Threats affecting Poland

A critical vulnerability in Lanscope Endpoint Manager has been confirmed by CISA to be actively exploited in ongoing cyberattacks. Lanscope Endpoint Manager is an endpoint management solution used to monitor and control enterprise devices. The vulnerability allows attackers to potentially execute unauthorized actions on affected systems, posing a significant risk to confidentiality, integrity, and availability. Although specific technical details and affected versions are not disclosed, the critical severity indicates a high-impact flaw. European organizations using Lanscope Endpoint Manager are at risk, especially those in sectors with high endpoint management reliance. No official patches or CVSS score are currently available, but the threat is urgent. Mitigation should focus on immediate risk reduction, including network segmentation, monitoring for suspicious activity, and vendor engagement for updates. Countries with strong adoption of Lanscope products and critical infrastructure sectors are most likely to be targeted. The ease of exploitation and active attacks justify a suggested severity rating of critical. Defenders must prioritize detection and containment to prevent compromise.

News#infosecnews#redditGermany+9

A high-severity phishing campaign targets Ukraine aid groups using fake Zoom meeting invitations and weaponized PDF files. Attackers impersonate trusted contacts to lure victims into opening malicious PDFs that may deliver malware or steal credentials. This threat exploits the reliance on virtual meetings and document sharing in humanitarian operations. European organizations supporting Ukraine or involved in aid efforts are at risk of data breaches, operational disruption, and espionage. The campaign requires user interaction but does not require prior authentication, increasing its attack surface. No known exploits in the wild have been reported yet, but the threat remains credible due to its targeted nature. Defenders should focus on verifying meeting invitations, scanning attachments, and educating users on phishing tactics. Countries with strong ties to Ukraine and active humanitarian sectors are most likely to be affected. The suggested severity is high due to the potential impact on confidentiality and operational integrity combined with ease of exploitation through social engineering.

Phishing#infosecnews#redditPoland+7

The Iran-linked threat actor group MuddyWater has launched a global espionage campaign targeting over 100 organizations worldwide. This campaign focuses on intelligence gathering and is characterized by high-priority targeting of entities likely involved in sensitive sectors. Although specific technical details and exploited vulnerabilities are not disclosed, MuddyWater is known for using sophisticated tactics including spear-phishing and custom malware. The campaign poses significant risks to confidentiality and integrity of targeted organizations’ data. European organizations, especially those in critical infrastructure, government, and defense sectors, are at heightened risk due to their strategic value. Mitigation requires enhanced threat hunting, network monitoring for MuddyWater TTPs, and strict access controls. Countries with strong geopolitical ties or adversarial relations with Iran, and those with high adoption of targeted technologies, are more likely to be affected. Given the espionage nature, ease of exploitation is moderate but impact on confidentiality is high, warranting a high severity rating. Defenders should prioritize detection of MuddyWater indicators and implement proactive cyber threat intelligence sharing.

Campaign#infosecnews#redditGermany+9

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was a WebSocket RAT enabling remote command execution and data exfiltration. Despite six months of preparation, the attackers' infrastructure was only active for one day, indicating sophisticated planning and operational security. An additional mobile attack vector was discovered, using fake applications to collect data from Android devices. The campaign demonstrated extensive operational planning, compartmentalized infrastructure, and deliberate exposure control.

Malware#android#coldriverUkraine+6

A new Python-based Remote Access Trojan (RAT) named 'Nursultan Client' targets gamers by masquerading as a legitimate Minecraft client. It uses the Telegram Bot API for command and control, enabling attackers to capture screenshots, access webcams, steal Discord authentication tokens, open URLs, and perform system reconnaissance on Windows machines. Although it attempts persistence, its implementation has flaws. The malware's focus on Discord tokens and gaming users suggests a Malware-as-a-Service model, likely sold to other threat actors. No known exploits in the wild have been reported yet. The threat poses a medium severity risk but could escalate if customized versions improve persistence or evasion. European organizations with gaming communities or employees using Discord and Minecraft are at risk, especially in countries with high gaming engagement and Discord usage. Mitigation requires targeted detection of the fake client, monitoring Telegram API usage, and securing Discord tokens. Countries like Germany, France, the UK, and the Netherlands are most likely affected due to their large gaming populations and technology adoption. The threat is medium severity given its impact on confidentiality and moderate ease of exploitation without user interaction beyond initial infection.

Malware#discord#gamingGermany+5

The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.

