The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.
WEBJACK is a malware campaign targeting Microsoft IIS servers by deploying BadIIS malware modules to conduct SEO poisoning and fraud. The attackers hijack high-profile websites, including government and educational institutions, redirecting users to gambling sites. The campaign selectively serves malicious content to search engine crawlers while redirecting or blocking normal visitors, leveraging legitimate IIS modules for stealth. Originating from a Chinese-speaking threat actor, it primarily affects Southeast Asia and Latin America, with a focus on Vietnamese-language targets. Although no known exploits are publicly reported, the campaign uses advanced tools such as Cobalt Strike and XLANY Loader. The threat demonstrates evolving IIS hijacking techniques and abuse of legitimate security tools for monetization. European organizations could be at risk if targeted due to the use of IIS servers and the potential for reputational damage and fraud. Mitigation requires specific IIS module monitoring, integrity checks, and enhanced web server security. Countries with significant IIS usage and strategic government or educational targets, such as Germany, France, and the UK, are more likely to be affected. The threat severity is assessed as medium given the targeted nature, impact on availability and integrity, and moderate ease of exploitation without user interaction.
A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories, unpacks components, and generates new APK files before silently installing the malware. BTMob grants extensive device access, enabling credential theft and surveillance. UASecurity Miner focuses on persistence and remote control. The attack chain involves social engineering, APK generation, third-party packer services, and multiple command and control endpoints, reflecting a growing trend in modular Android threats.
RONINGLOADER is a sophisticated multi-stage malware loader used by the DragonBreath APT group to deploy an updated variant of the gh0st RAT. It begins infection via trojanized NSIS installers disguised as legitimate software and employs advanced evasion techniques including signed driver abuse, thread-pool injection, and Protected Process Light (PPL) exploitation to disable Microsoft Defender. The loader terminates antivirus processes, applies custom Windows Defender Application Control (WDAC) policies, and injects payloads into trusted system processes to avoid detection. This campaign targets Chinese EDR tools but demonstrates advanced tactics that could be adapted elsewhere. The malware’s complexity and stealth capabilities pose a medium severity threat, with potential impacts on confidentiality and integrity. European organizations using Windows environments with Microsoft Defender could be at risk, especially those in critical infrastructure and government sectors. Mitigation requires tailored detection of abnormal driver behavior, WDAC policy monitoring, and restricting installation of unsigned drivers. Countries with high adoption of Microsoft Defender and strategic geopolitical interest in China-related espionage are most likely affected.
A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.
Cloudflare experienced a global network outage impacting its services worldwide. The outage disrupted Cloudflare's network infrastructure, affecting many dependent websites and services. Although no specific vulnerability or exploit was reported, the incident highlights the risks associated with reliance on major cloud and CDN providers. The outage caused availability issues but did not indicate a breach or compromise of confidentiality or integrity. European organizations relying on Cloudflare for DNS, CDN, or security services may have faced service disruptions. No known exploits or malicious activity were linked to this event. Mitigation focuses on improving resilience through multi-provider strategies and robust incident response plans. Countries with high Cloudflare adoption and critical internet infrastructure are most likely affected. The severity is assessed as high due to the broad impact on availability and the critical nature of Cloudflare's services. Defenders should prioritize continuity planning and monitoring for similar future incidents.
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Britain’s domestic intelligence agency warned that Chinese nationals were ”using LinkedIn profiles to conduct outreach at scale” on behalf of the Chinese Ministry of State Security. The post MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn appeared first on SecurityWeek .
UNC1549, an Iranian-linked threat group, has been targeting aerospace, aviation, and defense industries since mid-2024. They employ sophisticated initial access techniques, including exploiting third-party relationships and targeted phishing. The group uses custom malware like TWOSTROKE, LIGHTRAIL, and DEEPROOT for persistence, and tools like DCSYNCER.SLICK and CRASHPAD for privilege escalation. UNC1549 demonstrates advanced lateral movement, reconnaissance, and defense evasion tactics. They extensively use SSH reverse tunnels and Azure infrastructure for command and control. The group's primary objective appears to be espionage, focusing on data collection and leveraging compromised organizations to target others in the same sector.
