Multiple state-sponsored Russian groups are targeting Ukrainian entities and European countries linked to Ukraine. The post Destructive Russian Cyberattacks on Ukraine Expand to Grain Sector appeared first on SecurityWeek .
Between 2016 and 2021, the suspects defrauded 4.3 million cardholders in 193 countries of €300 million (~$346 million). The post 18 Arrested in Crackdown on Credit Card Fraud Rings appeared first on SecurityWeek .
A Russian government organization was targeted by the Cavalry Werewolf hacker group, aiming to collect confidential information and network data. The attack began with phishing emails containing malware disguised as documents. The group utilized various tools including backdoors, trojans, and modified legitimate programs. They employed open-source software, reverse-shell backdoors, and Telegram API for control. The attackers focused on information gathering, network configuration, and establishing persistence in compromised systems. Their tactics included using Windows built-in tools, modifying the registry, and exploiting public directories for malware deployment. The group's sophisticated approach and diverse toolset highlight the evolving threat landscape for government institutions.
The German hosting provider aurologic GmbH has become a critical infrastructure hub for multiple high-risk and sanctioned cybercrime networks, including entities involved in disinformation and malware campaigns. Despite public scrutiny and sanctions, aurologic continues to provide upstream transit services, enabling threat actors to maintain operational stability. The provider's approach to abuse handling is reactive and legally compliant rather than proactive, allowing malicious infrastructure to persist. This situation highlights challenges in accountability within the hosting ecosystem and the risks posed by infrastructure neutrality when it enables cybercrime. Numerous suspicious domains linked to aurologic-hosted networks have been identified, associated with malware families and threat actor tools. European organizations, especially in Germany, face increased risks due to this infrastructure's stability and continued operation. Mitigation requires enhanced monitoring of traffic from these domains, collaboration with upstream providers, and pressure on hosting providers to adopt proactive abuse prevention. Countries with significant internet infrastructure and cybercrime targets in Europe are most likely to be affected.
Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses custom WOFF2 fonts with glyph substitution to obfuscate filenames and exploits WordPress comment endpoints for payload delivery. It has shifted to Startup folder persistence and employs extensive obfuscation techniques. Reconnaissance begins quickly after infection, followed by predictable attack patterns including AD enumeration, lateral movement, and potential ransomware preparation. The loader's delivery method and obfuscation techniques have evolved, making it more challenging to detect and analyze.
The Sandworm threat group has deployed destructive data wiper malware targeting Ukraine's grain sector, aiming to disrupt agricultural operations and supply chains. This attack involves wiping critical data from systems, causing operational downtime and loss of sensitive information. The campaign is part of ongoing cyber hostilities linked to geopolitical tensions in the region. European organizations connected to agricultural supply chains or with business ties to Ukraine may face indirect impacts. The attack does not require user interaction but targets critical infrastructure, increasing its severity. Mitigation requires robust backup strategies, network segmentation, and enhanced monitoring for destructive malware indicators. Countries with strong agricultural sectors and close economic ties to Ukraine are at higher risk. Given the destructive nature, ease of deployment by a sophisticated actor, and critical sector targeted, the threat severity is assessed as high. Defenders should prioritize incident response readiness and information sharing to mitigate potential spillover effects.
The Cavalry Werewolf hacking group has deployed a new backdoor malware named ShellNET targeting a Russian government organization. This backdoor enables persistent unauthorized access and remote control over compromised systems. Although currently reported with minimal discussion and no known exploits in the wild, the malware represents a medium-severity threat due to its potential for espionage and disruption. European organizations should be aware of this threat given geopolitical tensions and possible targeting of allied or related infrastructure. Mitigation requires enhanced network monitoring for unusual outbound connections, strict access controls, and threat hunting focused on backdoor indicators. Countries with strong intelligence, government, and critical infrastructure sectors, especially those with close ties or adversarial relations involving Russia, are more likely to be affected. The threat is assessed as medium severity due to the targeted nature, lack of widespread exploitation, and moderate impact potential. Defenders must prioritize detection and containment to prevent lateral movement and data exfiltration.
