A recent security news report reveals that all SonicWall Cloud Backup users have their firewall configuration files stored in a manner that may expose sensitive information. This exposure could potentially allow unauthorized access to firewall settings, leading to risks such as network compromise or data leakage. Although no known exploits are currently active in the wild, the high severity rating indicates significant potential impact. The threat primarily affects organizations using SonicWall Cloud Backup services, which are widely deployed in Europe. Attackers gaining access to these configuration files could manipulate firewall rules, bypass security controls, or extract confidential network topology information. Immediate attention is required to assess and secure backup storage configurations. European organizations, especially those in countries with high SonicWall adoption and critical infrastructure, should prioritize mitigation steps. No CVSS score is available, but the threat is assessed as high severity due to the sensitivity of the data and potential for exploitation without user interaction or authentication. Defenders should review backup storage policies, enforce strict access controls, and monitor for unusual access patterns to mitigate this risk.
Hacktivists have targeted critical infrastructure but mistakenly attacked a decoy plant designed to mislead attackers. This incident highlights the increasing risk posed by hacktivist groups to vital infrastructure sectors. Although no known exploits are currently in the wild, the critical nature of the target and the attacker's intent underscore the potential severity of such threats. European organizations operating critical infrastructure should be vigilant, as these sectors are often high-value targets. The attack on a decoy suggests defenders are employing deception tactics to detect and mitigate intrusions. This event emphasizes the need for robust cybersecurity measures, including threat intelligence, network segmentation, and incident response readiness. No specific vulnerabilities or affected versions are identified, limiting detailed technical mitigation steps. The threat is assessed as critical due to the potential impact on availability and integrity of essential services. Countries with significant critical infrastructure and geopolitical exposure in Europe are most likely to be affected. Defenders must prioritize proactive monitoring and deception strategies to counter similar hacktivist campaigns.
Hackers claim to have breached Discord, exposing data of approximately 5.5 million users. The breach reportedly involves unauthorized access to user data, though specific technical details and the nature of the exposed data remain limited. No known exploits are currently active in the wild, and the discussion around this incident is minimal. The breach is considered high severity due to the scale of affected users and the potential sensitivity of the data involved. European organizations and users relying on Discord for communication may face risks related to data privacy and potential phishing or social engineering attacks leveraging the leaked information. Mitigation involves monitoring official Discord communications, enforcing strong authentication, and educating users on recognizing phishing attempts. Countries with high Discord usage and significant tech or gaming communities, such as the UK, Germany, France, and the Netherlands, are likely to be most impacted. The severity is assessed as high given the large user base affected, potential confidentiality impact, and ease of exploitation through social engineering. Defenders should prioritize incident response readiness and user awareness campaigns.
In early September, hackers stole the firewall configuration backup files stored using the MySonicWall service. The post All SonicWall Cloud Backup Users Had Firewall Configurations Stolen appeared first on SecurityWeek .
&#;x26;#;x5b;This is a Guest Diary by Jin Quan Low, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].]
A new ransomware triad comprising DragonForce, LockBit, and Qilin is emerging with ambitions to dominate the ransomware landscape. These ransomware groups are known for leveraging remote code execution (RCE) vulnerabilities to infiltrate networks and deploy ransomware payloads. Although no specific exploits or affected software versions have been identified yet, the collaboration or concurrent activity of these groups signals a potential increase in ransomware attacks. The threat is currently assessed as medium severity due to the lack of confirmed exploits in the wild and limited technical details. European organizations, especially those in critical infrastructure and high-value sectors, could face increased ransomware risks if these groups target them. Mitigation requires proactive network monitoring, patch management, and incident response readiness tailored to ransomware attack vectors. Countries with significant digital infrastructure and history of ransomware targeting, such as Germany, France, and the UK, are likely to be most affected. Given the ransomware nature and potential for significant operational disruption, the suggested severity is high. Defenders should prioritize detection of ransomware behaviors, restrict lateral movement, and ensure robust backups to mitigate impact.
Qilin ransomware is used for domain-wide encryption, and a ransom is then demanded for the decryption keys and/or to prevent the publication of the stolen data. Qilin affiliates are recruited from cybercrime forums to use the Qilin RaaS platform, which handles payload generation, the publication of stolen data, and ransom negotiations.
Shuyal Stealer is a sophisticated infostealer malware targeting 19 different browsers. It conducts deep system reconnaissance, collecting detailed hardware information and user data. The malware disables Windows Task Manager, ensures persistence through startup folder insertion, and exfiltrates stolen data via a Telegram bot. Shuyal's capabilities include credential harvesting from multiple browsers, clipboard capture, screenshot taking, and Discord token theft. It employs evasion techniques like self-deletion and uses PowerShell for data compression. The malware's wide-ranging browser targets and extensive data collection make it a significant threat to user privacy and system security.
