A recent ransomware attack attributed to the RansomHub group was uncovered following an unusual CPU spike detected in a system. The attack involves ransomware that encrypts data and demands payment for decryption keys, posing a significant threat to affected organizations. Although no specific affected software versions or exploits in the wild have been reported, the high severity rating indicates a serious risk. European organizations, especially those with critical infrastructure or high-value data, could face operational disruption and financial losses. Mitigation requires proactive monitoring of system performance anomalies, robust endpoint protection, network segmentation, and incident response readiness. Countries with high adoption of vulnerable systems and strategic importance in sectors like finance, manufacturing, and healthcare are more likely to be targeted. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through typical ransomware infection vectors, and no need for user interaction beyond initial compromise, the threat severity is assessed as high. Defenders should prioritize detection of abnormal resource usage patterns and maintain updated backups to mitigate potential damage.
Fantasy Hub is a Russian-sold Android Remote Access Trojan (RAT) offered as Malware-as-a-Service (MaaS) that enables full device espionage. It targets Android devices, allowing attackers to remotely control and extract sensitive data. Although no known exploits in the wild are reported yet, the malware's capabilities pose a medium-level threat. The RAT can compromise confidentiality and privacy by accessing device sensors, communications, and stored data. European organizations with employees using Android devices are at risk, especially those in sectors with sensitive information. Mitigation requires enhanced mobile security hygiene, including restricting app installations, monitoring network traffic, and deploying mobile threat defense solutions. Countries with high Android adoption and strategic importance in cybersecurity, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of deployment via MaaS and the potential for significant data compromise without user interaction, the threat severity is assessed as high. Defenders should prioritize detection and containment strategies to mitigate potential espionage activities.
Enforcement of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) requirements started on November 10, 2025. The post CMMC Live: Pentagon Demands Verified Cybersecurity From Contractors appeared first on SecurityWeek .
APT37, a known advanced persistent threat group, has been observed abusing Google Find Hub functionality to conduct data-wiping attacks on Android devices. This attack leverages the integration between Google Find Hub and Android to remotely trigger destructive actions, leading to potential data loss and device disruption. While no specific affected versions or exploits in the wild have been confirmed, the threat is considered high severity due to the destructive nature and potential for targeted attacks. European organizations using Android devices with Google Find Hub integration are at risk, especially those in sectors targeted by APT37. Mitigation requires strict control over device permissions, monitoring for unusual Find Hub activity, and applying security best practices for Android device management. Countries with high Android adoption and strategic interest to APT37, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the potential impact on data integrity and availability, ease of exploitation via trusted device features, and no need for user interaction. Defenders should prioritize detection of anomalous Find Hub commands and enforce robust endpoint security policies.
Intel has filed a lawsuit against a former engineer accused of stealing approximately 18,000 top secret files prior to being laid off. This insider threat incident involves unauthorized exfiltration of highly sensitive intellectual property and confidential information. Although no direct exploit or vulnerability is reported, the breach highlights risks related to insider threats and data exfiltration. The incident underscores the importance of robust access controls, monitoring, and data loss prevention strategies. European organizations with similar intellectual property or sensitive data face comparable risks from disgruntled or departing employees. Mitigation requires strict enforcement of least privilege, timely revocation of access upon termination, and enhanced behavioral monitoring. Countries with significant semiconductor industries or advanced technology sectors are more likely to be impacted. Given the scale and sensitivity of the data stolen, the severity is assessed as high. Defenders should prioritize insider threat detection and response capabilities to prevent similar incidents.
The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and potentially exposing sensitive communications between congressional offices and CBO […] The post 10th November – Threat Intelligence Report appeared first on Check Point Research .
The Lazarus Group, a DPRK-linked threat actor, has launched a targeted espionage campaign against aerospace and defense sectors using a new variant of the Comebacker backdoor. The attack employs spear phishing with highly specific lure documents to deliver macro-based malware. The infection chain is multi-staged, featuring custom decryption algorithms and encrypted command-and-control communications, indicating advanced evasion techniques. The campaign infrastructure remains active, suggesting ongoing operations. This threat poses risks to confidentiality and integrity of sensitive defense-related information. European aerospace and defense organizations should enhance phishing defenses and monitor for indicators such as specific file hashes and suspicious domains. No CVSS score is assigned, but the threat is assessed as high severity due to its targeted nature, potential impact, and sophisticated malware. Countries with significant aerospace and defense industries and geopolitical interest in DPRK activities are most at risk. Immediate mitigation includes user training, macro restrictions, network monitoring, and threat intelligence sharing.
The North Korea-aligned threat actor DeceptiveDevelopment employs social engineering tactics to target software developers, especially those in cryptocurrency and Web3 projects. They use fake job offers and trojanized code challenges to deliver malware like BeaverTail and InvisibleFerret. The group has evolved to include more sophisticated tools like TsunamiKit and AkdoorTea. There are connections between DeceptiveDevelopment and North Korean IT worker fraud campaigns, with both groups collaborating and sharing information. The IT workers use AI-generated fake identities and employ proxy interviewers to secure remote jobs, posing risks to employers. This hybrid threat combines traditional fraud with cybercrime, blurring the lines between targeted APT activity and cybercrime.
