A cyberattack targeted OnSolve CodeRED, a critical emergency alert system, causing emergency alerts to go dark. This disruption poses a severe risk to public safety by preventing timely dissemination of urgent warnings. The attack highlights vulnerabilities in emergency communication infrastructure. No specific technical details or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild at this time. The incident underscores the importance of securing alerting platforms to maintain public trust and safety. European organizations relying on similar alerting systems could face analogous risks. Immediate mitigation and resilience planning are essential to prevent similar outages. The attack's critical severity stems from its impact on availability and potential to endanger lives. Defenders should prioritize securing emergency communication systems and establishing robust incident response protocols.
ASUS has disclosed a critical authentication bypass vulnerability affecting its AiCloud routers. This flaw allows attackers to circumvent authentication mechanisms, potentially granting unauthorized access to router management interfaces. Exploitation could lead to full control over the device, enabling attackers to manipulate network traffic, steal sensitive data, or deploy further attacks within the network. No known exploits are currently reported in the wild, but the severity and nature of the flaw demand immediate attention. European organizations using ASUS AiCloud routers are at risk, especially those in sectors relying heavily on secure network infrastructure. Mitigation requires prompt firmware updates once available, network segmentation, and enhanced monitoring of router access logs. Countries with high ASUS router market penetration and critical infrastructure reliance on such devices are more likely to be impacted. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation without authentication, and broad potential scope, this vulnerability is assessed as critical severity. Defenders should prioritize patching and implement compensating controls to reduce exposure until updates are deployed.
This report discusses concerns about Huawei and Chinese surveillance activities as highlighted by Bruce Schneier, a well-known security expert. It is a security news article rather than a direct vulnerability or exploit. The content focuses on geopolitical and supply chain risks related to Huawei's telecommunications equipment and potential surveillance implications. There are no specific technical vulnerabilities, exploits, or affected software versions detailed. The threat is medium severity due to the potential impact on confidentiality and national security, but lacks direct exploitability information. European organizations using Huawei infrastructure may face risks of unauthorized data access or espionage. Mitigation involves careful supply chain risk management, network segmentation, and enhanced monitoring of Huawei equipment. Countries with significant Huawei infrastructure deployment and geopolitical tensions with China, such as Germany, France, and the UK, are most likely affected. The threat is indirect, stemming from surveillance concerns rather than technical exploits, requiring strategic and policy-level responses.
JSONFormatter and CodeBeautify users exposed credentials, authentication keys, configuration information, private keys, and other secrets. The post Thousands of Secrets Leaked on Code Formatting Platforms appeared first on SecurityWeek .
Fake Battlefield 6 game downloads are being distributed to spread malware and steal player data. These malicious downloads impersonate the highly anticipated game to lure victims into installing harmful software. The malware aims to compromise user confidentiality by harvesting sensitive information from infected systems. While no known exploits or vulnerabilities in Battlefield 6 itself are involved, the threat leverages social engineering and fake distribution channels. European gamers and organizations with gaming communities may be targeted, especially where Battlefield 6 has significant popularity. The threat requires user interaction to download and execute the fake installer, limiting automated spread but increasing risk through deception. Mitigation involves educating users on verifying legitimate sources, employing endpoint protection with malware detection, and monitoring network traffic for suspicious activity. Countries with large gaming populations and strong Battlefield fanbases, such as the UK, Germany, France, and the Nordics, are more likely to be affected. Given the medium severity rating and the nature of the attack, defenders should prioritize awareness and technical controls to prevent infection and data theft.
A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finger protocol, and anti-analysis checks. They utilize multiple domains for payload delivery and command and control. The group's infrastructure overlaps with previous campaigns from 2024, suggesting an evolution of tactics rather than a new actor. NetMedved's operations involve social engineering, custom obfuscation, and abuse of legitimate tools to evade detection and maintain persistence on compromised systems.
The attack on the engineering firm was identified by Arctic Wolf in September before it could disrupt the engineering company’s operations or spread further. The post Russian Hackers Target US Engineering Firm Because of Work Done for Ukrainian Sister City appeared first on SecurityWeek .
CISA has described the techniques used by attackers and pointed out that the focus is on high-value individuals. The post CISA Warns of Spyware Targeting Messaging App Users appeared first on SecurityWeek .