A threat actor gained initial access to a network via RDP using compromised credentials, likely obtained through an infostealer, data breach, or initial access broker. They quickly moved laterally to a domain controller, created multiple impersonation accounts with high privileges, and installed AnyDesk for persistence. Over nine days, the actor conducted extensive network reconnaissance using SoftPerfect NetScan and NetExec, mapped virtualization infrastructure, and browsed file shares. They exfiltrated sensitive data from multiple shares using temp.sh. On the final day, the actor connected to backup servers, deleted backup jobs, and deployed Lynx ransomware across multiple servers. The intrusion lasted 178 hours and leveraged compromised domain admin credentials throughout.
The state-sponsored APT has been targeting the victims’ family members to increase pressure on their targets. The post Iranian Hackers Target Defense and Government Officials in Ongoing Campaign appeared first on SecurityWeek .
The ClickFix malware campaign abuses the decades-old Finger protocol to facilitate malicious activities. This protocol, originally designed for user information queries, is being exploited as an attack vector despite its obsolescence. The malware leverages the protocol to infiltrate systems, potentially bypassing modern security controls that overlook legacy services. Although no known exploits are currently active in the wild, the high severity rating indicates significant risk if leveraged. European organizations using legacy systems or network services that still support the Finger protocol are particularly vulnerable. The threat could impact confidentiality and integrity by enabling unauthorized access or data leakage. Mitigation requires disabling the Finger protocol on all networked devices, conducting thorough network scans for legacy services, and enhancing monitoring for unusual Finger protocol traffic. Countries with higher legacy infrastructure usage and strategic industries relying on older systems are at greater risk. Given the ease of exploitation of an outdated protocol and the broad scope of affected systems, the suggested severity is high. Defenders should prioritize identifying and eliminating Finger protocol usage to reduce exposure to this emerging malware threat.
The threat involves evolving impersonation campaigns distributing the Gh0st RAT malware, a remote access trojan known for stealthy espionage and data exfiltration. Attackers use digital doppelganger techniques to mimic legitimate entities, increasing the likelihood of successful phishing and social engineering. Although no specific affected versions or exploits in the wild are reported, the campaign's medium severity reflects the potential for significant confidentiality and integrity impacts. European organizations, especially those in critical infrastructure and government sectors, face elevated risks due to targeted espionage motives. Mitigation requires tailored detection of impersonation tactics, enhanced email filtering, and user training focused on recognizing sophisticated social engineering. Countries with high adoption of targeted software and strategic geopolitical importance, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the malware's capabilities, ease of exploitation via social engineering, and broad potential impact without requiring user authentication but needing user interaction. Defenders should prioritize monitoring for impersonation indicators, deploying endpoint detection for Gh0st RAT behaviors, and enforcing strict access controls to limit lateral movement.
NotDoor is a backdoor malware leveraging Outlook macros for persistence and lateral movement within compromised environments. It stages files in C:\ProgramData and abuses DLL sideloading via OneDrive.exe to evade detection. The malware executes encoded PowerShell commands, modifies registry keys to enable macros and disable security dialogs, and uses Outlook functions for command-and-control (C2) communication and email monitoring. Detection strategies include monitoring suspicious PowerShell activity, registry changes, and the creation of VbaProject. OTM files by non-Outlook processes. The threat is linked to the APT28 (Fancy Bear) actor and represents a medium-severity risk. European organizations using Microsoft Outlook and OneDrive are potential targets, especially those in critical infrastructure and government sectors. Mitigation requires focused monitoring, macro policy enforcement, and DLL sideloading prevention measures.
The 'SpearSpecter' campaign is a high-severity espionage operation attributed to Iranian threat actors targeting defense and government entities. It involves sophisticated spear-phishing and possibly custom malware to infiltrate sensitive networks. While no specific vulnerabilities or exploits have been publicly disclosed, the campaign's focus on high-value targets indicates a strategic intent to gather intelligence. European defense and government organizations are at risk due to their geopolitical relevance and collaboration with global security partners. The threat actors likely employ stealthy tactics to maintain persistence and evade detection. Mitigation requires enhanced email filtering, network monitoring for anomalous activity, and strict access controls. Countries with significant defense industries and government institutions, such as the UK, Germany, France, and Italy, are most likely to be targeted. Given the campaign's espionage nature, ease of exploitation is moderate but impact on confidentiality is critical. Defenders should prioritize threat intelligence sharing and incident response readiness to counter this evolving threat.
