A data leak from a Chinese technology firm has reportedly exposed details of state-linked hacking operations. The leak, surfaced via a Reddit post linking to an external news source, suggests that sensitive information about cyber espionage activities tied to a nation-state actor has been compromised. Although the breach is categorized as medium severity and no direct exploits are currently known, the exposure of operational details could enable adversaries to better understand and potentially counter these hacking campaigns. European organizations may face increased risks if targeted by these state-linked actors or if their infrastructure overlaps with the compromised information. Mitigation requires enhanced monitoring for related threat indicators, strengthening incident response capabilities, and reviewing exposure of sensitive operational data. Countries with significant technology sectors, critical infrastructure, or geopolitical interest in China are more likely to be affected. Given the medium severity, the threat poses a moderate risk primarily through intelligence exposure rather than immediate exploitation. Defenders should prioritize intelligence sharing and proactive defense measures to mitigate potential follow-on attacks.
ASUS has disclosed a critical authentication bypass vulnerability affecting its DSL series routers. This flaw allows an attacker to circumvent authentication mechanisms, potentially gaining unauthorized administrative access to the device. Exploitation could lead to full control over the router, enabling attackers to manipulate network traffic, deploy malware, or disrupt services. No known exploits are currently reported in the wild, but the severity and nature of the vulnerability make it a high-risk threat. European organizations using ASUS DSL routers are at risk, especially those in sectors relying heavily on stable and secure network infrastructure. Immediate mitigation steps include monitoring for official patches from ASUS and implementing network-level protections. Countries with significant ASUS router deployments and critical infrastructure reliance are more likely to be targeted. Given the ease of exploitation without authentication and the potential for widespread impact, this vulnerability is assessed as critical severity. Defenders should prioritize identification, patching, and network segmentation to reduce exposure.
The ransomware landscape is experiencing significant fragmentation, complicating defense efforts, while the notorious LockBit ransomware group has reemerged as a prominent threat. This resurgence signals a potential increase in targeted ransomware attacks leveraging LockBit's established infrastructure and tactics. European organizations, especially those in critical infrastructure and high-value sectors, face heightened risks due to LockBit's return and the broader ransomware ecosystem's instability. The fragmentation among ransomware groups may lead to more unpredictable attack vectors and increased competition, potentially escalating ransom demands and attack frequency. Defenders should prioritize monitoring for LockBit indicators, enhance incident response readiness, and implement targeted controls to mitigate ransomware risks. Countries with high digital infrastructure reliance and previous ransomware incidents, such as Germany, France, and the UK, are particularly vulnerable. Given the high impact on confidentiality, integrity, and availability, combined with ease of exploitation and no need for user interaction in some cases, this threat is assessed as high severity. Immediate, specific mitigation steps beyond generic advice are critical to reduce exposure and potential damage.
A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign. The post Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign appeared first on SecurityWeek .
A recently patched vulnerability in Fortinet FortiWeb web application firewall products has been actively exploited to create unauthorized administrative accounts. This flaw allows attackers to escalate privileges by injecting admin-level credentials, potentially leading to full control over the affected devices. Although the vulnerability has been patched, exploitation attempts have been observed in the wild, highlighting the urgency for organizations to apply updates. The attack does not require user interaction but may require network access to the FortiWeb management interface. European organizations using FortiWeb appliances are at risk of unauthorized access, data compromise, and disruption of web application security controls. Immediate patching and monitoring for suspicious admin account creation are critical to mitigate this threat. Countries with significant Fortinet market presence and critical infrastructure relying on FortiWeb are particularly vulnerable. Given the ease of exploitation and high impact on confidentiality and integrity, this vulnerability is assessed as high severity. Defenders should prioritize deploying patches, auditing admin accounts, and restricting management interface access to trusted networks.
