Threats affecting Netherlands

ThreatFox IOCs for 2025-12-11

Indicator#type:osint#tlp:whiteGermany+5

DroidLock is a newly identified Android malware that locks infected devices and demands a ransom to restore access. It operates by taking control of the device's lock screen, effectively denying user access until payment is made. Although no specific affected Android versions are listed, the malware targets mobile users broadly. There are currently no known exploits in the wild beyond initial reports, and technical details remain limited. The malware represents a high-severity threat due to its potential to disrupt device availability and extort users. European organizations with employees using Android devices for business risk operational disruption and data access issues. Mitigation requires proactive mobile device management, user education on avoiding suspicious apps, and rapid incident response capabilities. Countries with high Android adoption and significant mobile workforce presence, such as Germany, France, the UK, Italy, and Spain, are most likely to be impacted. Given the ransomware nature, ease of exploitation via social engineering or malicious apps, and significant impact on availability and confidentiality, the threat severity is assessed as high. Defenders should prioritize detection of suspicious lock screen behavior and ensure robust backup and recovery procedures for mobile endpoints.

Malware#infosecnews#redditGermany+7

Over 10,000 Docker Hub container images have been discovered to contain embedded credentials and authentication keys, posing a significant security risk. These leaked secrets can enable attackers to gain unauthorized access to cloud services, internal systems, or other sensitive resources. The exposure stems from developers inadvertently including sensitive information within container images pushed to public repositories. European organizations using Docker containers from public registries are at risk of compromise if they deploy or use these vulnerable images. The threat is particularly relevant to industries with heavy container adoption and cloud reliance. Mitigation requires scanning container images for secrets before deployment, enforcing strict secret management policies, and using private registries with access controls. Countries with large cloud and container ecosystems, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation and potential for significant confidentiality and integrity breaches, this threat is assessed as high severity. Defenders must prioritize secret scanning and credential rotation to reduce exposure.

News#infosecnews#redditGermany+5

A torrent distribution of Leonardo DiCaprio’s movie "One Battle After Another" has been identified as a vector for the Agent Tesla malware. Agent Tesla is a well-known information stealer that targets credentials and sensitive data from infected systems. The malware is typically distributed via malicious downloads, including pirated content such as torrents. This threat poses a medium risk due to the potential for credential theft and data compromise, especially for users who download pirated media. European organizations could be impacted if employees or users inadvertently download such torrents on corporate or personal devices connected to corporate networks. Mitigation requires user education on the risks of pirated content, network monitoring for malware indicators, and endpoint protection with behavioral detection capabilities. Countries with high torrent usage and significant media consumption, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s capability to steal sensitive information and the ease of exploitation via social engineering, the suggested severity is medium. Defenders should prioritize awareness campaigns and technical controls to prevent infection and lateral movement within networks.

News#infosecnews#redditGermany+6

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

A sophisticated adversary-in-the-middle phishing campaign targets Microsoft 365 and Okta users by exploiting single sign-on (SSO) flows. Attackers use lookalike domains and malicious JavaScript injections to steal credentials and session tokens, bypassing multi-factor authentication. Initial access is gained through phishing emails themed around compensation and benefits, sent via compromised mailboxes and Amazon SES. The phishing infrastructure is hosted on Cloudflare, enhancing resilience and evasion. This campaign specifically targets organizations relying on Okta as an identity provider for Microsoft 365, enabling session hijacking and credential theft. The threat poses a medium severity risk due to its complexity and potential impact on confidentiality and integrity. European organizations using these platforms are at risk, especially in countries with high adoption of Microsoft 365 and Okta. Mitigation requires targeted user training, domain monitoring, and enhanced detection of anomalous authentication flows. No CVSS score is available; however, the threat is assessed as high severity given the bypass of MFA and session hijacking capabilities.

Campaign#phishing#adversary-in-the-middleGermany+6

NANOREMOTE is a newly identified Windows backdoor malware closely related to the previously known FINALDRAFT malware family. It uniquely leverages the Google Drive API for stealthy data exfiltration and payload staging, complicating detection efforts. The malware communicates with a hardcoded IP over HTTP using encrypted and compressed JSON data and supports 22 command handlers for system reconnaissance, file operations, and command execution. Its modular design includes a task management system for file transfers and incorporates open-source components. NANOREMOTE’s similarity to FINALDRAFT indicates a shared codebase and development environment, suggesting ongoing evolution of this threat. Although no known exploits are reported in the wild yet, its capabilities pose a medium risk. Detection is challenging due to its use of legitimate cloud services for malicious activity. European organizations should be vigilant, especially those with Windows environments and reliance on Google Drive services.

