LinkPro is a newly discovered Linux rootkit that leverages eBPF (extended Berkeley Packet Filter) technology to stealthily hide its presence on infected systems. It activates upon receiving specially crafted 'magic' TCP packets, allowing attackers to control compromised hosts covertly. This rootkit's use of eBPF, a legitimate kernel feature, makes detection challenging as it operates at a low level within the Linux kernel. Although no known exploits are currently reported in the wild, the rootkit's capabilities pose a significant risk to Linux-based infrastructure. European organizations relying on Linux servers, especially those exposed to external networks, could be targeted. The rootkit threatens system confidentiality, integrity, and availability by enabling persistent unauthorized access and potential data exfiltration or sabotage. Mitigation requires advanced monitoring of eBPF programs, network traffic analysis for anomalous TCP packets, and strict kernel security policies. Countries with high Linux adoption in critical sectors and strategic geopolitical relevance are more likely to be affected. Given its stealth, activation method, and potential impact, this threat is assessed as high severity. Defenders should prioritize detection and containment strategies tailored to eBPF misuse and network-based triggers.
The tech giant attributed the attacks to Vanilla Tempest, also known as Vice Spider and Vice Society. The post Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign appeared first on SecurityWeek .
Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in Windows. We promptly reported this issue to Microsoft and they fixed the vulnerability starting with OS Build 26100.4202 in the KB5058499 update preview released on May 28th 2025. In the following sections, we […] The post Denial of Fuzzing: Rust in the Windows kernel appeared first on Check Point Research .
PostgreSQL 13 reached its end of life (EOL) status, meaning it will no longer receive security updates or patches from the maintainers. Organizations continuing to use PostgreSQL 13 beyond its EOL date risk exposure to unpatched vulnerabilities that could compromise data confidentiality, integrity, and availability. This situation is particularly relevant for European organizations relying on PostgreSQL 13 in critical applications. Without updates, attackers may exploit known or newly discovered vulnerabilities, increasing the risk of data breaches or service disruptions. Mitigation requires timely upgrading to supported PostgreSQL versions and implementing compensating controls such as enhanced monitoring and network segmentation. Countries with significant PostgreSQL adoption and critical infrastructure relying on this database are at higher risk. Given the lack of direct exploits currently in the wild but the potential for future exploitation, the threat severity is assessed as medium. Defenders should prioritize migration planning and risk assessment to avoid exposure after PostgreSQL 13's EOL.
A new tech support scam is leveraging the Microsoft logo to create a fake browser lock screen, tricking users into believing their system is compromised. This phishing attack aims to steal sensitive data by convincing victims to contact fraudulent support services. The scam does not exploit software vulnerabilities but relies on social engineering and visual deception. It has been recently reported on Reddit and covered by hackread.com, indicating emerging awareness but minimal current discussion or exploitation. European organizations and users are at risk due to the widespread use of Microsoft products and browsers. The scam's impact includes potential data theft, financial loss, and reputational damage. Mitigation requires user education, browser security enhancements, and blocking known scam domains. Countries with high Microsoft product adoption and significant digital infrastructure are most likely to be targeted. Given the ease of exploitation and potential data compromise without technical exploitation, the threat severity is assessed as medium.
Threat actors are exploiting CVE-2025-20352, a recent Cisco zero-day, to deploy a rootkit on older networking devices. The post Cisco Routers Hacked for Rootkit Deployment appeared first on SecurityWeek .
Famous Chollima, a North Korean threat group, has deployed a new malware campaign targeting job seekers by impersonating hiring organizations. The attack involves a trojanized Node.js application named 'Chessfi' and uses evolving malware tools BeaverTail and OtterCookie, which now include keylogging and screenshot capabilities. A malicious Visual Studio Code extension embedding these tools was also discovered, indicating new infection vectors. The malware steals cryptocurrency credentials by targeting multiple browsers and wallet extensions, and it can upload files from compromised systems. This campaign leverages social engineering and developer tools to infiltrate victims, focusing on cryptocurrency theft and credential harvesting. The threat is medium severity due to its broad capabilities and stealth but requires user interaction for infection. European organizations involved in software development, cryptocurrency, and job recruitment are at particular risk.