Malware#remote command execution#rootkitGermany+9

Rival hacker groups have publicly exposed the alleged operators behind the Lumma Stealer malware, a threat known for stealing sensitive information from infected systems. This doxing event aims to undermine the operators by revealing their identities, potentially disrupting their activities. While the Lumma Stealer malware itself poses a medium-level threat due to its data theft capabilities, this particular incident is focused on the interpersonal conflict between threat actors rather than a new technical vulnerability or exploit. There are no known active exploits or new versions of the malware associated with this event. European organizations using systems vulnerable to information stealers like Lumma Stealer should remain vigilant, as such malware can compromise confidentiality and lead to data breaches. The doxing may lead to retaliatory attacks or shifts in threat actor tactics, increasing the risk landscape. Mitigation should focus on strengthening endpoint security, monitoring for indicators of compromise related to Lumma Stealer, and maintaining robust incident response capabilities. Countries with significant digital infrastructure and high usage of targeted platforms may be more exposed to risks stemming from Lumma Stealer infections and related threat actor activity. Given the medium severity of the malware and the nature of this event, the overall threat level is assessed as medium. Defenders should prioritize detection and prevention of Lumma Stealer infections while monitoring threat actor developments.

Malware#infosecnews#redditGermany+6

Yesterday, Chinese security services published a story alleging a multi-year attack against the systems operating the Chinese standard time (CST), sometimes called Beijing Standard Time. China uses only one time zone across the country, and has not used daylight saving time since 1991. Most operating systems use UTC internally and display local time zones for user convenience. Modern operating systems use NTP to synchronize time. Popular implementations are ntpd and chrony. The client will poll several servers, disregard outliers, and usually sync with the "best" time server based on latency and jitter detected.

News#localGermany+7

Star Blizzard started using the NoRobot (BaitSwitch) and MaybeRobot (SimpleFix) malware after public reporting on the LostKeys malware. The post Russian APT Switches to New Backdoor After Malware Exposed by Researchers appeared first on SecurityWeek .

MalwareGermanyFrance+8

Jewett-Cameron Company says hackers stole sensitive information and are threatening to release it unless a ransom is paid. The post Fencing and Pet Company Jewett-Cameron Hit by Ransomware appeared first on SecurityWeek .

MalwareGermanyFrance+5

Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+9

The Brazilian Caminho loader is a sophisticated malware delivery mechanism active since March 2025, leveraging LSB steganography to hide . NET payloads within images hosted on legitimate platforms. It initiates infection via phishing emails containing malicious scripts that download these steganographic images. The loader executes payloads filelessly in memory and establishes persistence using scheduled tasks. Caminho operates as a Loader-as-a-Service, delivering multiple malware families such as Remcos RAT, Xworm, and Katz stealer across South America, Africa, and Eastern Europe. Its use of bulletproof hosting and Portuguese language artifacts indicates a Brazilian origin and professional operation. The campaign targets multiple industries opportunistically without a specific sector focus. The infection chain employs multiple advanced techniques including fileless execution, steganography, and obfuscation, complicating detection and mitigation efforts. European organizations, especially in Eastern Europe, face risks of data theft, espionage, and system compromise. Mitigation requires targeted email security, memory scanning, and monitoring of scheduled tasks for persistence.

Malware#africa#eastern europePoland+7

Salt Typhoon is an advanced persistent threat (APT) group identified as targeting global telecommunications and energy sectors. The campaign was recently reported by Darktrace and highlighted in infosec news sources. While specific technical details and indicators of compromise are limited, the group’s focus on critical infrastructure sectors suggests a strategic intent to disrupt or gather intelligence from vital services. The threat is assessed as medium severity due to the lack of known exploits in the wild and minimal public technical details, but the potential impact on confidentiality and availability in critical sectors remains significant. European telecom and energy organizations are at risk given the continent's reliance on these sectors for economic stability and national security. Mitigation should focus on enhanced network monitoring, anomaly detection, and threat hunting tailored to APT behaviors. Countries with large telecom and energy infrastructures, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium severity, organizations should prioritize proactive defense measures and incident response readiness to mitigate potential disruptions or espionage activities.

