This threat involves attackers using memory-only filesystems (tmpfs) on Linux systems, such as /dev/shm, to hide malicious tools or stage data exfiltration. Traditional forensic imaging tools cannot capture these volatile filesystems because they lack block device backing. The analyst describes a method to collect both metadata and file contents from these tmpfs mounts by first extracting inode metadata using stat commands and then archiving file contents with tar, preserving forensic integrity. This technique has been tested successfully on numerous Linux and Unix-like systems. The threat highlights the challenge of detecting and collecting evidence from in-memory filesystems that attackers exploit to evade detection. The severity is medium due to the difficulty in forensic collection and potential for attackers to hide artifacts in tmpfs, but exploitation requires system access. European organizations running Linux servers with tmpfs mounts are at risk of stealthy attacks leveraging this technique.
Herodotus is a newly discovered Android malware designed to perform device takeover by mimicking human behavior to evade biometric and automated detection. It is distributed via side-loading and targets financial organizations and cryptocurrency wallets, with active campaigns observed in Italy and Brazil and potential for global spread. The malware is offered as Malware-as-a-Service and is linked to the Brokewell malware family. It steals credentials and remotely controls infected devices, using randomized delays between inputs to simulate human interaction. This behavior mimicry complicates detection by security solutions relying on behavioral analysis. The malware’s focus on financial targets and crypto wallets poses significant risks to confidentiality and financial integrity. European organizations, especially in Italy and Poland, are currently targeted and should prepare for potential expansion. Mitigation requires advanced layered security, including strict app installation policies, behavioral anomaly detection tuned for such mimicry, and user education on side-loading risks.
A DLL hijacking vulnerability has been identified involving narrator.exe, a Windows accessibility helper. This issue allows an attacker to load a malicious DLL by exploiting the way Windows resolves DLL dependencies for narrator.exe. Although no known exploits are currently active in the wild, the vulnerability could be leveraged to execute arbitrary code with the privileges of the affected process. The threat is rated medium severity due to the potential for privilege escalation and code execution without requiring user interaction, but it lacks widespread exploitation and detailed technical disclosure. European organizations using Windows systems with narrator.exe enabled could be impacted, especially those with high reliance on accessibility features or legacy configurations. Mitigation involves monitoring DLL loading paths, applying strict DLL search order policies, and employing application whitelisting. Countries with significant Windows enterprise usage and critical infrastructure are more likely to be targeted.
RedTiger is a medium-severity malware that targets users by stealing sensitive data including Discord authentication tokens and capturing webcam images. It is a data-stealing malware that compromises user privacy and security by exfiltrating credentials and potentially sensitive multimedia content. Although no known exploits in the wild have been reported yet, the malware’s capabilities pose significant risks if deployed. The malware’s focus on Discord tokens suggests targeting of users active on this platform, which is widely used across Europe. Webcam image theft indicates a high privacy invasion risk. Mitigation requires advanced endpoint protection, user education on phishing and suspicious downloads, and monitoring for unusual Discord token usage. European countries with high Discord adoption and strong gaming or tech sectors are more likely to be affected. Given the ease of exploitation and impact on confidentiality and privacy, the threat severity is assessed as high. Defenders should prioritize detection of this malware’s indicators and implement strict access controls on webcam and application tokens.
Recent reports indicate that ransomware payments have hit a record low, with only 23% of victims paying ransoms in Q3 2025. This trend suggests a shift in ransomware attack dynamics and victim response strategies. Although ransomware remains a significant malware threat, the declining payment rate may reflect improved defensive measures, increased law enforcement actions, or changes in attacker tactics. European organizations, often targeted by ransomware, could experience reduced financial losses from ransom payments but must remain vigilant against evolving ransomware techniques. The threat landscape is dynamic, and attackers may adapt to these changes by altering extortion methods or targeting less prepared victims. Defenders should focus on enhancing detection, incident response, and backup strategies to mitigate ransomware impact. Countries with high ransomware incident rates and critical infrastructure are more likely to be affected. Overall, while the payment rate decline is positive, ransomware remains a persistent threat requiring ongoing attention.
