&#;x26;#;x5b;This is a Guest Diary by James Woodworth, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].
A significant data breach has impacted Coupang, a major South Korean e-commerce platform, compromising all 33.7 million user accounts. The breach potentially exposes sensitive personal information of the entire user base, posing risks of identity theft, fraud, and targeted phishing attacks. Although no known exploits are currently active, the breach's scale and the sensitivity of the data involved make it a high-priority incident. European organizations connected to South Korean markets or with users who have accounts on Coupang should be vigilant. The breach highlights the importance of robust data protection and incident response strategies. Mitigation involves monitoring for suspicious activities, enhancing authentication mechanisms, and ensuring data encryption. Countries with strong economic ties to South Korea and significant e-commerce engagement are more likely to be affected. Given the breach's scope and impact, the severity is assessed as high. Defenders must prioritize user notification, forensic analysis, and cross-border cooperation to mitigate downstream risks.
Albiriox is a banking trojan offered under a malware-as-a-service model for $720 per month. The post New Albiriox Android Malware Developed by Russian Cybercriminals appeared first on SecurityWeek .
A medium-severity security incident involving a compromise of the europa.eu domain was reported via a blog post linked from a Reddit NetSec discussion. The compromise was discovered through an unconventional method related to cricket, as detailed by the author. There is minimal technical detail publicly available, and no known exploits in the wild have been reported. The incident highlights potential risks to European Union digital infrastructure and sensitive information. European organizations relying on europa.eu services may face confidentiality and integrity risks. Mitigation should focus on enhanced monitoring, incident response readiness, and verification of domain and service integrity. Countries with significant EU institutional presence and digital infrastructure are most likely affected. Given the limited technical details and no active exploitation, the threat severity is assessed as medium.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting OpenPLC ScadaBR to its Known Exploited Vulnerabilities catalog. This flaw pertains to the OpenPLC ScadaBR platform, which is used for industrial control systems and SCADA environments. Although no specific CVSS score or detailed technical exploit information is provided, the vulnerability is assessed as medium severity. There are no known exploits in the wild at this time, and technical discussion and details remain minimal. The vulnerability could potentially impact the confidentiality, integrity, and availability of industrial control systems if exploited. European organizations using OpenPLC ScadaBR, especially in critical infrastructure sectors, should be vigilant. Mitigation should focus on monitoring for updates from vendors, applying patches promptly once available, and implementing network segmentation and access controls. Countries with significant industrial automation and critical infrastructure sectors, such as Germany, France, and the UK, are likely to be most affected.
The Tomiris threat actor has evolved its tactics by employing public-service implants to establish stealthier command and control (C2) channels targeting government entities. This shift enables Tomiris to blend malicious traffic with legitimate public service communications, complicating detection efforts. The attacks primarily focus on government targets, leveraging botnet capabilities to maintain persistence and control. Although no specific affected software versions or exploits in the wild are currently identified, the high severity rating reflects the potential impact on confidentiality and operational integrity. European government organizations are at risk due to the strategic nature of the targets and the increasing geopolitical tensions involving state-sponsored cyber activities. The stealthy use of public-service implants suggests a sophisticated adversary capable of evading traditional network defenses. Mitigation requires enhanced network monitoring for anomalous use of public service protocols, strict segmentation of critical government networks, and threat hunting focused on unusual C2 patterns. Countries with significant government digital infrastructure and geopolitical relevance, such as Germany, France, the UK, and the EU institutions in Belgium, are most likely to be affected. Given the high potential impact on confidentiality and integrity, ease of stealthy exploitation, and the broad scope of government targets, the suggested severity is high.
For the latest discoveries in cyber research for the week of 1st December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES OpenAI has experienced a data breach resulting from a compromise at third-party analytics provider Mixpanel, which exposed limited information of some ChatGPT API clients. The leaked data includes names, email addresses, approximate […] The post 1st December – Threat Intelligence Report appeared first on Check Point Research .
The FCC has issued a warning about hackers hijacking radio equipment to broadcast false emergency alerts. This threat involves unauthorized access to radio transmission systems, enabling attackers to send fraudulent alerts that could cause public panic and disrupt emergency response. The attack targets vulnerabilities in radio infrastructure, potentially exploiting weak authentication or outdated equipment. European organizations relying on similar radio alert systems could face misinformation campaigns and operational disruptions. Mitigation requires securing radio equipment with strong access controls, network segmentation, and continuous monitoring for anomalous transmissions. Countries with extensive emergency broadcast networks and critical infrastructure dependent on radio alerts are at higher risk. Given the high potential impact on public safety and the ease of exploitation of poorly secured systems, this threat is assessed as high severity. Defenders should prioritize hardening radio communication channels and coordinating with regulatory bodies to prevent misuse.
The Bloody Wolf threat actor group has expanded its use of a Java-based NetSupport Remote Access Trojan (RAT) targeting entities in Kyrgyzstan and Uzbekistan. This campaign leverages the NetSupport RAT, a legitimate remote administration tool often abused by attackers for espionage and data exfiltration. Although no specific affected software versions or exploits are detailed, the high severity rating indicates significant risk. The attacks focus on Central Asian countries but could have implications for European organizations with ties to the region or using similar RAT infrastructure. The threat involves remote access capabilities that can compromise confidentiality, integrity, and availability of targeted systems without requiring user interaction once deployed. Defenders should prioritize detection of NetSupport RAT activity, implement strict Java application controls, and monitor network traffic for suspicious remote administration connections. Given the geopolitical context and the nature of the RAT, Eastern European countries with strategic interests in Central Asia may be at increased risk. The threat is assessed as high severity due to the potential for extensive espionage and operational disruption, ease of RAT deployment, and broad impact on targeted organizations.
