The ransomware group Qilin has been highly active in 2025, publishing over 40 victim cases per month on its leak site. Manufacturing, professional services, and wholesale trade are the most affected sectors. Attackers likely originate from Eastern Europe or Russian-speaking regions. They use tools like Cyberduck for data exfiltration and leverage notepad.exe and mspaint.exe to view sensitive information. The attack flow includes initial VPN access, reconnaissance, credential theft, lateral movement, and ransomware deployment. Two encryptors are often used: one spread via PsExec and another targeting network shares. The ransomware encrypts files, deletes backups, and leaves ransom notes. Persistence is achieved through scheduled tasks and registry modifications.
The Safepay ransomware group has claimed responsibility for a cyberattack targeting Xortec, a professional video surveillance provider. This incident involves unauthorized access and potential encryption or theft of sensitive surveillance data. Although detailed technical specifics and exploited vulnerabilities are not disclosed, the attack highlights risks to critical infrastructure providers. European organizations relying on Xortec's surveillance solutions could face operational disruptions and data confidentiality breaches. The ransomware nature of the attack suggests possible demands for ransom payments and risks of data exposure. Mitigation requires enhanced monitoring of network activity, strict access controls, and incident response readiness. Countries with significant deployments of Xortec products or critical infrastructure sectors are at higher risk. Given the medium severity rating and limited exploitation details, the threat is assessed as medium severity. Defenders should prioritize detection and containment strategies to minimize impact.
EDR-Redir is a technique that abuses Windows kernel components—specifically a Bind Filter driver (bindflt.sys) and the Windows Cloud Filter API (cldflt.sys)—to redirect or corrupt the working folder of Endpoint Detection and Response (EDR) software. By doing so, attackers can disrupt or disable the EDR's process services, effectively bypassing detection and response capabilities. This method does not require known exploits or published patches yet and has minimal public discussion, indicating it may be a novel or emerging technique. The attack targets the integrity and availability of EDR systems, potentially allowing attackers to operate undetected. While no active exploits are reported in the wild, the medium severity rating reflects the significant impact on security monitoring if successfully implemented. European organizations relying on Windows-based EDR solutions are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires advanced monitoring of kernel filter drivers, integrity checks on EDR folders, and restricting unauthorized driver installations. Countries with high adoption of Windows enterprise environments and advanced threat landscapes, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
The Russian agricultural regulatory agency Rosselkhoznadzor was targeted by a distributed denial-of-service (DDoS) attack, causing delays in food shipments across Russia. This attack disrupted the agency's online services, impacting its ability to process and manage food shipment logistics. Although no direct exploitation of software vulnerabilities was reported, the attack highlights the risk of service disruption to critical supply chain infrastructure. The attack's medium severity reflects its impact on availability rather than confidentiality or integrity. European organizations involved in agricultural trade or supply chains linked to Russia could face indirect effects such as delays or increased scrutiny. Mitigation should focus on enhancing DDoS resilience through traffic filtering, capacity scaling, and incident response planning. Countries with strong trade ties to Russia and significant agricultural sectors, such as Germany, Poland, and the Netherlands, are more likely to be affected. Given the attack's nature and impact, the suggested severity is medium due to the disruption of availability without evidence of data compromise or exploitation complexity.
Hackers are conducting mass attacks targeting outdated WordPress plugins, exploiting known vulnerabilities to compromise websites. These attacks leverage unpatched security flaws in widely used plugins, enabling attackers to potentially execute arbitrary code, inject malicious content, or gain unauthorized access. European organizations running WordPress sites with outdated plugins face increased risks of data breaches, website defacement, or service disruption. The threat is high severity due to the widespread use of WordPress across Europe and the ease of exploitation without requiring authentication. Mitigation requires immediate plugin updates, continuous vulnerability monitoring, and enhanced web application firewall rules tailored to WordPress plugin exploits. Countries with large digital economies and high WordPress adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the potential impact on confidentiality, integrity, and availability, and the ease of exploitation, the suggested severity is high. Defenders should prioritize patch management and proactive monitoring to reduce exposure to these mass exploitation attempts.
Lazarus has used fake job offers in attacks targeting companies developing UAV technology, for information theft. The post North Korean Hackers Aim at European Drone Companies appeared first on SecurityWeek .
At the Pwn2Own Ireland event, hackers earned over $1 million by discovering and exploiting 73 zero-day vulnerabilities across various software and hardware targets. These zero-days represent previously unknown security flaws that could be leveraged for unauthorized access, data theft, or system compromise. Although no known exploits are currently active in the wild, the sheer volume and diversity of vulnerabilities highlight significant security risks. European organizations using affected products should be vigilant, as attackers could weaponize these zero-days before patches are widely deployed. Mitigation requires timely patching once updates are released, enhanced monitoring for unusual activity, and applying defense-in-depth strategies. Countries with high technology adoption and critical infrastructure reliant on the targeted systems are at greater risk. Given the high impact potential and ease of exploitation demonstrated in controlled environments, the threat severity is assessed as high. Defenders must prioritize awareness and readiness to respond to emerging exploits stemming from these zero-days.