A ransomware attack targeting the state of Nevada was discovered in August but had been active since May, initiated by a state employee inadvertently downloading malicious software. The prolonged undetected presence allowed the attackers to establish persistence and potentially exfiltrate data or disrupt operations. This incident highlights the risks of social engineering and the importance of timely detection and response. Although no specific ransomware variant or exploit details are provided, the attack underscores vulnerabilities in endpoint security and user awareness. European organizations face similar risks from ransomware that can remain dormant and undetected for months. Mitigation requires enhanced user training, robust endpoint protection, network segmentation, and continuous monitoring. Countries with significant public sector digital infrastructure and those historically targeted by ransomware campaigns are at higher risk. Given the medium severity rating and lack of known exploits, the threat is serious but not critical. Immediate detection and containment are crucial to minimize impact.
Adobe Acrobat 2020 has reached its end of life (EOL), meaning it will no longer receive security updates or patches from Adobe. This cessation of support increases the risk of unpatched vulnerabilities being exploited by attackers. Organizations continuing to use Adobe Acrobat 2020 after EOL may face increased exposure to security risks, including potential data breaches or malware infections. European organizations relying on this software should plan to upgrade to supported versions or alternative PDF solutions promptly. The threat does not involve active exploits currently in the wild but represents a growing risk over time. Mitigation involves inventorying affected installations, prioritizing upgrades, and enhancing endpoint protections. Countries with high adoption of Adobe products and significant regulatory requirements around data protection are most likely to be impacted. Given the medium severity and lack of active exploits, the risk is moderate but should not be underestimated due to the critical role of PDF software in business workflows.
Threat actors have begun leveraging Windows Hyper-V virtualization technology to stealthily run hidden Linux virtual machines (VMs) on compromised Windows hosts. This technique enables attackers to evade Endpoint Detection and Response (EDR) tools by isolating malicious activities within a concealed Linux VM, making detection and forensic analysis significantly more difficult. The threat does not currently have known exploits in the wild but is considered high priority due to its potential to bypass common security controls. European organizations using Windows systems with Hyper-V enabled are at risk, especially those in sectors with high virtualization adoption. Attackers exploiting this method can maintain persistence and conduct lateral movement or data exfiltration under the radar. Mitigation requires enhanced monitoring of Hyper-V activity, restricting Hyper-V usage to trusted administrators, and deploying advanced behavioral analytics capable of detecting anomalous VM creation and network traffic. Countries with high Windows and Hyper-V market penetration and strategic importance in critical infrastructure are most likely to be targeted. Given the stealthy nature and potential impact on confidentiality and integrity, this threat is assessed as high severity. Defenders should prioritize visibility into virtualization layers and integrate Hyper-V telemetry into their security monitoring frameworks.
The threat actor stole the firewall configuration files of all SonicWall customers who used the cloud backup service. The post State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack appeared first on SecurityWeek .
A data breach at Hyundai AutoEver America has exposed sensitive personal information including Social Security Numbers (SSNs) and driver's license details. The breach was reported via Reddit's InfoSecNews community and covered by BleepingComputer, indicating its credibility and urgency. Although no specific technical details or exploited vulnerabilities have been disclosed, the exposure of personally identifiable information (PII) poses significant risks of identity theft and fraud. There is no evidence of active exploitation in the wild yet, but the breach's high severity classification underscores the potential impact. European organizations connected to Hyundai or its supply chain should be alert to possible secondary risks such as phishing or targeted attacks leveraging leaked data. Mitigation should focus on monitoring for misuse of exposed data, enhancing identity verification processes, and ensuring robust incident response readiness. Countries with strong automotive industry ties and significant Hyundai market presence, such as Germany and the UK, are likely to be most affected. Given the nature of the breach and the sensitivity of the data exposed, the suggested severity is high. Defenders must prioritize detection of suspicious activity related to this breach and communicate transparently with affected individuals to mitigate harm.
In September 2025, SonicWall disclosed a security breach attributed to state-sponsored hackers. The breach involved unauthorized access to SonicWall's systems, potentially compromising sensitive data and impacting the security of their customers. While specific technical details and affected product versions were not disclosed, the incident is considered high severity due to the involvement of advanced threat actors and the critical nature of SonicWall's security products. No known exploits in the wild have been reported yet. European organizations relying on SonicWall's VPN and firewall solutions may face increased risk of data exposure and operational disruption. Mitigation requires immediate review of SonicWall product configurations, enhanced monitoring for suspicious activity, and applying any forthcoming patches or guidance from SonicWall. Countries with significant SonicWall deployments and strategic sectors such as finance, government, and critical infrastructure are most at risk. Given the breach's potential impact on confidentiality and integrity, ease of exploitation by skilled attackers, and the broad scope of affected systems, the suggested severity is high. Defenders should prioritize threat detection, incident response readiness, and collaboration with SonicWall for remediation updates.
