonating legitimate crypto-related tools. These packages employ techniques such as homoglyphs, version bumping, and inflated download counts to appear trustworthy and evade detection. The malware aims to steal crypto funds by redirecting transactions and exfiltrating secrets, including OAuth tokens for Google Ads accounts. The campaign highlights the risks of software supply chain attacks, especially for projects relying on compromised dependencies. No known exploits in the wild have been reported yet, but the threat poses a significant risk to developers and organizations integrating these packages. The attack affects . NET developers using NuGet packages related to cryptocurrency and OAuth services. The severity is assessed as medium due to the potential confidentiality and financial impact, combined with moderate exploitation complexity. European organizations involved in blockchain development, fintech, and digital advertising are particularly at risk. Mitigation requires strict dependency vetting, use of package integrity verification, and monitoring of OAuth token usage.

Campaign#nuget#homoglyphsGermany+6

The Kimwolf botnet has compromised approximately 1.8 million Android TV devices globally, leveraging them to conduct large-scale distributed denial-of-service (DDoS) attacks. This botnet exploits vulnerabilities in Android TV platforms to gain control without requiring user interaction or authentication. The hijacked devices are then orchestrated to flood targeted networks with traffic, disrupting services and causing outages. European organizations relying on Android TV infrastructure or connected smart devices may face increased risk of service disruption and collateral damage from these attacks. The botnet's scale and use of consumer IoT devices make mitigation challenging, requiring coordinated efforts between device manufacturers, network operators, and end users. Countries with high adoption rates of Android TV and significant digital infrastructure are particularly vulnerable. Immediate mitigation involves network-level traffic filtering, device firmware updates, and enhanced monitoring for unusual traffic patterns. Given the ease of exploitation and broad impact, this threat is assessed as high severity for affected entities in Europe.

Botnet#infosecnews#redditGermany+7

Cisco has disclosed a critical zero-day vulnerability in its AsyncOS platform that is currently unpatched and reportedly exploited in the wild. The vulnerability affects Cisco AsyncOS, a proprietary operating system used in various Cisco security and email appliances. Although detailed technical specifics and affected versions are not publicly available, the zero-day nature and active exploitation elevate the risk significantly. No official patch has been released yet, and known exploits have not been fully documented, increasing the urgency for organizations to implement interim mitigations. European organizations using Cisco AsyncOS-based products, especially in sectors reliant on secure email and network security appliances, face potential risks including unauthorized access, data compromise, and service disruption. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco’s forthcoming patches promptly. Countries with high Cisco market penetration and critical infrastructure reliance on Cisco security products, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the critical severity, ease of exploitation, and potential for widespread impact without authentication, this vulnerability demands immediate attention from cybersecurity teams.

Vulnerability#infosecnews#redditGermany+3

CVE-2025-14764 is a medium-severity vulnerability in the Amazon S3 Encryption Client for Go involving the use of a broken or risky cryptographic algorithm due to missing cryptographic key commitment. This flaw allows a user with write access to an S3 bucket to introduce a new encrypted data key (EDK) that decrypts to different plaintext when the encrypted data key is stored in an instruction file rather than S3 metadata. The vulnerability does not impact confidentiality but can compromise data integrity by enabling unauthorized data manipulation. Exploitation requires network access, low privileges (write access), and no user interaction, with a CVSS score of 5.3. AWS has addressed this issue in version 4.0 or later of the S3 Encryption Client for Go. European organizations using vulnerable versions should upgrade promptly to prevent potential data integrity attacks, especially those relying on instruction file storage for encrypted data keys. Countries with significant AWS usage and cloud adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.

EPSS 0.1%VulnerabilityCWE-327Germany+3

CVE-2025-14762 is a medium-severity vulnerability in the AWS SDK for Ruby involving the use of a broken or risky cryptographic algorithm. The issue arises from missing cryptographic key commitment when encrypted data keys (EDKs) are stored in an "instruction file" rather than S3 metadata. This flaw allows a user with write access to an S3 bucket to introduce a malicious EDK that decrypts to different plaintext, potentially compromising data integrity. Exploitation requires network access, low privileges, and no user interaction, but has a high impact on integrity without affecting confidentiality or availability. AWS has addressed this vulnerability in SDK version 1.208.0 and later. European organizations using the AWS SDK for Ruby, especially those heavily reliant on S3 for encrypted data storage, should prioritize upgrading to mitigate risks. Countries with significant cloud adoption and AWS usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The vulnerability does not appear to be exploited in the wild yet, but the risk of data tampering warrants prompt remediation.