A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.
In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews. The post Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks appeared first on SecurityWeek .
A Chinese APT group named Jewelbug has expanded its operations to target organizations in South America, South Asia, Taiwan, and Russia. The group's recent intrusion into a Russian IT service provider lasted for five months in 2025, potentially aiming for a supply chain attack. Jewelbug has deployed new backdoors, including one leveraging Microsoft Graph API and OneDrive for command and control. The group's tactics include using legitimate tools, DLL sideloading, and the bring-your-own-vulnerable-driver technique. Notably, Jewelbug's targeting of Russian organizations marks a shift in Chinese cyber operations, previously considered to be allied with Russia.
Questions have been raised over the technical viability of the purported WhatsApp exploit, but the researcher says he wants to keep his identity private. The post Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta appeared first on SecurityWeek .
TransparentTribe, a Pakistani-linked threat actor, is conducting a cyber espionage campaign targeting Indian military organizations using DeskRAT, a Golang-based Remote Access Trojan. The attack begins with phishing emails containing links to malicious ZIP archives that deploy multi-stage payloads designed for Linux environments, specifically targeting the Indian government-endorsed BOSS operating system. DeskRAT establishes command and control over WebSocket connections and uses various persistence techniques to maintain access. The campaign leverages regional tensions and local protests to increase the likelihood of successful compromise. While primarily focused on Indian military targets, the malware's Linux focus and sophisticated evasion techniques highlight a targeted espionage effort. No known exploits or CVEs are associated with this malware yet, and the severity is assessed as medium. European organizations are not the primary target but could be indirectly impacted if geopolitical tensions escalate or if similar tactics are adopted against allied or related entities. Defenders should focus on phishing prevention, monitoring WebSocket traffic, and hardening Linux systems, especially those running government or military-grade OS variants.
The relationship between the Russian government and cybercriminal groups has evolved from passive tolerance. The post Russian Government Now Actively Managing Cybercrime Groups: Security Firm appeared first on SecurityWeek .
ESET researchers have uncovered a new instance of Operation DreamJob, a campaign attributed to the North Korea-aligned Lazarus group, targeting European defense companies involved in UAV technology. The attacks align with North Korea's efforts to enhance its drone program, likely aiming to steal proprietary information and manufacturing know-how. The campaign uses social engineering tactics, trojanized open-source projects, and deploys the ScoringMathTea RAT. The attackers' toolset includes various droppers, loaders, and downloaders, with a focus on UAV-related targets. This activity highlights the ongoing threat posed by Lazarus and North Korea's interest in advancing its drone capabilities through cyberespionage.
Agenda ransomware group, also known as Qilin, has been deploying a Linux-based ransomware binary on Windows hosts using legitimate remote management and file transfer tools. This cross-platform execution technique bypasses Windows-centric detections and security solutions. The attack chain includes the use of BYOVD for defense evasion, deployment of multiple SOCKS proxy instances for C&C traffic obfuscation, and targeted theft of backup credentials. Agenda has affected 591 victims across 58 countries since January 2025, primarily targeting organizations in developed markets and high-value industries. The group's sophisticated approach combines legitimate tools, cross-platform execution, and strategic targeting of backup infrastructure, making detection significantly more challenging for organizations.
Infostealers landscape exploded in 2024 and they remain a top threat today. If Windows remains a nice target (read: Attackers&#;x26;#;39; favorite), I spotted an Infostealer targeting Android devices. This sounds logical that attackers pay attention to our beloved mobile devices because all our life is stored on them.
The PhantomCaptcha RAT campaign targets aid organizations supporting Ukraine by deploying a Remote Access Trojan (RAT) to infiltrate their systems. This threat is associated with an advanced persistent threat (APT) actor, aiming to gather intelligence or disrupt operations. The attack leverages social engineering or phishing to deliver the RAT payload, enabling attackers to gain unauthorized access and control over victim machines. European aid groups involved in Ukraine support are at risk due to their direct involvement and potential exposure. The campaign is currently assessed as medium severity, with no known public exploits but significant operational impact potential. Mitigation requires targeted defenses including enhanced email filtering, endpoint detection, and strict access controls. Countries with strong ties to Ukraine aid efforts, such as Poland, Germany, and the Baltic states, are most likely to be affected. The threat poses a medium risk due to the need for user interaction and targeted nature but can lead to serious confidentiality and operational impacts if successful. Defenders should prioritize awareness training and network segmentation to limit the RAT's effectiveness.