Operation DreamJob is a cyberespionage campaign by the North Korea-aligned Lazarus group targeting European defense companies specializing in UAV technology. The attackers use social engineering and trojanized open-source software to deliver a sophisticated malware toolset including ScoringMathTea RAT and BinMergeLoader. The campaign aims to steal intellectual property and manufacturing knowledge to support North Korea's drone program. Attack techniques involve multiple stages with droppers, loaders, and downloaders, exploiting user interaction and system reconnaissance. The threat poses a medium severity risk due to targeted espionage with potential long-term strategic impact on defense capabilities. European UAV manufacturers and defense contractors are primary targets, especially in countries with significant aerospace industries. Mitigation requires enhanced supply chain security, strict validation of open-source software, user training against social engineering, and robust endpoint detection. Countries like Germany, France, Italy, and the UK are most likely affected given their UAV sector prominence and defense industry size. The campaign does not require zero-day exploits but leverages social engineering and trojanized software, increasing the risk of successful infiltration. Defenders should prioritize monitoring for known malware components and suspicious network activity related to this campaign.
Cisco firewall vulnerabilities are currently being actively exploited to conduct Denial of Service (DoS) attacks. These flaws allow attackers to disrupt network availability by overwhelming or crashing affected firewall devices. Although no specific affected versions or CVEs are detailed, the threat is rated high severity due to active exploitation and potential widespread impact. European organizations relying on Cisco firewalls for perimeter defense face risks of service outages and operational disruption. Mitigation requires immediate attention to Cisco advisories, network segmentation, and enhanced monitoring for anomalous traffic patterns. Countries with significant Cisco firewall deployments and critical infrastructure reliance are at greater risk. The threat is assessed as high severity given the ease of exploitation, impact on availability, and lack of authentication requirements. Defenders should prioritize patching once available, implement DoS protection mechanisms, and conduct incident response preparedness. This threat underscores the importance of proactive firewall security management in Europe’s cybersecurity landscape.
Chinese state-sponsored hackers are leveraging legacy vulnerabilities, such as those in Log4j and Microsoft IIS, to conduct global espionage campaigns. These attacks exploit well-known, often unpatched bugs in widely deployed software to gain unauthorized access and maintain persistence. The threat actors focus on legacy systems that remain in use due to operational constraints, turning them into espionage tools. European organizations running outdated or unpatched versions of these technologies are at significant risk. The attacks can compromise confidentiality and integrity of sensitive data, with potential impacts on national security and critical infrastructure. Mitigation requires targeted patch management, legacy system audits, and enhanced monitoring for exploitation attempts. Countries with high adoption of affected technologies and strategic geopolitical relevance are more likely targets. The threat is assessed as high severity due to the potential for widespread impact and the sophistication of the adversaries. Defenders must prioritize legacy vulnerability remediation and threat intelligence sharing to reduce exposure.
A sophisticated malware campaign is increasingly targeting WordPress websites to inject online casino spam content. This malware uses multiple redundancy and reinfection techniques, storing payloads in databases and non-standard file extensions to evade detection and maintain persistence. The campaign exploits the popularity of online gambling and leverages the decline of other spam sources, such as essay writing services, to focus on lucrative casino spam. Although primarily noted in Indonesia due to strict gambling laws, the campaign has international reach. The malware's complexity and persistence mechanisms pose risks to website integrity, SEO rankings, and user trust. European organizations running WordPress sites could be targeted, especially those with lax security or outdated plugins. Mitigation requires advanced detection, continuous monitoring, and tailored cleanup strategies. The threat is assessed as medium severity due to its impact on website integrity and SEO rather than direct data breach or system compromise.
The U. S. Congressional Budget Office (CBO) was reportedly targeted by a suspected foreign cyberattack. While specific technical details and attack vectors have not been disclosed, the incident is considered high priority due to the sensitive nature of the CBO's role in U. S.government budgetary and economic analysis. There is no current evidence of known exploits in the wild or detailed indicators of compromise. The attack highlights the ongoing risk of state-sponsored or foreign cyber espionage against government institutions. European organizations with similar governmental or budgetary functions should be alert to potential spillover or similar targeting. Mitigation should focus on enhanced monitoring, threat intelligence sharing, and hardening of critical government systems.
A Russia-linked advanced persistent threat (APT) group named InedibleOchotense is impersonating the cybersecurity vendor ESET to deploy a backdoor malware on Ukrainian systems. This campaign involves social engineering tactics to trick victims into trusting malicious payloads disguised as legitimate ESET software or communications. The backdoor enables persistent unauthorized access, potentially allowing espionage, data exfiltration, or further network compromise. Although currently observed targeting Ukraine, the threat poses risks to organizations in Europe due to geopolitical tensions and shared infrastructure. The attack does not require known exploits but relies on deception and malware delivery. Mitigation requires enhanced email and software supply chain verification, network monitoring for unusual activity, and user awareness training. Countries with close ties to Ukraine or high adoption of ESET products are at elevated risk. The threat severity is assessed as medium given the targeted nature, potential impact on confidentiality and integrity, and moderate ease of exploitation through impersonation without zero-day exploits.