Malware#command execution#file exfiltrationGermany+5

This threat involves a detailed guide posted on Reddit describing how to conduct a covert red team phishing campaign, including reconnaissance and adversary-in-the-middle (AITM) session capture techniques. Although it does not provide direct exploits or malware, it offers tactical knowledge that could be leveraged by threat actors to craft sophisticated phishing attacks. The post lacks specific details on creating a Microsoft 365 proxy configuration, leaving that as an exercise for readers, which may limit immediate exploitation. No known exploits are currently in the wild based on this information. The threat is categorized as medium severity due to its potential to facilitate targeted phishing campaigns that could compromise credentials and session integrity. European organizations, especially those heavily reliant on Microsoft 365 and similar cloud services, could be at risk if threat actors apply these techniques. Mitigation requires advanced phishing detection, user training focused on AITM attack vectors, and enhanced monitoring of session anomalies. Countries with high adoption of Microsoft 365 and significant exposure to APT activity, such as the UK, Germany, France, and the Netherlands, are more likely to be targeted. The threat does not require direct software vulnerabilities or exploits but depends on social engineering and technical interception methods, making it moderately difficult to execute but impactful if successful.

Phishing#netsec#redditGermany+5

CVE-2025-64822 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.23 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the browsers of users who visit the affected pages. This vulnerability requires user interaction to trigger and does not allow direct system compromise but can lead to session hijacking, data theft, or further attacks within the context of the victim's browser. The CVSS score is 5.4 (medium severity), reflecting the need for some privileges and user interaction. European organizations using AEM for web content management are at risk, especially those with public-facing portals or intranets accessible by multiple users. Mitigation involves promptly applying patches once available, implementing strict input validation and output encoding, and employing Content Security Policy (CSP) headers to limit script execution. Countries with significant Adobe Experience Manager deployments, such as Germany, France, the UK, and the Netherlands, are more likely to be affected due to their large enterprise and public sector use of AEM.

EPSS 0.3%VulnerabilityCWE-79Germany+3

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a significant threat due to its dual mission. The attack chain involves a fake Teams website, malicious ZIP files, and binary data retrieval from XML and JSON files. The malware exploits rundll32.exe for binary proxy execution and establishes C2 communication. Attribution to Silver Fox is based on overlapping infrastructure and links to previous campaigns. Organizations with global operations, especially in China, are advised to implement robust security measures and logging capabilities to defend against this evolving threat.

Malware#false flag#valleyratChina+6

SOAPwn is a security research finding that demonstrates exploitation techniques targeting . NET Framework applications using HTTP client proxies and WSDL (Web Services Description Language). The research reveals how attackers can leverage misconfigurations or vulnerabilities in HTTP proxy handling and WSDL processing to compromise . NET applications. Although no known exploits are currently observed in the wild, the threat highlights a medium-severity risk due to potential unauthorized access or code execution. European organizations using . NET Framework applications that consume SOAP services via HTTP proxies should be aware of this threat. Mitigations include careful configuration of HTTP clients, validation of WSDL inputs, and restricting proxy usage. Countries with significant . NET enterprise deployments and critical infrastructure relying on SOAP-based services are more likely to be impacted.

Tool#netsec#redditGermany+7

A new campaign involving the ClickFix malware is spreading a macOS infostealer by abusing the ChatGPT chat-sharing feature to post malicious user guides on the official ChatGPT website. This technique leverages social engineering by embedding harmful content within seemingly legitimate shared chats, potentially tricking users into downloading and executing the infostealer. Although no known exploits in the wild have been reported yet, the threat is considered high severity due to the sensitive data targeted and the innovative attack vector. European organizations using macOS devices are at risk, especially those with employees who frequently use ChatGPT and may be exposed to these malicious shared chats. The attack impacts confidentiality by stealing sensitive information and could lead to broader compromise if credentials or tokens are exfiltrated. Mitigation requires monitoring and restricting the use of chat-sharing features, educating users about the risks of downloading files from untrusted shared chats, and deploying endpoint detection solutions tailored for macOS. Countries with high macOS adoption and significant tech sector presence, such as Germany, the UK, France, and the Nordics, are more likely to be affected. Given the ease of exploitation via social engineering and the potential for significant data theft, the suggested severity is high.

News#netsec#redditGermany+7

North Korean threat actors have been observed deploying EtherRAT malware through exploits targeting the React2Shell vulnerability. EtherRAT is a remote access trojan capable of data exfiltration and system control. The React2Shell vulnerability allows attackers to execute arbitrary code on affected systems, facilitating malware deployment without user interaction. Although no confirmed exploits in the wild have been reported yet, the combination of a known exploit vector and a sophisticated RAT indicates a credible medium-level threat. European organizations using vulnerable software stacks could face risks to confidentiality and integrity if targeted. Mitigation requires proactive patching of React2Shell vulnerabilities and enhanced network monitoring for unusual RAT activity. Countries with high adoption of affected technologies and strategic importance in geopolitical contexts are more likely to be targeted. Given the ease of exploitation and potential impact, the threat severity is assessed as medium. Defenders should prioritize vulnerability management and incident detection to reduce exposure.