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data.
This issue affects Asseco mMedica in versions before 11.9.5.
While reviewing malicious messages that were delivered to our handler inbox over the past few days, I noticed that the “subject” of one phishing e-mail looked quite strange when displayed in the Outlook message list…
A mass attack campaign is targeting WordPress websites using vulnerabilities or malicious functionalities in the GutenKit and Hunk Companion plugins. These plugins, if installed and active, could be exploited to compromise site integrity, potentially allowing attackers to execute unauthorized actions. Although no specific affected versions or known exploits in the wild have been identified yet, the campaign's scale and focus on popular WordPress plugins raise concerns. European organizations running WordPress sites with these plugins are at risk, especially those in countries with high WordPress adoption. Mitigation requires immediate auditing of installed plugins, removal or update of GutenKit and Hunk Companion plugins, and enhanced monitoring for suspicious activity. Given the medium severity and lack of detailed technical exploit data, the threat should be taken seriously but is not currently critical. Countries with large WordPress user bases and significant web infrastructure, such as Germany, the UK, France, Italy, and Spain, are most likely to be affected. Defenders should prioritize plugin hygiene and proactive threat detection to prevent compromise.
The hackers stole information from a file transfer solution and the country’s power supply was not affected. The post Hackers Target Swedish Power Grid Operator appeared first on SecurityWeek .
Memento Labs is reportedly resurfacing as a cyber threat actor linked to the legacy of Hacking Team, a notorious surveillance software vendor known for supplying governments with offensive cyber tools. While concrete technical details and active exploits are currently minimal, the campaign's reemergence signals potential renewed activity in targeted cyber espionage or surveillance operations. There is no evidence of widespread exploitation or public exploits at this time, and the threat appears to be in early stages of observation. European organizations, especially those in government, defense, and critical infrastructure sectors, should be vigilant given Hacking Team's historical targeting patterns. Mitigation should focus on enhanced monitoring for advanced persistent threat (APT) behaviors, network segmentation, and strict access controls. Countries with significant government and defense industries, such as Germany, France, Italy, and the UK, are likely to be primary targets. Given the medium severity and lack of active exploitation, the threat should be considered medium risk but monitored closely for escalation. Defenders should prioritize threat intelligence sharing and proactive detection capabilities to identify any emerging indicators of compromise related to Memento Labs.
Recent reports indicate a decline in ransomware profits as victims increasingly refuse to pay ransom demands. This trend suggests a shift in victim response strategies, potentially reducing the financial incentives for ransomware operators. Despite the drop in profits, ransomware remains a high-priority cybersecurity threat due to its disruptive nature and potential for data loss. European organizations, often targeted by ransomware, may experience changes in attack patterns or ransom negotiation dynamics. The threat does not involve a new vulnerability or exploit but reflects evolving attacker-victim interactions. Defenders should focus on strengthening incident response, backup strategies, and ransomware resilience. Countries with high ransomware incident rates and critical infrastructure reliance on digital systems are most at risk. The severity is assessed as high given ransomware's impact on confidentiality, integrity, and availability, even if exploitation ease varies. No direct technical exploit details are provided, but the ongoing ransomware threat landscape necessitates vigilance and proactive defense measures.
A data breach involving House Democrats’ Resume Bank DomeWatch has resulted in the leak of thousands of Capitol Hill job applicants' personal data. The exposed information likely includes sensitive personal details submitted during the application process for government positions. Although no active exploits are known, the breach poses risks related to identity theft, phishing, and reputational damage. The leak was reported via Reddit and covered by an external news source, indicating limited public discussion so far. European organizations are indirectly affected, mainly through potential targeting of applicants or affiliated entities. Mitigation involves enhanced data protection policies, monitoring for misuse of leaked data, and improving access controls on recruitment databases. Countries with strong ties to US government operations or with significant diplomatic presence in Washington, D. C.are more likely to be impacted. The severity is assessed as medium due to the sensitivity of the data and the potential for misuse, despite the lack of direct system compromise or active exploitation.
