Threats affecting Poland

A torrent distribution of Leonardo DiCaprio’s movie "One Battle After Another" has been identified as a vector for the Agent Tesla malware. Agent Tesla is a well-known information stealer that targets credentials and sensitive data from infected systems. The malware is typically distributed via malicious downloads, including pirated content such as torrents. This threat poses a medium risk due to the potential for credential theft and data compromise, especially for users who download pirated media. European organizations could be impacted if employees or users inadvertently download such torrents on corporate or personal devices connected to corporate networks. Mitigation requires user education on the risks of pirated content, network monitoring for malware indicators, and endpoint protection with behavioral detection capabilities. Countries with high torrent usage and significant media consumption, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s capability to steal sensitive information and the ease of exploitation via social engineering, the suggested severity is medium. Defenders should prioritize awareness campaigns and technical controls to prevent infection and lateral movement within networks.

News#infosecnews#redditGermany+6

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

SOAPwn is a security research finding that demonstrates exploitation techniques targeting . NET Framework applications using HTTP client proxies and WSDL (Web Services Description Language). The research reveals how attackers can leverage misconfigurations or vulnerabilities in HTTP proxy handling and WSDL processing to compromise . NET applications. Although no known exploits are currently observed in the wild, the threat highlights a medium-severity risk due to potential unauthorized access or code execution. European organizations using . NET Framework applications that consume SOAP services via HTTP proxies should be aware of this threat. Mitigations include careful configuration of HTTP clients, validation of WSDL inputs, and restricting proxy usage. Countries with significant . NET enterprise deployments and critical infrastructure relying on SOAP-based services are more likely to be impacted.

Tool#netsec#redditGermany+7

North Korean threat actors have been observed deploying EtherRAT malware through exploits targeting the React2Shell vulnerability. EtherRAT is a remote access trojan capable of data exfiltration and system control. The React2Shell vulnerability allows attackers to execute arbitrary code on affected systems, facilitating malware deployment without user interaction. Although no confirmed exploits in the wild have been reported yet, the combination of a known exploit vector and a sophisticated RAT indicates a credible medium-level threat. European organizations using vulnerable software stacks could face risks to confidentiality and integrity if targeted. Mitigation requires proactive patching of React2Shell vulnerabilities and enhanced network monitoring for unusual RAT activity. Countries with high adoption of affected technologies and strategic importance in geopolitical contexts are more likely to be targeted. Given the ease of exploitation and potential impact, the threat severity is assessed as medium. Defenders should prioritize vulnerability management and incident detection to reduce exposure.

Malware#infosecnews#redditGermany+7

A Ukrainian hacker has been charged with assisting Russian hacktivist groups, highlighting ongoing cyber conflict dynamics between these nations. While no specific vulnerabilities or exploits are detailed, this development underscores the risks posed by insider threats and state-affiliated cyber activities. The incident may increase cyber espionage, sabotage, or disruption attempts targeting European organizations linked to Ukraine or Russia. European entities should be vigilant about potential retaliatory or opportunistic attacks leveraging insider knowledge. Mitigation should focus on enhancing insider threat detection, monitoring for unusual access patterns, and strengthening collaboration with law enforcement. Countries with significant geopolitical ties to Ukraine and Russia, such as Poland, Germany, and the Baltic states, are likely to be most affected. Given the lack of technical exploit details, the severity is assessed as medium due to the potential for indirect impacts on confidentiality and availability. Defenders should prioritize intelligence sharing and proactive threat hunting to mitigate emerging risks from this geopolitical cyber tension.

News#infosecnews#redditPoland+7

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

MalwareGermanyFrance+8

Victoria Dubranova faces over 25 years in prison for links to Russia-backed CARR and NoName hacktivist groups. The post US Indicts Extradited Ukrainian on Charges of Aiding Russian Hacking Groups appeared first on SecurityWeek .