EPSS 0.2%VulnerabilityCWE-327Germany+3

A Chinese-nexus advanced persistent threat actor, UAT-9686, is actively targeting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The campaign, ongoing since late November 2025, exploits non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor called AquaShell. Additional tools observed include AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing. The attackers can execute encoded commands in the system shell and create reverse connections to attacker-controlled servers. This sophisticated attack aligns with tactics used by other Chinese APT groups, raising concerns about potential widespread impact on email security infrastructure.

Campaign#apt#backdoorGermany+7

A recently reported security threat involves hackers potentially taking control of car dashboards by exploiting vulnerabilities in the vehicle's modem. This attack vector targets the modem component that connects the car to external networks, allowing remote access to critical vehicle systems such as the dashboard interface. Although no specific affected versions or exploits in the wild have been confirmed, the threat is rated as high severity due to the potential impact on vehicle safety and driver information integrity. European organizations involved in automotive manufacturing, fleet management, and connected car services could face significant risks. Mitigation requires a combination of secure modem firmware updates, network segmentation within vehicle systems, and rigorous security testing of telematics components. Countries with strong automotive industries and high adoption of connected vehicles, such as Germany, France, and Italy, are most likely to be affected. Given the ease of remote exploitation and the critical nature of vehicle control systems, this threat is assessed as high severity. Defenders should prioritize monitoring telematics security, applying vendor patches promptly, and implementing intrusion detection for vehicle networks.

News#infosecnews#redditGermany+6

A critical zero-day vulnerability has been identified in SonicWall's SMA1000 series appliances, with active exploitation reported. This vulnerability allows attackers to potentially compromise affected devices, risking confidentiality, integrity, and availability of enterprise networks. Although no official patches or CVSS scores are currently available, the threat is considered critical due to the nature of the exploited zero-day and the strategic role of SMA1000 devices in secure remote access. European organizations using SonicWall SMA1000 appliances are at heightened risk, especially in countries with significant SonicWall market presence and critical infrastructure sectors. Immediate mitigation steps include enhanced monitoring, network segmentation, and applying any forthcoming vendor updates promptly. Given the minimal public discussion and lack of detailed technical disclosures, organizations should prioritize threat intelligence gathering and incident response readiness. The threat landscape suggests that countries like Germany, France, the UK, and the Netherlands may be most affected due to their extensive use of SonicWall products and critical infrastructure reliance on secure remote access solutions.

Vulnerability#infosecnews#redditGermany+3

A critical remote code execution (RCE) vulnerability chain was discovered in PostHog involving Server-Side Request Forgery (SSRF), a zero-day SQL escaping flaw in ClickHouse, and default PostgreSQL credentials. This chain allows attackers to escalate from SSRF to full RCE on the affected system. Although no known exploits are currently in the wild, the combination of these vulnerabilities poses a significant risk. The vulnerabilities stem from improper input validation, insecure default credentials, and SQL injection weaknesses. European organizations using PostHog for analytics or data processing could face data breaches, system compromise, and service disruption. Mitigation requires immediate credential changes, patching or configuration hardening of ClickHouse and PostgreSQL, and restricting SSRF attack vectors. Countries with higher adoption of PostHog and related database technologies, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize detection of SSRF attempts, audit default credentials, and apply security best practices to prevent exploitation.

Vulnerability#netsec#redditGermany+3

Fourteen malicious NuGet packages have been identified that steal cryptocurrency wallet information and advertising data from developers who incorporate them into their projects. These packages, distributed via the NuGet repository, pose a risk by embedding malicious code that exfiltrates sensitive data during software build or runtime. Although no known exploits in the wild have been reported yet, the presence of such packages in a widely used package manager highlights a significant supply chain risk. European organizations using . NET technologies and NuGet packages in their development pipelines are at risk of data theft and potential financial loss. Mitigation requires proactive package vetting, use of trusted sources, and enhanced monitoring of development dependencies. Countries with strong software development sectors and high adoption of Microsoft technologies, such as Germany, the UK, and France, are particularly vulnerable. Given the medium severity, the threat impacts confidentiality primarily, with moderate ease of exploitation due to the public availability of these packages. Defenders should prioritize dependency audits and implement automated scanning tools to detect malicious packages early.

News#infosecnews#redditGermany+4

I have already talked about various React2Shell exploit attempts we have observed in the last weeks. But new varieties of the exploit are popping up, and the most recent one is using this particular version of the exploit:

NewsGermanyFrance+6