LeetAgent is a malware tool used by the ForumTroll APT group, which exploited a zero-day Chrome vulnerability to infect Russian organizations. The same tools were also used to distribute Dante, a sophisticated commercial spyware developed by Memento Labs (formerly HackingTeam). Dante features modular encrypted components and self-destructs if inactive. The attacks targeted media, government, educational, and financial sectors primarily in Russia and Belarus. No known exploits are currently active in the wild beyond these campaigns. Detection has been achieved through advanced XDR solutions, and threat intelligence is available via Kaspersky’s APT data service. European organizations face risks mainly if targeted by similar threat actors or if they share infrastructure or partnerships with affected regions. Mitigation requires patching browsers, monitoring for indicators of compromise, and employing advanced detection tools. Given the malware’s sophistication, modularity, and use of zero-days, the threat severity is assessed as high.
The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers. The post Massive China-Linked Smishing Campaign Leveraged 194,000 Domains appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .
Wordfence has blocked approximately 8.7 million attacks exploiting vulnerabilities in the outdated GutenKit and Hunk Companion WordPress plugins. These flaws, although old, continue to be targeted by attackers attempting to compromise WordPress sites. The attacks are widespread but do not currently have known active exploits in the wild beyond these blocked attempts. The vulnerabilities allow attackers to potentially execute unauthorized actions on affected sites, risking data confidentiality and site integrity. European organizations using these plugins remain at risk if they have not removed or patched these components. Mitigation involves removing these outdated plugins, applying any available patches, and employing robust web application firewalls like Wordfence. Countries with high WordPress usage and significant e-commerce or media sectors are more likely to be targeted. Given the scale of attacks and potential impact, the threat severity is assessed as high. Defenders should prioritize identifying and remediating these vulnerable plugins to prevent compromise.
Coveware has attributed the drop to large enterprises increasingly refusing to pay up and smaller amounts paid by mid-market firms. The post Ransomware Payments Dropped in Q3 2025: Analysis appeared first on SecurityWeek .
The Lazarus group is conducting a sophisticated malware campaign called DreamJobs, deploying modular loaders known as DreamLoaders to deliver various payloads. These loaders include a trojanized TightVNC client, DLL sideloaders such as TSVIPSrv.dll, and other components designed to stealthily extract administrator credentials. The malware authenticates to Microsoft tenants, retrieves SharePoint URLs, and loads encrypted payloads, leveraging legitimate system binaries and encrypted communications to evade detection. The campaign targets organizations’ administrative accounts to gain persistent access and exfiltrate sensitive data. The modular and flexible architecture of DreamLoaders allows the attackers to adapt payloads dynamically. No known exploits are publicly reported yet, but the campaign’s complexity and stealth techniques pose a significant threat. European organizations using Microsoft cloud services and remote administration tools like TightVNC are at risk. Mitigation requires advanced detection of sideloading and anomalous authentication behaviors. The threat is assessed as medium severity due to the need for initial access and the targeted nature of the attack.
The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks. The post Chrome Zero-Day Exploitation Linked to Hacking Team Spyware appeared first on SecurityWeek .
A Local File Inclusion (LFI) vulnerability exists in Traccar versions 5.8 through 6.8.1 on Windows systems due to Jetty's addPath method. This vulnerability allows unauthenticated attackers to read arbitrary files on the server by exploiting the way Jetty handles path additions. Although no known exploits are currently in the wild, the flaw can lead to sensitive information disclosure, potentially aiding further attacks. The vulnerability is specific to Windows environments and does not require authentication or user interaction, increasing its risk. European organizations using affected Traccar versions on Windows should prioritize mitigation. The threat is assessed as medium severity due to its impact on confidentiality and ease of exploitation. Countries with significant Traccar deployments and critical infrastructure monitoring are at higher risk.
