Threats affecting Poland

A family of four new remote access trojans (RATs) operated by the STD Group has been identified, leveraging Discord as their command and control (C2) channel. These RATs—Minecraft RAT, UwUdisRAT, STD RAT, and Propionanilide RAT—are written in C++ and use a ROT23 cipher to obfuscate Discord bot tokens for C2 communication. The malware has evolved from single payloads to using packers, complicating detection efforts. The RATs enable attackers to perform reconnaissance, execute commands, and maintain persistence on infected systems. Detection is supported by YARA rules and file indicators provided in the analysis. While no known exploits in the wild have been reported yet, the use of Discord for C2 is notable for evading traditional network defenses. European organizations, especially those with high Discord usage or gaming-related sectors, could be targeted. Mitigation requires enhanced monitoring of Discord traffic, endpoint detection tuned for these RAT behaviors, and restricting unauthorized Discord bot usage within corporate environments.

Malware#std rat#propionanilideGermany+7

A new malware loader discovered in May 2025 executes two malware families: TorNet and PureHVNC. The loader uses API hashing with MurmurHash2 and implements persistence through registry modifications. It decrypts and decompresses payloads using AES-128-ECB and LZMA, then injects them into a suspended jsc.exe process. TorNet, a downloader malware, communicates via TOR network, while PureHVNC is a commercial RAT allowing remote access. Both malware use Protocol Buffers for configuration deserialization. The loader's unique characteristics include its dual payload execution and API hashing implementation, indicating potential future attack techniques.

Malware#purehvnc#loaderGermany+6

Android/BankBot-YNRK is a sophisticated mobile banking Trojan targeting Android devices, specifically aiming at financial and cryptocurrency applications. It abuses Android accessibility services to gain elevated privileges, enabling it to automate UI interactions and extract sensitive user data. The malware can masquerade as legitimate apps, suppress audio notifications to avoid user detection, and perform unauthorized operations such as credential theft and fraudulent transactions. It maintains persistence on infected devices and communicates with command-and-control (C2) servers to receive remote commands and exfiltrate data. Although no known exploits are reported in the wild, the trojan represents a significant threat to Android users, especially those engaged in mobile banking and cryptocurrency activities. The malware’s complexity and stealth capabilities increase the risk of financial loss and privacy breaches. European organizations with employees or customers using Android banking or crypto apps are at risk, particularly in countries with high Android market share and digital banking adoption. Mitigation requires targeted measures including restricting accessibility service permissions, monitoring network traffic for suspicious domains, and educating users on app installation risks.

Malware#overlay attacks#cryptocurrency theftGermany+7

The 130-page document covers several important aspects and it’s available in both Japanese and English. The post Japan Issues OT Security Guidance for Semiconductor Factories appeared first on SecurityWeek .

AnalysisGermanyFrance+5

The Akira ransomware group claims to have stolen 23GB of data from Apache OpenOffice, a widely used open-source office productivity suite. Although no specific vulnerabilities or exploits have been detailed, the incident highlights a targeted ransomware attack involving data exfiltration prior to encryption. There is no evidence of known exploits in the wild or affected software versions disclosed. The attack appears to be recent and reported via Reddit and cybersecurity news sources, but with minimal technical discussion or confirmation. European organizations using Apache OpenOffice or related infrastructure could face risks of data compromise and operational disruption. Mitigation requires enhanced network segmentation, monitoring for unusual data transfers, and robust incident response plans. Countries with significant open-source software adoption and critical infrastructure relying on Apache OpenOffice are more likely to be impacted. Given the medium severity rating and lack of detailed exploit information, the threat is assessed as medium severity. Defenders should prioritize detection of ransomware behaviors and data exfiltration attempts while maintaining updated backups and access controls.

Malware#infosecnews#redditGermany+7

A former defense contractor executive has pleaded guilty to selling cyber exploits to Russia, raising concerns about the unauthorized transfer of sensitive offensive cyber capabilities. Although no specific exploits or affected systems have been disclosed, the incident highlights risks related to insider threats and the proliferation of advanced cyber tools to nation-state adversaries. European organizations could face increased risks if these exploits target critical infrastructure or defense-related sectors. The threat underscores the importance of stringent insider threat programs and supply chain security. No known active exploitation has been reported yet, but the potential for future attacks leveraging these exploits remains. Mitigation should focus on enhanced monitoring of privileged personnel, rigorous vetting, and rapid incident response capabilities. Countries with significant defense industries and critical infrastructure, such as the UK, Germany, and France, are most likely to be impacted. Given the medium severity rating and lack of direct exploit details, the overall threat level is assessed as medium. Defenders should remain vigilant for emerging indicators related to these exploits and strengthen collaboration with intelligence and law enforcement agencies.