Microsoft's October 2025 Patch Tuesday addresses 175 vulnerabilities, including three zero-day flaws. While no known exploits are currently reported in the wild, these zero-days represent significant security risks if left unpatched. The update covers a broad range of Microsoft products, potentially affecting many organizations globally. European entities relying on Microsoft technologies should prioritize timely patching to mitigate risks of exploitation. The medium severity rating reflects the broad impact but currently limited exploitation evidence. Attackers could leverage these vulnerabilities to compromise confidentiality, integrity, or availability of systems. No detailed technical specifics or affected versions are provided, limiting precise risk assessment. Organizations should monitor for further technical disclosures and threat intelligence updates. Proactive patch management and vulnerability scanning remain critical defenses. Countries with high Microsoft usage and strategic digital infrastructure are most at risk.
The "BlackSuit Blitz" is a ransomware attack campaign targeting a global equipment manufacturer, as detailed by Palo Alto Networks' Unit 42. This malware campaign involves sophisticated tactics to infiltrate corporate networks and encrypt critical data, disrupting operations. Although the attack is rated medium severity and no known exploits are currently in the wild, the threat demonstrates the potential for significant operational impact. European organizations in manufacturing and critical infrastructure sectors could be at risk due to the global nature of the targeted industry. The attack does not require known vulnerabilities or specific affected software versions, indicating a possible use of social engineering or credential compromise. Mitigation requires enhanced network segmentation, proactive threat hunting, and employee awareness training tailored to ransomware tactics. Countries with strong manufacturing bases and critical infrastructure, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the medium severity, the attack poses a moderate risk to confidentiality, integrity, and availability, with exploitation complexity likely moderate and no indication of user interaction requirements. Defenders should prioritize detection of lateral movement and ransomware behaviors and implement robust backup and recovery strategies.
Two critical vulnerabilities with CVSS scores of 10.0 have been discovered in Red Lion Remote Terminal Units (RTUs), which are widely used in industrial control systems (ICS). These bugs could allow attackers to gain full control over affected RTUs, potentially compromising industrial processes and critical infrastructure. Although no known exploits are currently in the wild, the severity and potential impact of these flaws are extremely high. The vulnerabilities could lead to unauthorized remote access, manipulation of control commands, and disruption of industrial operations. European organizations relying on Red Lion RTUs in sectors such as energy, manufacturing, and utilities are at significant risk. Immediate mitigation steps include applying vendor patches once available, segmenting ICS networks, and enhancing monitoring for unusual activity. Countries with substantial industrial infrastructure and critical ICS deployments, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation and the critical nature of the impact, the suggested severity is critical. Defenders must prioritize identifying affected devices and implementing compensating controls to prevent potential industrial sabotage or operational disruption.
For a while, clipboard content has been monitored by many infostealers. Purposes can be multiple, like simply searching and exfiltrating juicy data or on-the-fly modification like crypto-wallet swapping&#;x26;#;x5b;1&#;x26;#;x5d;. Note that the clipboard is a major risk when you don&#;x26;#;39;t disable clipboard sharing between your virtual machines and hosts. A malware running in a sandbox will access your (host) clipboard without problem!
A large-scale botnet comprising approximately 100,000 nodes is conducting widespread attacks targeting Remote Desktop Protocol (RDP) services. These attacks aim to exploit exposed or weakly secured RDP endpoints to gain unauthorized access. Although no specific affected software versions or exploits have been identified, the botnet's scale and focus on RDP services pose a significant risk to organizations relying on remote desktop access. The threat is currently assessed as medium severity, with no known exploits in the wild yet. European organizations with exposed RDP services are at risk of brute-force or credential-stuffing attacks, potentially leading to unauthorized access, data breaches, or ransomware deployment. Mitigation requires immediate hardening of RDP endpoints, including enforcing strong authentication, network-level restrictions, and continuous monitoring. Countries with high RDP usage in critical infrastructure and enterprise environments, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected. Given the ease of exploitation and potential impact on confidentiality and availability, the suggested severity is high. Defenders should prioritize securing RDP access and monitoring for unusual login attempts to prevent compromise.