A recently reported security issue involves code beautifiers—tools used to format source code—accidentally exposing sensitive credentials from banks, government agencies, and technology organizations. These tools, when processing code, can inadvertently reveal secrets such as API keys, passwords, and tokens embedded in the code or configuration files. Although no known exploits are currently active in the wild, the exposure risk is high due to the sensitive nature of the leaked information. The threat primarily arises from the improper handling or display of code snippets by beautifiers, which may not sanitize or mask confidential data. European organizations using such tools in their development or code review processes could face significant confidentiality breaches. Mitigation requires careful auditing of code before formatting, implementing automated secret detection, and restricting access to formatted code outputs. Countries with large financial sectors, government digital services, and advanced tech industries are more likely to be impacted. Given the ease of exploitation and the criticality of exposed data, the threat severity is assessed as high. Defenders should prioritize securing development pipelines and educating developers about secret management best practices.
CISA has issued a warning about active spyware campaigns targeting high-value users of Signal and WhatsApp messaging platforms. These campaigns aim to hijack accounts and compromise communications through sophisticated spyware infections. The threat actors focus on individuals with sensitive or strategic communications, leveraging vulnerabilities or social engineering to deploy spyware. This poses significant risks to confidentiality and privacy, especially for organizations relying on these encrypted messaging services. European organizations using Signal and WhatsApp for secure communications are at risk of espionage and data theft. The campaigns do not currently have known exploits in the wild but are considered high priority due to their targeted nature and potential impact. Mitigation requires enhanced user awareness, strict device hygiene, and monitoring for suspicious activity. Countries with high adoption of these messaging apps and strategic geopolitical interests are most vulnerable. The severity is assessed as high given the potential for significant confidentiality breaches and the difficulty in detecting spyware infections.
The Cl0p ransomware group has listed Mazda and Mazda USA as victims of the Oracle EBS campaign on its leak website. The post Mazda Says No Data Leakage or Operational Impact From Oracle Hack appeared first on SecurityWeek .
RadzaRat is a newly identified spyware targeting Android devices by masquerading as a legitimate file manager application. It is notable for evading detection by all 66 antivirus engines on VirusTotal, indicating advanced stealth capabilities. The spyware can hijack devices, potentially compromising user confidentiality and device integrity. Although no known exploits in the wild have been confirmed, the threat is considered medium severity due to its evasion techniques and potential impact. European organizations using Android devices are at risk, especially those with mobile workforces or BYOD policies. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and monitoring device behavior for anomalies. Countries with high Android usage and significant mobile-dependent sectors, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the spyware’s stealth and potential for data exfiltration without user interaction, the threat severity is assessed as high. Defenders should prioritize detection improvements and user awareness to prevent infection and limit damage.
For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. […] The post 24th November – Threat Intelligence Report appeared first on Check Point Research .
Qilin ransomware is a recently identified ransomware threat investigated and reported by a trusted cybersecurity news source. Although technical details and indicators are limited, the ransomware is considered high severity due to its potential to encrypt data and disrupt operations. No known exploits in the wild have been confirmed yet, and minimal discussion exists in the InfoSec community. European organizations could face significant operational and financial impacts if targeted, especially those in critical infrastructure and industries with high ransomware exposure. Mitigation requires proactive network segmentation, robust backup strategies, and enhanced monitoring for ransomware behaviors. Countries with high digital infrastructure and ransomware incident history, such as Germany, France, the UK, Italy, and the Netherlands, are more likely to be affected. Given the lack of detailed exploitation data but the inherent destructive nature of ransomware, the threat severity is assessed as high. Defenders should prioritize early detection and incident response readiness to mitigate potential Qilin ransomware attacks.
APT31, a China-linked advanced persistent threat group, has launched stealthy cyberattacks targeting Russian IT infrastructure by leveraging cloud services. These attacks are characterized by their covert nature, aiming to infiltrate and maintain persistence within Russian organizations' networks. Although no specific vulnerabilities or exploits have been publicly detailed, the use of cloud services as an attack vector suggests sophisticated tactics to evade detection and exploit trusted platforms. The threat poses significant risks to confidentiality and integrity of targeted systems, with potential for espionage or disruption. European organizations, especially those with close ties to Russian entities or using similar cloud platforms, could face indirect risks. Mitigation requires enhanced monitoring of cloud service usage, strict access controls, and threat hunting focused on stealthy behaviors. Countries with strong economic or political connections to Russia and high cloud adoption rates are most likely to be affected. Given the stealth, high impact potential, and lack of required user interaction, this threat is assessed as high severity. Defenders should prioritize detection capabilities and inter-organizational information sharing to counter this evolving threat.
APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads. The post Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks appeared first on SecurityWeek .