News#infosecnews#redditGermany+5

A major US telecom backbone provider, Ribbon Communications, was reportedly compromised by nation-state actors. Ribbon Communications supplies critical communications technology to the US government and major telecom operators. Although specific technical details of the breach are not disclosed, the attack likely targets sensitive infrastructure supporting telecom networks. The incident highlights risks to telecom supply chains and potential impacts on network confidentiality, integrity, and availability. No known exploits or patches have been reported yet. European organizations relying on interconnected telecom infrastructure or using Ribbon products may face indirect risks. Mitigation requires enhanced monitoring, supply chain risk assessments, and collaboration with vendors. Countries with significant telecom infrastructure linked to US networks or strategic geopolitical interest in US-China/Russia relations are more likely to be affected. Given the medium severity and lack of detailed exploit information, the threat is assessed as high due to the critical nature of telecom backbone systems and potential for disruption or espionage.

CampaignGermanyFrance+6

Hacktivists have been reported by the Canadian Centre for Cyber Security to increasingly target internet-exposed Industrial Control Systems (ICS), with confirmed tampering incidents at a water facility and an oil and gas firm in Canada. These attacks highlight the growing risk to critical infrastructure sectors from threat actors exploiting exposed ICS environments. While no known exploits are currently in the wild, the medium severity rating reflects the potential for disruption to essential services. European organizations operating similar ICS environments, especially in water and energy sectors, face comparable risks. The threat underscores the need for enhanced ICS network segmentation, strict access controls, and continuous monitoring to detect unauthorized activity. Countries with significant oil, gas, and water infrastructure and high ICS adoption are more likely to be targeted. Given the ease of exploitation of internet-exposed ICS and the critical nature of these systems, the suggested severity is high. Defenders should prioritize reducing ICS exposure to the internet and implementing robust incident response plans tailored to ICS environments.

NewsGermanyFrance+6

Peter Williams stole trade secrets from his US employer and sold them to a Russian cybersecurity tools broker. The post Former US Defense Contractor Executive Admits to Selling Exploits to Russia appeared first on SecurityWeek .

NewsGermanyFrance+4

Hacktivists have reportedly breached critical infrastructure in Canada, as warned by a Canadian cyber agency. The breach is considered critical, indicating significant potential impact on essential services. Details are limited, with minimal discussion and no known exploits currently in the wild. The attack highlights the growing threat posed by hacktivist groups targeting national infrastructure. European organizations should be aware of similar risks, especially those with interconnected infrastructure or shared supply chains. Mitigation requires enhanced monitoring, incident response readiness, and collaboration with national cybersecurity agencies. Countries with close economic and security ties to Canada, or with similar critical infrastructure profiles, are more likely to be affected. The severity is assessed as critical due to the breach of critical infrastructure, potential for widespread disruption, and the difficulty in defending such targets. Defenders must prioritize threat intelligence sharing and proactive defense measures to mitigate similar threats.

Breach#infosecnews#redditGermany+9

The PolarEdge threat actor operates a sophisticated botnet infrastructure leveraging a newly discovered RPX_Client component and over 140 VPS nodes as RPX Servers. This infrastructure uses a multi-hop relay design involving more than 25,000 compromised IoT devices to conceal attack origins and enable proxy services and remote command execution. The botnet exploits CVE-2023-20118 to compromise IoT devices, facilitating anonymized and encrypted communications via SOCKS5 and Trojan protocols. Despite no known active exploits in the wild, the infrastructure poses a medium severity risk due to its potential for stealthy persistence, evasion, and large-scale disruptive attacks such as DDoS. The use of suspicious certificates and reverse-connect proxies complicates detection and mitigation efforts. The threat primarily impacts IoT ecosystems globally, with a focus on European organizations.

KEVMalware#proxy#infrastructureGermany+6

Tangerine Turkey is a cryptomining campaign that propagates via VBScript worms spread through USB drives, leveraging legitimate system binaries for execution and persistence. The malware employs advanced defense evasion techniques such as registry modification and masquerading malicious files as legitimate system components. It establishes persistence through malicious services and scheduled tasks while attempting to disable Windows Defender. Although its primary objective is unauthorized cryptocurrency mining, its capabilities for persistence and lateral movement pose broader security risks. The campaign uses living-off-the-land binaries and creates mock directories to conceal its activities. No known CVEs or exploits are currently associated with this threat. The medium severity rating reflects the financial motivation and potential for system compromise without immediate destructive impact. European organizations using Windows systems with USB access are at risk, especially those with lax endpoint security controls and high-value targets. Mitigation requires targeted controls beyond generic advice, including USB device management, monitoring for living-off-the-land abuse, and registry integrity checks.

