For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .
Ransomware payments reached the highest level in 2023, at $1.1 billion paid in 1,512 reported incidents. The post Ransomware Payments Surpassed $4.5 Billion: US Treasury appeared first on SecurityWeek .
A side-channel tracking technique leveraging WhatsApp and Signal allows an attacker to infer a target phone's device activity state (screen on/off, offline) by sending silent probe reactions to invalid message IDs and measuring delivery receipt round-trip times. This method does not generate visible notifications or messages on the victim's device, making it stealthy. Over time, attackers can profile user behavior such as when they are home, sleeping, or mobile. The attack requires the ability to send messages to the target number, which can be mitigated by restricting unknown contacts in privacy settings. Although no direct data breach occurs, this privacy-invasive tracking poses significant risks. The threat is relevant to European users given WhatsApp and Signal's widespread adoption. No known exploits in the wild exist yet, but the proof-of-concept is publicly available.
LockBit 5.0 ransomware group's infrastructure has been exposed through a leak of servers, IP addresses, and domains. This exposure could allow defenders and law enforcement to disrupt their operations or track their activities. While no known exploits are currently in the wild leveraging this leak, the information disclosure presents a significant intelligence opportunity. European organizations, often targeted by LockBit, may benefit from enhanced detection and prevention capabilities. The leak increases the risk of retaliatory or opportunistic attacks by other threat actors attempting to exploit the exposed infrastructure. Immediate mitigation involves monitoring for related indicators and collaborating with cybersecurity communities to leverage the leaked data. Countries with high ransomware victimization rates and significant LockBit activity, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity due to the potential operational impact on ransomware campaigns and the broad scope of affected entities. Defenders should prioritize intelligence sharing and proactive network defense measures to mitigate risks stemming from this exposure.
CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.
This report highlights a connection between Russia’s largest private university and a $25 million essay mill operation. While not a direct cybersecurity vulnerability or exploit, the linkage raises concerns about academic integrity, potential fraud, and reputational risks. The threat involves misuse of educational credentials and possible facilitation of fraudulent academic achievements. There is no indication of technical exploitation, malware, or direct cyberattacks. European organizations are indirectly affected through potential impacts on academic collaboration, credential verification, and trust in educational partnerships. Mitigation focuses on enhanced due diligence, verification of academic credentials, and awareness of fraudulent academic services. Countries with strong academic ties to Russia or significant Russian-speaking populations may be more exposed to related risks. Given the nature of the threat, the severity is assessed as medium due to reputational and operational risks rather than direct technical compromise.
The FBI has issued a warning about virtual kidnapping scams that leverage altered social media photos to extort victims. Attackers manipulate images to create convincing fake scenarios, claiming to have kidnapped a loved one and demanding ransom payments. These scams rely heavily on social engineering and psychological pressure rather than technical exploits. European organizations and individuals could be targeted due to widespread social media use and the potential for financial extortion. The threat does not involve direct system compromise but poses significant risks to personal security and financial integrity. Mitigation requires public awareness campaigns, verification protocols for ransom claims, and cooperation with law enforcement. Countries with high social media penetration and significant expatriate or immigrant populations may be more vulnerable. Given the ease of exploitation and high impact on victims, the threat severity is assessed as high. Defenders should focus on education, incident response readiness, and monitoring for related fraud attempts.
The Intellexa leaks have exposed zero-day vulnerabilities and an innovative attack vector using advertisements to deliver Predator spyware. This spyware is highly sophisticated, leveraging undisclosed vulnerabilities to infiltrate target systems without detection. The attack vector involves malicious ads that, when interacted with or simply viewed, can trigger the exploitation of zero-day flaws to install spyware. Although no known exploits are currently active in the wild, the potential for targeted espionage and surveillance is significant. European organizations, especially those in sensitive sectors, face elevated risks due to the spyware's stealth and advanced capabilities. Mitigation requires proactive threat hunting, enhanced monitoring of ad traffic, and collaboration with intelligence agencies to detect and block such campaigns. Countries with high adoption of affected platforms and strategic geopolitical importance are most likely targets. Given the high impact on confidentiality and the complexity of detection, this threat is assessed as high severity. Defenders should prioritize awareness, network segmentation, and zero-day vulnerability management to reduce exposure.
