Windows 11 23H2 is approaching its end of life (EOL), meaning Microsoft will cease providing security updates and patches for this version after the designated date. Organizations continuing to use this version post-EOL will be exposed to unpatched vulnerabilities, increasing their risk of compromise. Although no specific exploits are currently known in the wild targeting this EOL, the lack of security updates inherently raises the threat level. European organizations relying on Windows 11 23H2 should plan timely upgrades to supported versions to maintain security posture. Failure to upgrade may lead to increased exposure to malware, ransomware, and other cyberattacks exploiting unpatched vulnerabilities. The impact is particularly significant for sectors with strict compliance requirements and critical infrastructure. Countries with high Windows 11 adoption and strong digital economies are at greater risk. Proactive asset management and patching strategies are essential to mitigate risks associated with this EOL. This threat is assessed as medium severity due to the indirect nature of the risk and absence of active exploits.
COLDRIVER, a Russian state-sponsored threat group, swiftly shifted operations after their LOSTKEYS malware was exposed in May 2025. They developed new malware families, including NOROBOT, YESROBOT, and MAYBEROBOT, within days. The infection chain begins with a COLDCOPY lure disguised as a CAPTCHA, leading to the deployment of NOROBOT, a DLL that retrieves subsequent stages. YESROBOT, a Python backdoor, was briefly used before being replaced by MAYBEROBOT, a more flexible PowerShell backdoor. The malware chain has undergone constant evolution, with COLDRIVER focusing on evading detection while maintaining intelligence collection capabilities against high-value targets. The group's tactics include using HTTPS for command retrieval, encrypting commands, and implementing various evasion techniques.
The Russian Lynk group has leaked sensitive files from the UK Ministry of Defence (MoD), including detailed information on eight military bases. This data breach represents a significant compromise of confidential military information, potentially exposing critical infrastructure and operational details. The leak was reported via a Reddit InfoSec news post linking to an external article, with minimal public discussion so far. Although no specific technical exploitation details or affected software versions are provided, the leak's nature suggests a targeted campaign against UK defense assets. The breach poses a high risk to confidentiality and national security, with potential ramifications for allied European countries. Immediate mitigation involves reviewing access controls, enhancing monitoring for related threat actor activity, and conducting thorough incident response. European countries with close military cooperation with the UK or shared defense infrastructure are most likely to be affected. Given the sensitivity and potential impact, this threat is assessed as high severity despite the absence of a CVSS score.
The GlassWorm malware is a self-spreading malicious software targeting OpenVSX and VS Code extension registries. It propagates by infecting extensions within these registries, potentially compromising developers and users who download affected extensions. This malware can lead to unauthorized code execution, data theft, and supply chain compromise. European organizations relying on VS Code and OpenVSX for software development are at risk of indirect infection through compromised extensions. The malware's self-spreading nature increases the risk of rapid proliferation across development environments. Mitigation requires rigorous extension vetting, monitoring for unusual extension behavior, and restricting extension installation policies. Countries with significant software development sectors and high adoption of VS Code and OpenVSX, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and integrity, ease of spread, and no need for user interaction beyond extension installation, the threat severity is assessed as high.
This report discusses a technique to tunnel WireGuard VPN traffic over HTTPS using Wstunnel to bypass network restrictions that block VPN protocols including WireGuard. The method leverages HTTPS, which is less frequently blocked, to encapsulate WireGuard packets, enabling VPN connectivity in restrictive environments. While not a vulnerability or exploit, this technique can be used by threat actors to evade detection or censorship. There are no known exploits in the wild associated with this method, and it primarily represents a network evasion tactic rather than a direct security threat. European organizations may face challenges if their network monitoring or filtering relies on blocking VPN protocols, as this tunneling approach can circumvent such controls. Mitigation requires advanced network inspection capabilities and policy adjustments to detect tunneled VPN traffic over HTTPS. Countries with high VPN usage and strict network controls, such as Russia and Belarus, or those with advanced cybersecurity monitoring, like Germany and France, are more likely to be impacted. Given the medium severity assigned and the nature of the technique, the overall threat level is medium, reflecting moderate risk due to potential evasion of network defenses without direct exploitation of vulnerabilities.
