The RondoDox botnet is a newly identified threat that weaponizes over 50 vulnerabilities spanning more than 30 different vendors. This botnet leverages a broad attack surface by exploiting multiple flaws, potentially enabling widespread compromise of diverse systems. Although no known exploits are currently observed in the wild, the high severity rating indicates significant risk if weaponized. European organizations face heightened exposure due to the extensive vendor ecosystem and the critical infrastructure that may rely on affected products. The botnet's multi-vendor approach complicates detection and mitigation, increasing the likelihood of successful infiltration and persistence. Defenders should prioritize comprehensive vulnerability management, including cross-vendor patching and network segmentation. Countries with high technology adoption and critical infrastructure reliance on diverse vendors, such as Germany, France, and the UK, are particularly at risk. Given the complexity and scale of this threat, the suggested severity is high, reflecting the potential for extensive confidentiality, integrity, and availability impacts without requiring user interaction. Immediate attention to vendor advisories and proactive threat hunting is essential to mitigate this emerging botnet threat.
The video game software development company says the incident impacted users of its SpeedTree website. The post Malicious Code on Unity Website Skims Information From Hundreds of Customers appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 13th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Qilin ransomware group has claimed responsibility for targeting Asahi, Japan’s largest brewing company, that had been hacked on September 29th. The attack resulted in the exfiltration of over 9,300 files totaling 27GB […] The post 13th October – Threat Intelligence Report appeared first on Check Point Research .
A phishing campaign using fake 'Inflation Refund' text messages is targeting New Yorkers, attempting to deceive recipients into revealing sensitive information or installing malware. The scam exploits current economic concerns to lure victims with promises of financial relief. Although primarily reported in New York, the tactic could potentially spread to other regions. The attack does not require prior authentication but relies on user interaction to succeed. There are no known exploits in the wild beyond the phishing messages themselves. The threat poses a high risk due to potential financial loss and identity theft. European organizations should be aware of similar scams exploiting economic anxieties. Mitigation requires user education, robust SMS filtering, and verification procedures for unsolicited financial communications. Countries with significant US financial or diaspora connections may be more exposed. Overall, the threat severity is assessed as high due to its social engineering effectiveness and potential impact on confidentiality and financial integrity.
IAmAntimalware is a newly reported technique involving the injection of malicious code into antivirus software, potentially allowing attackers to bypass security defenses. The threat was recently discussed on Reddit's NetSec community and linked to an external source, but currently lacks detailed technical disclosures, known exploits, or affected product versions. Although the severity is assessed as medium, the ability to compromise antivirus software could have significant implications for system integrity and trustworthiness. European organizations relying heavily on antivirus solutions may face risks of stealthy malware persistence and evasion. Mitigation requires enhanced monitoring of antivirus processes, integrity verification, and strict application control policies. Countries with large enterprise sectors and high adoption of popular antivirus products are more likely to be impacted. Given the limited public details and no known active exploitation, the suggested severity is medium. Defenders should prioritize awareness and proactive validation of antivirus software integrity to mitigate potential risks.
There is a reported surge in AI-powered cyberattacks targeting Ukraine, attributed to Russia-linked threat actors. These attacks represent a campaign leveraging artificial intelligence techniques to enhance the sophistication and effectiveness of cyber operations. While specific technical details and exploited vulnerabilities are not disclosed, the use of AI suggests automation, improved evasion, and potentially novel attack vectors. The threat is assessed as medium severity due to limited public technical data and no known exploits in the wild. European organizations, especially those with geopolitical or strategic ties to Ukraine, may face indirect risks such as spillover or targeted attacks. Mitigation requires enhanced monitoring for AI-driven attack patterns, threat intelligence sharing, and tailored defenses beyond generic cybersecurity measures. Countries with close political, economic, or military connections to Ukraine, such as Poland, Germany, and the Baltic states, are more likely to be affected. Given the medium severity, defenders should prioritize awareness and preparedness for evolving AI-enabled threats in the regional cyber landscape.
Other noteworthy stories that might have slipped under the radar: US universities targeted by payroll pirates, Zimbra vulnerability exploited, Mic-E-Mouse attack. The post In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware appeared first on SecurityWeek .
GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure. The post Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign appeared first on SecurityWeek .
The botnet packs over 50 exploits targeting unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices. The post RondoDox Botnet Takes ‘Exploit Shotgun’ Approach appeared first on SecurityWeek .
Supply chain attacks have surged by 250% from 2021 to 2024, with third-party vendor compromise accounting for 45% of incidents. These attacks have a longer average dwell time (287 days) compared to direct attacks (207 days), indicating significant detection challenges. The financial impact is substantial, with supply chain attacks costing an average of $5.12 million per incident. CISA has issued an emergency directive emphasizing zero-trust architecture, Software Bill of Materials (SBOM) requirements, and continuous vendor risk assessments to mitigate these threats. European organizations face heightened risks due to their reliance on complex vendor ecosystems and critical infrastructure. Countries with dense technology sectors and critical infrastructure, such as Germany, France, and the UK, are particularly vulnerable. Mitigation requires tailored vendor risk management, adoption of SBOM tools, and enhanced monitoring of supply chain interactions. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation through trusted vendors, and broad scope, this threat is assessed as critical severity.