CISA has issued a warning about a critical vulnerability in CentOS Web Panel (CWP) that is actively being exploited in the wild. The vulnerability allows attackers to compromise affected systems, potentially leading to unauthorized access and control. Although specific technical details and affected versions are not provided, the critical severity indicates a high risk of exploitation without requiring user interaction or authentication. European organizations using CentOS Web Panel for web hosting or server management are at significant risk, especially those in countries with high adoption of CentOS-based infrastructure. Immediate mitigation steps include monitoring for unusual activity, applying patches when available, restricting access to the panel, and enhancing network segmentation. Countries such as Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their extensive use of Linux-based web hosting environments and critical infrastructure. Given the critical nature and active exploitation, the suggested severity is critical. Defenders should prioritize detection and containment efforts to prevent compromise and data breaches.
For several years, we have offered a "new domain" list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the list has been causing issues, resulting in a "cut-off" list being returned. To resolve this issue, I updated the API call. It is sort of backward compatible, but it will not allow you to retrieve the full list. Additionally, we offer a simple "static file" containing the complete list. This file should be used whenever possible instead of the API.
Norton researchers have successfully cracked the Midnight ransomware and released a free decryptor tool, enabling victims to recover their encrypted data without paying ransom. Midnight ransomware is a malware strain that encrypts victim files to extort payment. The availability of a decryptor significantly reduces the threat posed by this ransomware. There are no known active exploits in the wild currently, and the discussion around this development is minimal. The threat severity is assessed as medium due to the ransomware’s potential impact but mitigated by the decryptor’s release. European organizations previously targeted or vulnerable to Midnight ransomware can now leverage this decryptor to recover data. However, vigilance remains necessary as ransomware variants evolve rapidly. Practical mitigation includes deploying the decryptor if infected, maintaining robust backups, and enhancing endpoint security. Countries with higher ransomware incidents and significant use of affected systems are more likely to benefit from this development. Overall, this represents a positive step in combating ransomware threats but does not eliminate the need for comprehensive cybersecurity defenses.
A sophisticated cyber attack targeting the defense sector was identified in October 2025, utilizing a weaponized ZIP archive disguised as a military document. The multi-stage attack employs advanced evasion techniques and deploys a complex infrastructure combining OpenSSH for Windows with a customized Tor hidden service. The malware establishes persistent backdoor access, allowing anonymous remote access via SSH, RDP, SFTP, and SMB protocols. The lure document targets Belarusian Air Force drone experts, suggesting intelligence gathering on regional UAV capabilities. The attack's tactics, techniques, and procedures align with those of Sandworm (APT44), a Russian-linked APT group, although definitive attribution remains uncertain at this stage.
The Silent Lynx APT group has been conducting espionage campaigns targeting Central Asian nations, Russia, China, and Azerbaijan. Two main campaigns were identified: one focusing on Russia-Azerbaijan relations and another on China-Central Asia relations. The group uses various malware including PowerShell scripts, .NET implants, and C++ reverse shells. They leverage spear-phishing with malicious attachments, GitHub-hosted payloads, and scheduled tasks for persistence. The campaigns aim to gather intelligence on diplomatic communications, transportation projects, and other strategic initiatives. Silent Lynx shows a pattern of targeting summit meetings and infrastructure deals in the region, with a particular focus on events in Dushanbe, Tajikistan.
A new Android Trojan masquerades as legitimate news reader or digital ID apps, stealthily stealing sensitive data by exploiting Android Accessibility Services and overlay features. It primarily targets banking and cryptocurrency applications by overlaying fake login screens to capture credentials. The malware operates silently in the background, connects to a remote command center for updates and cleanup, and has been observed mainly in Southeast Asia. Although no CVE or known exploits in the wild are reported, the malware's capabilities pose significant risks to user confidentiality and financial security. This threat highlights the importance of enhanced mobile security and user vigilance against fake apps and overlay attacks.