Warp Panda has been using the BrickStorm, Junction, and GuestConduit malware in attacks against US organizations. The post US Organizations Warned of Chinese Malware Used for Long-Term Persistence appeared first on SecurityWeek .
CISA has reported that hackers linked to the People's Republic of China (PRC) are using a malware toolset named BRICKSTORM to maintain persistent, long-term access within U. S.government and critical infrastructure systems. This campaign involves stealthy intrusion techniques aimed at espionage and data exfiltration. Although no known exploits are currently in the wild, the threat is considered high severity due to the advanced persistent threat (APT) nature and potential impact on confidentiality and integrity. European organizations with ties to U. S.entities or similar critical infrastructure sectors may also be targeted or affected. Mitigation requires enhanced network monitoring, strict access controls, and threat hunting focused on detecting BRICKSTORM indicators. Countries with significant U.
AutoIT3[1] is a powerful language that helps to built nice applications for Windows environments, mainly to automate tasks. If it looks pretty old, the latest version was released last September and it remains popular amongst developers, for the good… or the bad! Malware written in AutoIt3 has existed since the late 2000s, when attackers realized that the language was easy to learn (close to basic) but can also compiled into standalone PE files! From a malware point of view, such executables make an extended use of packed data, making them more stealthy.
Predator spyware has introduced a new infection vector enabling zero-click attacks, which do not require any user interaction to compromise a target device. This advancement increases the stealth and effectiveness of the spyware, allowing attackers to silently infiltrate devices and exfiltrate sensitive data. Although no known exploits are currently observed in the wild, the high severity rating reflects the potential risk posed by this novel attack method. European organizations, especially those in sectors with high-value targets such as government, defense, and critical infrastructure, could face significant confidentiality and integrity risks. Mitigation requires proactive monitoring for unusual device behavior, applying security updates promptly, and employing advanced endpoint detection solutions capable of identifying zero-click attack patterns. Countries with high adoption of mobile and IoT technologies, and those with strategic geopolitical importance, are more likely to be targeted. Given the ease of exploitation without user interaction and the potential for broad impact, this threat is assessed as high severity. Defenders should prioritize awareness and readiness to detect and respond to such sophisticated spyware threats.
The Ministry of Communications on had asked smartphone makers to install the government’s “Sanchar Saathi” app within 90 days and to prevent users from disabling it. The post India Rolls Back Order to Preinstall Cybersecurity App on Smartphones appeared first on SecurityWeek .
The Aisuru botnet recently launched the largest recorded DDoS attack, peaking at 29.7 Tbps, which was successfully mitigated by Cloudflare. This attack represents a significant escalation in volumetric DDoS capabilities, leveraging a large network of compromised devices to overwhelm targeted infrastructure. While no specific vulnerabilities or exploits were involved, the scale and sophistication of the botnet pose a serious threat to internet-facing services. European organizations, especially those with critical online infrastructure, could face service disruptions if targeted. Mitigation requires advanced DDoS protection services, network traffic filtering, and incident response preparedness. Countries with high internet infrastructure density and strategic digital assets, such as Germany, the UK, France, and the Netherlands, are likely to be primary targets. Given the attack's scale, ease of execution via botnet control, and potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize robust DDoS defenses and continuous monitoring to mitigate impact from similar future attacks.
The state-sponsored hackers relied on phishing emails to deliver a malicious payload to Reporters Without Borders (RSF). The post Reporters Without Borders Targeted by Russian Hackers appeared first on SecurityWeek .
The 25-page document outlines four principles for securely integrating AI with operational technology. The post Global Cyber Agencies Issue AI Security Guidance for Critical Infrastructure OT appeared first on SecurityWeek .