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source […] The post 20th October – Threat Intelligence Report appeared first on Check Point Research .
DefenderWrite is a security threat involving the abuse of whitelisted programs to perform arbitrary write operations into the operating folder of antivirus software. This technique leverages trusted, whitelisted executables to bypass security controls and modify antivirus files or configurations, potentially undermining the antivirus's integrity and effectiveness. Although no known exploits are currently in the wild, the threat poses a medium severity risk due to its potential to compromise endpoint security. European organizations relying on affected antivirus solutions could face risks to system integrity and detection capabilities. Mitigation requires strict application control policies, monitoring of write operations to antivirus directories, and enhanced endpoint detection rules. Countries with high adoption of targeted antivirus products and critical infrastructure sectors are more likely to be affected. Given the medium severity, the threat demands proactive defensive measures to prevent exploitation. Defenders should prioritize detection of anomalous write behaviors by whitelisted processes and enforce least privilege principles on antivirus folders.
A new . NET-based backdoor leveraging Windows Cryptographic API (CAPI) has been identified targeting Russian automotive and e-commerce companies. The malware is distributed via phishing emails containing ZIP attachments, which when opened, deploy the backdoor enabling remote code execution (RCE). Although currently focused on Russian firms, the technique and malware could potentially spread to other regions. The backdoor abuses . NET capabilities and CAPI functions to evade detection and maintain persistence. No known public exploits or patches exist yet, and the threat is considered high severity due to its RCE capabilities and targeted nature. European organizations with business ties or supply chains linked to Russian auto or e-commerce sectors should be vigilant. Mitigation requires enhanced email filtering, user training against phishing, and monitoring for unusual . NET process behavior and cryptographic API usage.
Microsoft has addressed a critical security vulnerability in ASP. NET Core, described as the highest-severity flaw ever found in this framework. Although specific technical details and affected versions are not disclosed, the flaw is rated high severity and has not yet been exploited in the wild. ASP. NET Core is widely used for building web applications and APIs, making this vulnerability significant for organizations relying on Microsoft web technologies. European organizations using ASP. NET Core could face risks to confidentiality, integrity, and availability if the flaw is exploited. Immediate patching is essential once updates are available. Mitigation should include prioritizing patch deployment, monitoring for suspicious activity, and reviewing application security configurations. Countries with strong Microsoft technology adoption and critical infrastructure relying on ASP.
Attackers are everywhere! They try to abuse victims using new communication channels and social engineering techniques! Somebody pointed my to the following Tik-Tok video: hxxps://vm[.]tiktok[.]com/ZGdaCkbEF/.
The U.S.is the top target for cyberattacks, with criminals and foreign adversaries targeting companies, governments and organizations. The post Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US appeared first on SecurityWeek .
A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.
Hidden links are a Black Hat SEO technique where attackers inject invisible HTML blocks containing links to unrelated, often malicious or adult-themed websites into compromised websites. This manipulation harms the website's reputation, degrades search engine rankings, and can lead to legal and trust issues. Attackers typically exploit vulnerabilities in content management systems (CMS) or compromise administrator accounts to insert these hidden links. Detection involves thorough website content audits and monitoring for unauthorized changes. Mitigation requires using licensed CMS solutions, timely software updates, strong authentication, and continuous security monitoring. Although this threat does not directly compromise data confidentiality or availability, it impacts website integrity and business reputation. European organizations with public-facing websites, especially those relying heavily on organic search traffic, are at risk. Countries with high CMS adoption and significant e-commerce or digital presence are more likely to be targeted. The suggested severity is medium due to the moderate impact on integrity and reputation, ease of exploitation via common CMS vulnerabilities, and no direct data breach or service disruption involved.