Campaign#infosecnews#redditGermany+6

The PolarEdge botnet campaign targets routers from Cisco, ASUS, QNAP, and Synology to expand its network of compromised devices. This campaign leverages vulnerabilities or weak configurations in these widely used routers to enlist them into a botnet, potentially enabling large-scale distributed denial-of-service (DDoS) attacks, data interception, or further lateral movement. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the critical role these devices play in network infrastructure. European organizations using these brands are at risk, especially those with less stringent router security practices. The campaign's expansion highlights the ongoing threat posed by botnets exploiting IoT and network edge devices. Defenders should focus on hardening router configurations, applying firmware updates, and monitoring network traffic for anomalies. Countries with high adoption of these router brands and significant digital infrastructure are more likely to be targeted. Immediate mitigation steps can reduce the risk of compromise and limit the botnet's growth.

Campaign#infosecnews#redditGermany+9

Russian threat actors have evolved a malware campaign that leverages fake "I am not a robot" CAPTCHA prompts to deliver malicious payloads. This technique abuses user trust in CAPTCHA interfaces to trick victims into executing malware, potentially leading to system compromise. The malware is associated with advanced persistent threat (APT) groups and represents a high-severity risk due to its social engineering vector and stealthy delivery. Although no known exploits are currently active in the wild, the campaign's sophistication and targeting suggest a significant threat to organizations, especially those with high user interaction and web-facing services. European organizations are at risk given the widespread use of CAPTCHA mechanisms and the geopolitical focus on this region. Mitigation requires enhanced user awareness, web filtering, and endpoint detection tuned to identify unusual CAPTCHA-related behaviors. Countries with large digital economies and critical infrastructure in Europe are most likely targets. The threat is assessed as high severity due to the potential for confidentiality breaches, ease of exploitation via social engineering, and the broad scope of affected systems without requiring prior authentication or complex user interaction beyond clicking a fake CAPTCHA.

Malware#infosecnews#redditGermany+9

GlassWorm is a groundbreaking self-propagating worm targeting VS Code extensions on OpenVSX marketplace. It employs invisible Unicode characters to conceal malicious code and utilizes a blockchain-based command and control infrastructure on Solana. The worm compromised seven OpenVSX extensions with 35,800 downloads, harvesting NPM, GitHub, and Git credentials, targeting cryptocurrency wallets, deploying SOCKS proxy servers, and installing hidden VNC servers. It spreads exponentially through the developer ecosystem using stolen credentials. The worm employs a triple-layer C2 setup involving Solana blockchain, direct IP connection, and Google Calendar. A new infected extension was also detected in Microsoft's VSCode marketplace. The campaign remains active, necessitating immediate security measures and audits of installed extensions.

Malware#self-propagating#vscodeFrance+7

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

Campaign#microsoft impersonation#browser manipulationGermany+9

Attackers are leveraging TikTok videos to distribute malware by masquerading as free software activations. The campaign uses social engineering to convince users to run malicious PowerShell scripts that download additional payloads, including the AuroStealer information stealer. Persistence is established via scheduled tasks, and one payload uses a self-compiling technique to inject shellcode directly into memory, evading detection. Multiple TikTok videos target various software products, employing the ClickFix technique to increase user trust. This threat exploits user interaction and social engineering on a popular platform, posing a medium risk due to its potential to compromise confidentiality and integrity. European organizations with users active on TikTok and those using targeted software products are at risk. Mitigations include user education, PowerShell execution restrictions, monitoring scheduled tasks, and blocking malicious domains. Countries with high TikTok usage and significant software user bases, such as Germany, France, and the UK, are more likely to be affected.

Malware#scheduled tasks#self-compilingGermany+7

The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting Windows Server machines primarily in government, financial, and industrial sectors across Asia, Africa, and Latin America. Attackers gain initial access by exploiting SQL servers and deploy custom implants such as Neursite and NeuralExecutor. These implants employ advanced persistence, evasion, and command execution techniques, using a multi-stage loading process and diverse communication protocols for command and control (C2). Although attribution is uncertain, indicators suggest possible links to Chinese-speaking threat actors. The campaign highlights the critical need for robust server security and continuous monitoring to detect complex multi-stage intrusions. No known exploits are currently in the wild, and the campaign is rated medium severity. The focus on Windows Server environments and SQL exploitation techniques underscores the risk to organizations relying on these technologies.

Malware#cyberespionage#multi-stage loadingGermany+9

A threat actor has been infecting servers of high-profile entities with backdoors to exfiltrate information and deploy additional payloads. The post Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign appeared first on SecurityWeek .

MalwareGermanyFrance+8