A newly discovered Android vulnerability, dubbed 'Pixnapping,' allows malicious apps to steal two-factor authentication (2FA) codes without requiring any special permissions. This flaw exploits a weakness in how Android handles screen content or notifications, enabling rogue applications to capture sensitive 2FA codes silently. Although no known exploits are currently in the wild, the high severity rating indicates significant risk if weaponized. European organizations relying on Android devices for 2FA could face increased risks of account compromise and unauthorized access. Mitigation requires immediate attention to app vetting, restricting app sources, and monitoring for suspicious app behavior. Countries with high Android usage and critical infrastructure reliant on 2FA are most vulnerable. The threat is assessed as high severity due to the potential confidentiality breach, ease of exploitation without permissions, and broad impact scope. Defenders should prioritize patching once available and enhance multi-layered authentication security measures.
Chinese threat actors have exploited a geo-mapping tool to maintain persistent access within targeted environments for over a year. This abuse leverages the legitimate functionality of the geo-mapping software to evade detection and sustain long-term presence. The threat is characterized by stealthy operations, making it difficult for defenders to identify and remove the adversary. While no known exploits are currently active in the wild, the persistence mechanism poses a significant risk to confidentiality and integrity of affected systems. European organizations using similar geo-mapping tools or related infrastructure could be targeted, especially those in strategic sectors. Mitigation requires focused monitoring of geo-mapping tool usage, anomaly detection, and strict access controls. Countries with high adoption of such tools and geopolitical relevance to China are at greater risk. The threat is assessed as high severity due to the potential for prolonged undetected compromise and sensitive data exposure.
Hackers have posted over 1 Tb of information allegedly stolen from Harvard on the Cl0p data leak website. The post Harvard Is First Confirmed Victim of Oracle EBS Zero-Day Hack appeared first on SecurityWeek .
Users can continue receiving important security updates for Windows 10 by enrolling in the ESU program. The post Windows 10 Still on Over 40% of Devices as It Reaches End of Support appeared first on SecurityWeek .
Oracle has released an emergency patch addressing a critical security flaw in its E-Business Suite. Although specific technical details about the vulnerability are not disclosed, the severity is rated critical, indicating a high risk of exploitation. No known exploits are currently reported in the wild, but the urgency of the patch suggests potential for significant impact if left unpatched. European organizations using Oracle E-Business Suite should prioritize applying this patch to prevent possible compromise. The flaw could affect confidentiality, integrity, and availability of enterprise resource planning data and processes. Countries with a high adoption of Oracle E-Business Suite and significant enterprise infrastructure are most at risk. Immediate mitigation involves deploying the official patch and reviewing access controls and monitoring for suspicious activity. Given the critical nature and potential for broad impact, this vulnerability demands swift action to avoid operational disruption or data breaches.
A large-scale botnet originating from multiple countries is actively targeting Remote Desktop Protocol (RDP) services primarily in the United States. The botnet attempts to exploit exposed or weakly secured RDP endpoints to gain unauthorized access, potentially enabling further malicious activities such as ransomware deployment or lateral movement. Although currently focused on the US, the widespread use of RDP in Europe makes European organizations vulnerable to similar attacks. The threat is classified as high severity due to the critical nature of RDP services and the potential for significant operational disruption. No known exploits or patches are currently associated with this botnet, and minimal public technical details are available. Defenders should prioritize securing RDP access through strong authentication, network segmentation, and monitoring for unusual login attempts. European countries with high RDP usage and critical infrastructure sectors are at increased risk. This threat underscores the ongoing risk posed by exposed RDP services and the need for proactive defense measures.
Unity Technologies’s SpeedTree website was compromised, resulting in the theft of customer payment data. This breach exposes sensitive financial information of users who interacted with the SpeedTree platform. Although no specific technical details or exploited vulnerabilities have been disclosed, the incident highlights risks associated with third-party software vendors. The breach is rated as high severity due to the sensitivity of stolen data and potential for fraud or identity theft. European organizations using SpeedTree or related Unity services should be vigilant about potential follow-on attacks or fraud attempts. Mitigation involves monitoring payment systems, enhancing incident detection, and reviewing third-party security postures. Countries with significant game development industries or large Unity user bases, such as Germany, France, and the UK, are likely more affected. The threat does not require user interaction for exploitation but depends on the attacker’s ability to breach the website. Overall, this incident underscores the importance of securing vendor platforms that handle payment data.