There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
A Vietnamese threat actor has transitioned from using the PXA Stealer to deploying PureRAT, a commercial remote access trojan. The attack chain involves multiple stages, including phishing emails, Python-based infostealers, and .NET loaders. The campaign demonstrates a progression in complexity, utilizing DLL sideloading, obfuscation techniques, and defense evasion methods. The final payload, PureRAT, provides the attacker with extensive control over compromised systems. The threat actor's shift to commodity malware indicates a maturing operation, lowering the barrier for sophisticated attacks. This evolution highlights the need for robust, multi-layered defense strategies to counter such adaptable threats.
ClayRat is an Android spyware campaign primarily targeting Russian users by masquerading as popular apps distributed through Telegram channels and phishing sites. It exfiltrates SMS, call logs, notifications, device info, takes photos, and sends SMS messages. The malware spreads aggressively by sending malicious links to victims' contacts, leveraging Android's default SMS handler role to bypass permission prompts. Over 600 samples and 50 droppers have been observed in three months, with continuous obfuscation improvements. The campaign uses impersonation, community distribution, UX deception, and self-propagation via SMS forwarding. While currently focused on Russia, the techniques and propagation methods pose risks to European organizations with Android users. No known exploits are publicly reported, and the campaign requires user interaction to install and propagate. Suggested severity is medium due to its impact on confidentiality and propagation capabilities but limited to targeted regions and requiring user action.
SonicWall has disclosed that hackers breached all of its firewall backup systems, potentially exposing sensitive firewall configurations and related data. This breach could allow attackers to analyze backup data to identify vulnerabilities or gain unauthorized access to networks protected by SonicWall firewalls. Although no known exploits are currently reported in the wild, the compromise of backup data represents a significant risk to confidentiality and network integrity. European organizations using SonicWall firewalls may face increased risk of targeted attacks or lateral movement within their networks. Immediate mitigation involves verifying backup integrity, rotating credentials, and enhancing monitoring for suspicious activity. Countries with high SonicWall market penetration and critical infrastructure reliance on these firewalls are at greater risk. Given the breach scope and potential impact, the severity is assessed as high. Defenders should prioritize incident response, forensic analysis, and communication with SonicWall for remediation updates.
The RondoDox botnet is actively targeting 56 known n-day vulnerabilities in a series of worldwide attacks. These n-day flaws represent previously disclosed but unpatched security issues across multiple products and platforms. Although no known exploits in the wild have been confirmed yet, the botnet's broad targeting and high-priority classification indicate a significant threat. The attacks are global, leveraging the botnet's capability to scan and exploit vulnerable systems that remain unpatched. European organizations are at risk, especially those with delayed patch management or using affected software. The botnet's exploitation could lead to compromised confidentiality, integrity, and availability of systems. Mitigation requires rapid identification of vulnerable systems, prioritized patching, and enhanced network monitoring for anomalous botnet activity. Countries with high technology adoption and critical infrastructure reliance on vulnerable platforms are most at risk. Given the scope and ease of exploitation of known vulnerabilities without authentication, the threat severity is assessed as high. Defenders should focus on proactive vulnerability management and network defenses to mitigate this evolving botnet threat.
Threat actors have begun leveraging the Velociraptor digital forensics and incident response (DFIR) tool as part of ransomware attack campaigns. Velociraptor, originally designed for legitimate forensic investigations and incident response, is being repurposed by attackers to facilitate lateral movement, reconnaissance, and data collection within compromised networks. This misuse enhances attackers' ability to identify valuable targets and escalate privileges before deploying ransomware payloads. The threat is considered high severity due to the tool's powerful capabilities, ease of use, and the significant impact ransomware attacks can have on confidentiality, integrity, and availability of systems. European organizations, especially those with critical infrastructure and large enterprise environments, face increased risk given the tool’s effectiveness in complex networks. Mitigation requires tailored detection of Velociraptor usage patterns, strict endpoint monitoring, and network segmentation to limit attacker movement. Countries with high adoption of enterprise IT infrastructure and critical sectors such as finance, manufacturing, and government are most likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the potential for widespread disruption, ease of exploitation by skilled attackers, and the critical nature of impacted assets.
Fake TikTok and WhatsApp Android applications have been identified as carriers of the ClayRat spyware, a malicious payload designed to covertly infiltrate devices and exfiltrate sensitive data. These counterfeit apps mimic popular social media and messaging platforms to deceive users into installation, leveraging social engineering tactics. Once installed, ClayRat spyware can monitor user activity, steal credentials, and potentially compromise device integrity. The threat primarily targets Android devices, exploiting the platform's app distribution channels outside official stores. European organizations face risks from data breaches, espionage, and operational disruption, especially those with mobile-dependent workforces. Mitigation requires enhanced user awareness, strict app installation policies, and deployment of advanced mobile threat detection solutions. Countries with high Android usage and significant social media engagement, such as Germany, France, Italy, Spain, and the UK, are most vulnerable. Given the spyware's covert nature, ease of installation via phishing, and potential for extensive data compromise, the threat severity is assessed as high. Defenders should prioritize detection of unauthorized app installations and implement robust endpoint security controls to mitigate this risk.
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.
A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious activities. The campaign targeted over 100 victims, primarily in Taiwan, Japan, South Korea, and Hong Kong. The threat actors also deployed Ghost RAT, a remote access trojan, for further system compromise. The attack methodology and victimology suggest a China-nexus threat actor, highlighting the need for improved security measures and vigilance against emerging threats.