Threat ActorGermanyFrance+7

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added newly discovered vulnerabilities affecting Microsoft Windows and WinRAR to its Known Exploited Vulnerabilities catalog. These flaws have been identified as actively exploited or highly likely to be exploited, prompting increased attention from security professionals. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates a significant risk to systems running these widely used software products. The vulnerabilities are currently rated as medium severity, with no confirmed exploits in the wild reported yet. European organizations using Microsoft Windows and WinRAR should be vigilant, as these products are ubiquitous across enterprises and consumers. The threat could impact confidentiality, integrity, and availability if exploited, especially in environments where these applications are critical. Mitigation requires timely patching once updates are available, enhanced monitoring for suspicious activity, and restricting WinRAR usage or applying configuration hardening. Countries with high adoption of Microsoft Windows and WinRAR, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

News#infosecnews#redditGermany+7

A Ukrainian woman has been taken into US custody for allegedly aiding the Russian-affiliated hacker groups NoName057 and CyberArmyofRussia_Reborn (CARR). These groups are known for conducting cyber operations aligned with Russian interests, often targeting Ukrainian and Western entities. While no specific vulnerabilities or exploits are detailed, the arrest highlights ongoing geopolitical cyber conflicts and the risks posed by insider assistance to threat actors. European organizations, especially those involved in critical infrastructure or geopolitical affairs related to Russia and Ukraine, may face increased cyber espionage or sabotage attempts. The threat underscores the importance of monitoring insider threats and geopolitical cyber risks. No direct technical exploit or vulnerability is described, but the operational capabilities of these groups remain a concern. Given the nature of the threat, mitigation should focus on intelligence sharing, insider threat programs, and enhanced monitoring of suspicious activities. Countries with significant geopolitical stakes in the Russia-Ukraine conflict and high exposure to Russian cyber operations are most likely to be affected. The severity is assessed as medium due to the indirect nature of the threat and lack of specific technical exploit details.

News#infosecnews#redditPoland+7

The DeadLock ransomware campaign employs a new Bring Your Own Vulnerable Driver (BYOVD) loader exploiting CVE-2024-51324, a vulnerability in Baidu Antivirus driver, to evade endpoint detection and response (EDR) tools. Attackers use PowerShell scripts to bypass User Account Control (UAC), disable Windows Defender, terminate security services, and delete volume shadow copies, facilitating ransomware deployment. DeadLock ransomware targets Windows systems with a custom stream cipher encryption using time-based cryptographic keys, employing advanced techniques such as recursive directory traversal, memory-mapped file I/O, and multi-threaded processing. Initial access is gained through compromised accounts, followed by system registry modifications, remote access establishment, reconnaissance, lateral movement, and defense impairment. Although no known exploits are currently in the wild, the sophisticated use of BYOVD and defense evasion techniques poses a significant threat to organizations. The attack complexity and multi-stage process highlight the need for targeted mitigation strategies. This threat is particularly relevant to European organizations using Baidu Antivirus or similar vulnerable drivers and those with Windows-based infrastructure. The suggested severity is high due to the potential for widespread impact, ease of defense evasion, and the ransomware’s destructive capabilities.

EPSS 0.5%Malware#deadlock#edr evasionGermany+9

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.

Campaign#domain spoofing#fileless executionGermany+9

Britain and its allies face escalating “hybrid threats … designed to weaken critical national infrastructure, undermine our interests and interfere in our democracies.” The post UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare appeared first on SecurityWeek .

NewsGermanyFrance+8

The US seeks information on the leader of Emennet Pasargad, Mohammad Bagher Shirinkar, and long-time employee Fatemeh Sedighian Kashi. The post US Posts $10 Million Bounty for Iranian Hackers appeared first on SecurityWeek .

NewsGermanyFrance+6

Ransomware groups have started using the Shanya EXE packer to obfuscate their EDR (Endpoint Detection and Response) evasion tools, complicating detection and mitigation efforts. This technique allows malware to hide components that disable or bypass security software, increasing the likelihood of successful ransomware deployment. The use of such packers enhances the stealth and persistence of ransomware attacks, posing a significant risk to organizations. European entities, especially those with critical infrastructure and high-value data, face increased exposure due to this evolving tactic. Mitigation requires advanced behavioral analysis, updated detection signatures, and strict application control policies. Countries with high ransomware activity and widespread use of targeted software are at greater risk. Given the high impact on confidentiality, integrity, and availability, combined with the ease of exploitation once initial access is gained, this threat is assessed as high severity. Defenders must prioritize monitoring for packed executables and strengthen endpoint defenses accordingly.