Malware#infosecnews#redditGermany+7

Three newly discovered encryption weaknesses affect PCIe 5.0 and later systems, potentially causing faulty data handling during data transmission over PCIe links. These vulnerabilities could lead to data corruption, leakage, or unauthorized data manipulation within high-speed interconnects critical for modern computing platforms. Although no known exploits are currently in the wild, the high-speed and widespread adoption of PCIe 5.0+ in servers, workstations, and data centers make this a significant concern. European organizations relying on advanced computing infrastructure may face risks to data integrity and confidentiality. Mitigation requires close collaboration with hardware vendors for firmware and hardware updates, as well as monitoring for vendor advisories. Countries with strong technology sectors and data center presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the potential impact on confidentiality, integrity, and availability, combined with the complexity of exploitation and lack of authentication requirements, this threat is assessed as high severity. Defenders should prioritize patching and validating PCIe implementations and consider additional encryption or integrity verification layers where possible.

News#infosecnews#redditGermany+5

The FBI has issued a warning about scams involving fake videos used to deceive victims, typically as part of phishing campaigns. These scams leverage manipulated or fabricated video content to trick users into divulging sensitive information or performing actions that compromise security. While no specific software vulnerabilities are exploited, the threat relies on social engineering and the increasing sophistication of video forgery techniques. The threat is classified as medium severity due to its potential to impact confidentiality and integrity through deception, though it does not directly affect system availability. European organizations are at risk, especially those with high exposure to phishing attacks and those in sectors targeted by fraudsters. Mitigation requires enhanced user awareness training focused on recognizing fake video content, deployment of advanced email and web filtering solutions, and verification protocols for video-based communications. Countries with large digital economies and high internet penetration, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant data compromise, the suggested severity is medium. Defenders should prioritize user education and implement multi-factor verification for sensitive transactions involving video communications.

Phishing#infosecnews#redditGermany+6

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

MalwareGermanyFrance+8

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added newly discovered vulnerabilities affecting Microsoft Windows and WinRAR to its Known Exploited Vulnerabilities catalog. These flaws have been identified as actively exploited or highly likely to be exploited, prompting increased attention from security professionals. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates a significant risk to systems running these widely used software products. The vulnerabilities are currently rated as medium severity, with no confirmed exploits in the wild reported yet. European organizations using Microsoft Windows and WinRAR should be vigilant, as these products are ubiquitous across enterprises and consumers. The threat could impact confidentiality, integrity, and availability if exploited, especially in environments where these applications are critical. Mitigation requires timely patching once updates are available, enhanced monitoring for suspicious activity, and restricting WinRAR usage or applying configuration hardening. Countries with high adoption of Microsoft Windows and WinRAR, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

News#infosecnews#redditGermany+7

A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy AMOS, a multi-stage malware that harvests credentials, escalates privileges, and establishes persistence. The attack bypasses traditional security measures by leveraging legitimate platforms and user behavior, making it particularly insidious. AMOS targets cryptocurrency wallets, browser data, and system information, exfiltrating sensitive data to attacker-controlled servers. This campaign represents a significant evolution in social engineering techniques, exploiting the growing reliance on AI assistants for technical guidance.

Malware#chatgpt#persistenceGermany+9

The DeadLock ransomware campaign employs a new Bring Your Own Vulnerable Driver (BYOVD) loader exploiting CVE-2024-51324, a vulnerability in Baidu Antivirus driver, to evade endpoint detection and response (EDR) tools. Attackers use PowerShell scripts to bypass User Account Control (UAC), disable Windows Defender, terminate security services, and delete volume shadow copies, facilitating ransomware deployment. DeadLock ransomware targets Windows systems with a custom stream cipher encryption using time-based cryptographic keys, employing advanced techniques such as recursive directory traversal, memory-mapped file I/O, and multi-threaded processing. Initial access is gained through compromised accounts, followed by system registry modifications, remote access establishment, reconnaissance, lateral movement, and defense impairment. Although no known exploits are currently in the wild, the sophisticated use of BYOVD and defense evasion techniques poses a significant threat to organizations. The attack complexity and multi-stage process highlight the need for targeted mitigation strategies. This threat is particularly relevant to European organizations using Baidu Antivirus or similar vulnerable drivers and those with Windows-based infrastructure. The suggested severity is high due to the potential for widespread impact, ease of defense evasion, and the ransomware’s destructive capabilities.

EPSS 0.5%Malware#deadlock#edr evasionGermany+9