On February 24, 2022, a cyberattack exploited a VPN vulnerability in Viasat's KA-SAT satellite network, deploying AcidRain wiper malware. This attack disrupted satellite communications for thousands of users in Ukraine and disabled 5,800 wind turbines in Germany. The malware shares similarities with the VPNFilter malware family and targeted management systems to cause widespread operational disruption. Although impactful, the attack was less severe than other infrastructure attacks on Ukraine during the same period. The incident underscores the vulnerabilities in satellite network security and the critical need for robust defenses against sophisticated cyber threats targeting critical infrastructure. No known exploits are currently active in the wild, and the attack required access through a VPN vulnerability. European organizations relying on satellite communications and renewable energy infrastructure are particularly at risk. Mitigation requires patching VPN vulnerabilities, enhancing network segmentation, and monitoring for indicators of compromise related to AcidRain. Germany is notably affected due to the impact on its wind turbines, and other European countries with similar infrastructure and satellite dependencies should remain vigilant.
Operation Endgame successfully dismantled three major malware threats: the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. Authorities seized 1025 servers linked to these operations and arrested one individual involved. These malware families were used for stealing sensitive information and controlling botnets for malicious activities. Although no active exploits are currently reported, the takedown disrupts ongoing cybercriminal campaigns. European organizations could have been targets due to the global reach of these malware strains. The medium severity reflects the moderate impact and complexity of these threats. Defenders should focus on monitoring for remnants of these malware, improving endpoint detection, and collaborating with law enforcement. Countries with high internet infrastructure and financial sectors are more likely to have been affected. The operation highlights the importance of international cooperation in combating cybercrime. Vigilance is still required as threat actors may attempt to rebuild or pivot to new malware.
Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .
A large-scale spam campaign involving tens of thousands of malicious NPM packages has been identified, distributing a self-replicating worm. The campaign appears to be orchestrated by an Indonesian threat actor, inferred from code comments and the random naming of packages. These malicious packages propagate by infecting other packages or systems, potentially compromising software supply chains. Although no known exploits in the wild have been reported yet, the widespread nature of the packages poses a significant risk. The threat primarily targets the JavaScript ecosystem, specifically developers and organizations relying on NPM packages. European organizations using NPM packages in their development workflows could face supply chain contamination, leading to data breaches, system compromise, or further malware propagation. Mitigation requires proactive package vetting, dependency auditing, and restricting automated package installations. Countries with strong software development sectors and high NPM usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium severity and the potential for widespread impact without requiring user interaction, the threat should be taken seriously and addressed promptly.
A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.
This report discusses the manual creation of . NET serialization gadgets, which are components that can be exploited in deserialization attacks to execute arbitrary code. While no specific vulnerabilities or exploits are currently known in the wild, the technique highlights potential risks in . NET applications that use insecure deserialization. The threat is of medium severity due to the complexity of exploitation and the need for specific conditions. European organizations using . NET frameworks in their applications should be aware of this emerging technique and review their deserialization practices. Mitigations include avoiding deserialization of untrusted data, implementing strict input validation, and employing secure coding practices. Countries with significant . NET development ecosystems and critical infrastructure relying on .
Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.
NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .
Behavioral detection allows defenders to recognize activity patterns like privilege escalation, credential theft, and lateral movement—often ahead of encryption or data exfiltration. The post How TTP-based Defenses Outperform Traditional IoC Hunting appeared first on SecurityWeek .
Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.
Hackers have been observed abusing a feature within the Triofox antivirus solution to deploy remote access tools (RATs). This abuse enables attackers to bypass traditional security controls by leveraging trusted antivirus functionality to execute malicious payloads remotely. Although no known exploits are currently active in the wild, the technique represents a high-severity threat due to the potential for unauthorized remote access and control over affected systems. European organizations using Triofox antivirus are at risk of targeted attacks that could compromise confidentiality, integrity, and availability of critical assets. The threat requires immediate attention to monitor and restrict misuse of antivirus features. Mitigation involves strict application control policies, enhanced monitoring of antivirus behavior, and network segmentation to limit lateral movement. Countries with higher adoption of Triofox or strategic sectors relying on this antivirus are more likely to be impacted. Given the ease of exploitation through trusted software features and the high potential impact, this threat is assessed as high severity. Defenders should prioritize detection of anomalous antivirus activity and prepare incident response plans accordingly.