A malicious npm package named 'https-proxy-utils' was discovered containing a post-install script that downloads and executes the AdaptixC2 post-exploitation framework agent. The package impersonated legitimate utilities and cloned functionality to evade detection. It targets Windows, Linux, and macOS platforms with tailored payload delivery methods. Once installed, the AdaptixC2 agent enables remote access, command execution, and persistence, posing significant risks to affected systems. This incident exemplifies the increasing abuse of open-source software supply chains as attack vectors. No known exploits in the wild have been reported yet, but the threat remains active and multi-platform. The malicious infrastructure is hosted on the domain cloudcenter.top, which serves payloads for different OS architectures. European organizations relying on npm packages for development or deployment are at risk, especially those with mixed OS environments. Mitigation requires vigilant package vetting, monitoring for suspicious post-install scripts, and network controls to block malicious domains.
Attackers are embedding blocks of links that lead to porn sites, online casinos, and the like. We explain their objective, and how to protect your website.
Microsoft has revoked 200 fraudulent digital certificates that were used in the Rhysida ransomware campaign. These certificates were exploited by attackers to sign malicious payloads, helping them evade detection and appear legitimate. The revocation disrupts the attackers' ability to use these certificates for code signing, thereby mitigating part of the threat. The Rhysida ransomware campaign remains a high-severity threat due to its use of trusted certificates to facilitate malware distribution. European organizations, especially those with high reliance on Microsoft ecosystems and critical infrastructure, could be targeted. The campaign highlights the ongoing risk of certificate-based trust abuse in ransomware operations. Defenders should prioritize monitoring for suspicious signed binaries and ensure robust certificate validation processes. Countries with significant Microsoft product usage and critical infrastructure sectors are at elevated risk. Immediate mitigation includes updating certificate revocation lists and enhancing endpoint detection capabilities to identify signed malware. The threat is assessed as high severity given the impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted certificates and no need for user interaction once infection vectors are triggered.
This threat report highlights ransomware attacks disproportionately impacting small businesses, emphasizing both financial and psychological damage. It details a new malware campaign by the North Korean group Famous Chollima, which targets job seekers with trojanized applications to steal credentials and cryptocurrency. The campaign employs multiple tactics including credential dumping, phishing, and malware execution techniques. The report stresses the importance of empathetic leadership and comprehensive incident response plans that address technical and human factors. Indicators include multiple malware hashes linked to this campaign. The threat is medium severity due to its targeted nature, impact on confidentiality and availability, and the exploitation complexity. European small businesses, especially those with limited cybersecurity resources, are at heightened risk. Mitigation requires tailored incident response, user awareness focused on job seeker scams, and credential protection strategies. Countries with significant small business sectors and exposure to North Korean threat activity are most likely affected.
UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.
A phishing campaign is impersonating LastPass by sending scam emails with alarming subjects like 'We Have Been Hacked' to trick users into clicking malicious links. These links lead to fake websites hosted on domains such as lastpassdesktop.com, designed to steal credentials and secret keys, potentially compromising users' password vaults. LastPass has confirmed it has not been breached and is actively working with partners like Cloudflare to take down these fraudulent domains and warn users. Similar phishing attacks have targeted other password managers, increasing the risk to users relying on these services. The campaign leverages social engineering tactics to create urgency and exploit trust in the LastPass brand. No direct system vulnerabilities are exploited, but the threat targets user credentials through deception. European organizations using LastPass or similar password managers are at risk of credential theft if users fall for these scams. Mitigation requires user education, domain blocking, and enhanced email filtering to detect and prevent phishing attempts.
The China-linked advanced persistent threat (APT) group known as Jewelbug has conducted a rare cross-nation cyberattack targeting a Russian IT provider. This campaign represents an unusual geopolitical targeting pattern, as it involves a Chinese APT focusing on a Russian entity. The attack is characterized by medium severity, with no known exploits in the wild or publicly disclosed technical details. The campaign was reported recently and is considered newsworthy due to its geopolitical implications and the involvement of a sophisticated threat actor. There are no specific affected software versions or vulnerabilities disclosed, and the attack details remain limited. European organizations should be aware of potential indirect impacts, especially those with ties to Russian IT infrastructure or supply chains. Mitigation should focus on enhanced monitoring for APT tactics, supply chain security, and cross-border intelligence sharing. Countries with significant IT service dependencies on Russian providers or geopolitical interest in Sino-Russian relations are more likely to be affected. Given the medium severity and limited technical details, the threat requires vigilance but does not currently indicate an immediate critical risk to European entities.