Campaign#vbscript#living-off-the-landGermany+6

In October 2025, a wave of sophisticated cyber attacks targeted corporate environments, leveraging phishing campaigns exploiting trusted platforms like Google Careers and ClickUp, abusing Figma for credential theft, and deploying the LockBit 5.0 ransomware variant against ESXi and Linux systems. Attackers used legitimate cloud services and multi-stage redirection to evade detection, while a new phishing kit named TyKit emerged. These campaigns threaten corporate credentials, infrastructure integrity, and data confidentiality across multiple sectors. The attacks do not require known exploits in the wild but rely heavily on social engineering and abuse of trusted platforms. Security operations centers (SOCs) must enhance detection capabilities, harden access controls, and employ advanced threat intelligence to mitigate these evolving threats. The overall severity is medium, reflecting the complexity and multi-vector nature of the attacks but without widespread exploitation of zero-day vulnerabilities. European organizations, especially those using affected platforms and cloud services, face significant risks from credential theft and ransomware infection.

Campaign#clickup#lockbit 5.0Germany+7

Russian threat actors are conducting targeted cyberattacks against Ukrainian organizations using stealthy living-off-the-land (LotL) techniques. These tactics leverage legitimate system tools and processes to evade detection and maintain persistence without deploying traditional malware. The attacks focus on covert operations to infiltrate networks, gather intelligence, and potentially disrupt critical infrastructure. While no specific vulnerabilities or exploits have been disclosed, the use of LotL methods complicates detection and response efforts. European organizations, especially those with close ties to Ukraine or involved in regional security and infrastructure, face elevated risks of spillover or collateral targeting. Mitigation requires enhanced monitoring of native system tools, strict access controls, and threat hunting focused on anomalous legitimate tool usage. Countries with significant geopolitical interest in the conflict and strong digital infrastructure connections to Ukraine are most likely to be affected. Given the high impact potential on confidentiality, integrity, and availability combined with stealthy exploitation and no need for user interaction, this threat is assessed as high severity. Defenders must prioritize visibility into living-off-the-land activities and strengthen cross-border intelligence sharing to counter these sophisticated attacks.

News#infosecnews#redditPoland+7

Let’s compare TikTok, Twitch, YouTube, Reddit, Pinterest, Facebook, Instagram, and other social media based on the amount of data they collect and their privacy settings.

AnalysisGermanyFrance+8

Airstalk is a newly discovered Windows-based malware family used by a suspected nation-state actor, CL-STA-1009, in supply chain attacks targeting business process outsourcing companies. It exists in PowerShell and . NET variants, with the latter exhibiting advanced features such as multi-threaded command-and-control (C2) protocols, versioning, and signed binaries. The malware abuses the AirWatch API for mobile device management to covertly communicate with its C2 infrastructure. It exfiltrates sensitive browser data including cookies, history, and bookmarks, enabling extensive data theft. Its evasion techniques and adaptive behavior make it particularly dangerous in third-party vendor environments. No known public exploits exist yet, but the threat poses a medium severity risk with potential for significant impact on confidentiality and operational security. European organizations relying on outsourcing and mobile device management solutions are at elevated risk, especially in countries with strong BPO sectors. Mitigation requires enhanced supply chain security, monitoring of AirWatch API usage, and behavioral detection of anomalous PowerShell and . NET activities.

Malware#nation-state#airstalkGermany+7

The Trigona threat actor continues to target MS-SQL servers through brute-force and dictionary attacks, exploiting weak credentials. They use CLR Shell for additional payloads and employ various tools like BCP, Curl, Bitsadmin, and PowerShell to install malware. The attackers utilize remote control tools such as AnyDesk, RDP, and possibly Teramind. New scanner malware written in Rust targets RDP and MS-SQL services. The threat actor also uses tools like SpeedTest and a custom StressTester. Various privilege escalation and file manipulation tools are employed. To protect against these attacks, administrators should use complex passwords, regularly update security software, and implement firewalls to control access to database servers.

Malware#remote-control#ransomwareGermany+6

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.

Malware#ghostgrab#cryptocurrency miningGermany+7

Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.

Threat Actor#trinper#cobalt strikeGermany+8

Qilin ransomware is a novel threat that leverages the Windows Subsystem for Linux (WSL) to execute Linux-based encryption tools on Windows systems, enabling it to bypass traditional Windows security controls. This technique allows the ransomware to run Linux encryptors natively within Windows environments, complicating detection and mitigation efforts. Although no known exploits are currently active in the wild, the high severity rating reflects the potential for significant impact. European organizations using Windows systems with WSL enabled are at risk, especially those with critical data and infrastructure. The ransomware’s abuse of WSL represents a shift in attack methodologies, requiring defenders to monitor both Windows and Linux subsystems. Mitigation should include disabling WSL where not needed, enhanced monitoring of WSL processes, and applying strict application control policies. Countries with high Windows adoption and significant industrial or governmental digital infrastructure, such as Germany, France, and the UK, are more likely to be targeted. Given the ransomware’s ability to compromise confidentiality, integrity, and availability without requiring user interaction, the suggested severity is high. Defenders must update their detection capabilities to include cross-platform behaviors and consider WSL as a potential attack vector.

Malware#infosecnews#redditGermany+6