Malware#infosecnews#redditGermany+6

JS#SMUGGLER is a threat actor or campaign leveraging compromised legitimate websites to deliver the NetSupport Remote Access Trojan (RAT). The attack involves injecting malicious JavaScript payloads into trusted sites, which then silently deploy NetSupport RAT onto victims' systems. This RAT enables attackers to gain persistent remote access, potentially leading to data theft, espionage, or further network compromise. The threat is considered high severity due to the use of trusted sites for delivery, the capabilities of NetSupport RAT, and the stealthy infection vector. European organizations relying on web traffic from compromised sites are at risk, especially those with remote workforce or critical infrastructure. Mitigation requires proactive monitoring of web assets, enhanced endpoint detection, and network segmentation to limit RAT impact. Countries with high internet usage, significant remote workforces, and strategic industries are more likely targets. Given the ease of exploitation via compromised sites and the high impact on confidentiality and integrity, the threat is assessed as high severity. Defenders should prioritize detection of unusual RAT activity and patch any web application vulnerabilities that could lead to site compromise.

Breach#infosecnews#redditGermany+9

Polish authorities have arrested Ukrainian individuals allegedly using advanced hacking equipment. The incident highlights ongoing cyber operations involving sophisticated tools, though specific technical details about the equipment or targeted systems have not been disclosed. There is no indication of a currently active exploit or vulnerability being exploited in the wild. The news primarily reflects law enforcement action against cybercriminal activity rather than a direct technical vulnerability or threat to organizations. European organizations, especially in Poland and neighboring countries, should remain vigilant given the geopolitical context and potential for cyber espionage or sabotage. No direct patch or mitigation is available due to lack of technical specifics. The severity is assessed as high due to the involvement of advanced hacking tools and potential for significant cyber operations, but the absence of detailed exploit information limits precise risk assessment. Countries with strategic importance in Eastern Europe and those hosting critical infrastructure are more likely to be impacted. Organizations should enhance monitoring and incident response capabilities to detect related threats. This event underscores the persistent cyber threat environment influenced by regional conflicts and advanced persistent threat actors.

News#infosecnews#redditPoland+7

A new campaign leveraging JS#SMUGGLER techniques is distributing the NetSupport RAT malware through compromised websites targeting Windows users. The attack involves malicious JavaScript payloads that bypass traditional detection by smuggling code to deliver the remote access trojan. Once infected, systems can be remotely controlled by attackers, risking data confidentiality, integrity, and availability. This campaign is currently observed in the wild but with minimal discussion and no known exploits reported yet. European organizations using Windows systems and frequently accessing web resources are at risk, especially those in sectors targeted by RATs for espionage or disruption. Mitigation requires advanced web filtering, endpoint detection tuned for RAT behaviors, and user awareness to avoid suspicious sites. Countries with high Windows usage and strategic importance in cyber espionage are more likely to be affected. The threat severity is assessed as medium due to the complexity of exploitation and the potential impact on affected systems. Defenders should prioritize monitoring for unusual network activity and implement layered defenses against web-based malware delivery.

Campaign#infosecnews#redditGermany+6

The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.

Malware#netsupport rat#persistenceGermany+9

A malicious campaign is targeting indie game platforms Itch.io and Patreon by posting fake update links in comments, which lead to downloads of LummaStealer malware. This malware uses advanced anti-analysis techniques to evade detection, including checks for virtual machines, specific usernames, and malware analysis processes. The payload is delivered via a nexe-compiled JavaScript file that drops and loads a DLL variant of LummaStealer. Despite efforts to remove malicious accounts, attackers continuously create new ones, indicating an ongoing and persistent threat. The campaign primarily targets users seeking game updates, exploiting trust in indie game communities. No known exploits in the wild have been reported yet, but the malware’s stealth and persistence pose a medium-level risk. European organizations involved in gaming, digital content creation, or using these platforms could be impacted, especially those with less mature security controls. Mitigation requires targeted detection of fake update links, monitoring of platform comments, and enhanced endpoint defenses against DLL injection and obfuscated JavaScript. Countries with active indie game development and strong Patreon/Itch.

Malware#indie games#patreonGermany+6