A recently reported security issue involves Microsoft Teams guest access functionality, where joining external tenants can inadvertently disable Microsoft Defender protections. This vulnerability arises when users participate as guests in other organizations' Teams environments, potentially allowing malicious actors to bypass endpoint security controls. The threat is significant due to the widespread use of Teams for collaboration across organizational boundaries, increasing the attack surface. No known exploits are currently in the wild, but the impact could be severe if leveraged. European organizations using Teams extensively for inter-company collaboration are at risk, especially those with guest access enabled. Mitigation requires strict control over guest access policies, monitoring of Defender status changes, and applying any forthcoming patches or configuration updates from Microsoft. Countries with high Teams adoption and critical infrastructure sectors relying on Microsoft 365 services are most likely to be affected. Given the ease of exploitation through legitimate collaboration features and the potential to disable critical security controls, the severity is assessed as high. Defenders should prioritize reviewing guest access configurations and enhance endpoint monitoring to detect anomalous Defender status changes.
Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like Telegram and Discord as command-and-control servers. The group employs various programming languages including Go, Rust, C/C#/C++, and Python to develop reverse shell tools. Some infections lead to the deployment of open-source post-exploitation frameworks such as Havoc and AdaptixC2. The campaign primarily focuses on Russian-speaking users and entities, with additional targets in Central Asian countries.
Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.
APT31, a Chinese cyber espionage group, is actively targeting the Russian IT sector, especially government contractors, using advanced malware and stealthy tactics. They leverage cloud services for command and control, deploy new malware families like AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor, and use prepared scripts for lateral movement. Their operations are timed to exploit organizational workflows, such as holidays, enabling prolonged undetected presence. The group employs multiple persistence, credential access, and data exfiltration techniques, evolving their toolkit while retaining older tools to maintain stealth. Although primarily focused on Russia, the sophistication and targeting of government contractors pose risks to European organizations with similar profiles. Mitigation requires tailored detection of cloud-based C2, monitoring lateral movement scripts, and enhanced credential security. Countries with significant IT sectors supporting government contracts and geopolitical interest in Russia-China dynamics are most at risk. The threat is assessed as high severity due to its espionage nature, stealth, and potential for long-term data compromise without requiring user interaction or known exploits in the wild.
The 'GhostAd' campaign is a large-scale Android adware threat that infiltrated Google Play with seemingly benign apps embedding persistent background advertising engines. These apps exploited Android foreground services, job schedulers, and continuous ad refreshing to maintain presence and aggressively display ads without user interaction, causing significant battery drain, degraded device performance, and difficulty in removal. Although primarily impacting users in East and Southeast Asia, the adware's use of legitimate advertising SDKs complicates detection and removal. Google has removed the malicious apps and disabled them via Google Play Protect. European organizations with Android device fleets could face indirect impacts such as reduced device availability and user productivity if similar apps spread. Mitigation requires proactive app vetting, enhanced endpoint monitoring for abnormal resource usage, and user education on app permissions and removal techniques. Countries with high Android adoption and significant Google Play usage, such as Germany, France, and the UK, are more likely to be affected if the campaign expands. Given the medium severity rating, the threat poses a moderate risk primarily through resource exhaustion and user disruption without direct data compromise or remote exploitation.
Shai-Hulud 2.0 is a highly aggressive and automated supply-chain malware targeting the npm ecosystem, identified in November 2025. It rapidly compromises hundreds of npm packages within hours, behaving like a worm that harvests credentials and cloud secrets. The malware leverages GitHub Actions as a persistent backdoor and creates public repositories to exfiltrate stolen data. This attack represents a significant escalation in supply-chain attack sophistication, affecting major projects and organizations globally. It results in tens of thousands of attacker-created GitHub repositories, facilitating widespread propagation. The malware automates spreading to new npm accounts, increasing infection speed and scale. It does not require user interaction once initial compromise occurs and exploits trusted software supply chains. No CVE or patch is currently available, and no known exploits in the wild have been reported yet. The attack’s medium severity rating may underestimate its potential impact given its worm-like behavior and credential theft capabilities.
A recently disclosed edge case vulnerability affects the mysql and mysql2 Node.js packages, where prepared statements—commonly trusted to prevent SQL injection—can be exploited under certain conditions. This vulnerability undermines the assumption that using prepared statements alone guarantees SQL injection safety, potentially allowing attackers to execute arbitrary SQL commands. While no known exploits are currently in the wild, the issue poses a medium severity risk due to its impact on data confidentiality and integrity. European organizations using Node.js applications with these database libraries should carefully review their usage of prepared statements and apply mitigations promptly. Countries with significant Node.js development ecosystems and industries relying on web applications and databases are at higher risk. Mitigation involves auditing code for unsafe prepared statement usage, applying any forthcoming patches, and employing additional input validation and query parameterization techniques. Given the ease of exploitation once the vulnerability is understood and the widespread use of these packages, the threat demands immediate attention despite limited current exploitation evidence.