A sophisticated cyber campaign utilizing the open-source Nezha tool has been discovered targeting vulnerable web applications since August 2025. Attackers gained access through an exposed phpMyAdmin panel, employing creative log poisoning techniques to implant a PHP web shell. The intrusion involved the use of AntSword for server control, followed by the installation of Nezha agent and Ghost RAT malware. This marks the first public report of Nezha being used for web server compromises. The campaign, linked to China-based infrastructure, affected over 100 systems, primarily in Taiwan, Japan, South Korea, and Hong Kong. Attackers used Nezha to disable Windows Defender and deploy Ghost RAT, establishing persistence under the name 'SQLlite'. Recommendations include patching public-facing applications, implementing authentication, and improving detection for post-exploitation activities.
The hackers claim the theft of 27 gigabytes of data, including contracts, employee information, and financial documents. The post Ransomware Group Claims Attack on Beer Giant Asahi appeared first on SecurityWeek .
BIETA and its subsidiary CIII research develop and sell technologies supporting China’s intelligence, counterintelligence, and military operations. The post Security Firm Exposes Role of Beijing Research Institute in China’s Cyber Operations appeared first on SecurityWeek .
The Mic-E-Mouse attack is a newly reported threat where compromised computer mice are exploited to capture audio conversations. This attack leverages the microphone capabilities embedded or accessible via certain computer mice to eavesdrop on users without their knowledge. Although no specific affected versions or exploits in the wild have been confirmed, the campaign is linked to advanced persistent threat (APT) actors, indicating a targeted and sophisticated approach. The attack does not require user interaction beyond normal mouse use, making it stealthy and potentially widespread. The severity is assessed as medium due to the targeted nature and complexity of exploitation. European organizations, especially those in sensitive sectors, could face confidentiality breaches if such devices are used within their environments. Mitigation requires strict hardware procurement policies, network segmentation, and monitoring for unusual device behavior. Countries with high adoption of advanced peripherals and significant strategic or governmental targets are more likely to be affected. Given the lack of patches or CVSS scoring, the threat is rated medium severity based on impact and exploitation factors.
The Medusa ransomware operators exploited the GoAnywhere MFT vulnerability one week before patches were released. The post Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks appeared first on SecurityWeek .
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple vulnerabilities affecting Oracle, Mozilla, Microsoft Windows, the Linux Kernel, and Microsoft Internet Explorer to its Known Exploited Vulnerabilities catalog. These vulnerabilities are recognized as actively exploited or pose a significant risk, prompting increased attention for remediation. Although no specific CVSS scores or detailed technical exploit information are provided, the inclusion in CISA's catalog indicates a medium severity level with potential impacts on confidentiality, integrity, and availability. European organizations using these widely deployed software products are at risk, especially those in critical infrastructure, government, and large enterprises. Mitigation requires prioritizing patch management, monitoring for exploitation attempts, and applying vendor advisories promptly. Countries with high adoption of these technologies and strategic importance in digital infrastructure, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the broad scope and active exploitation potential, the suggested severity is medium. Defenders should focus on rapid vulnerability assessment and remediation to reduce exposure.
A significant data breach has occurred at Red Hat, a major provider of open-source software solutions. The breach has escalated with the involvement of the threat actor group ShinyHunters, who are now engaging in extortion attempts using the stolen data. While specific technical details about the breach vector or compromised data have not been disclosed, the incident is classified as high severity due to the potential exposure of sensitive information and the reputational impact on Red Hat and its customers. No known exploits are currently reported in the wild, and the discussion around this breach remains minimal on public forums. European organizations relying on Red Hat products could face indirect risks, including supply chain exposure and targeted extortion attempts. Immediate mitigation involves monitoring for suspicious activity, reviewing access controls, and preparing incident response plans tailored to potential extortion scenarios. Countries with strong Red Hat market presence and critical infrastructure depending on its software are more likely to be affected. Given the breach's impact on confidentiality and the involvement of extortion, the suggested severity is high.
Since the release of XWorm V6.0 on June 4, 2025, we have noted a surge in samples identified as XWorm V6.0 on VirusTotal, reflecting its rapid adoption by threat actors. One prominent campaign illustrates its delivery: a malicious JavaScript (JS) file initiates a PowerShell (PS1) script, which deploys an injector to deliver the XWorm Client.
A Chinese cybercrime group is operating a global SEO fraud campaign by compromising Microsoft IIS web servers. The attackers leverage these compromised servers to manipulate search engine rankings, likely redirecting traffic or injecting fraudulent content to benefit their SEO schemes. This campaign is high priority due to its global scale and the widespread use of IIS servers. Although no specific exploited vulnerabilities or CVEs are identified, the threat involves unauthorized access and control over web infrastructure, impacting confidentiality and integrity. European organizations running IIS servers are at risk of having their web assets abused for fraudulent purposes, potentially damaging reputation and causing indirect financial losses. Mitigation requires proactive server hardening, continuous monitoring for unauthorized changes, and rapid incident response. Countries with significant IIS deployment and high-value web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation implied by compromised servers and the broad impact on availability and integrity, the suggested severity is high. Defenders should prioritize detection of unusual web server activity and ensure robust patching and access controls to prevent compromise.
XWorm malware has reemerged with a new ransomware module and an expanded arsenal of over 35 plugins, enhancing its capabilities for persistence, data theft, and system compromise. Although no known exploits are currently active in the wild, the malware's modular architecture and ransomware addition significantly increase its threat potential. European organizations face heightened risks due to the malware's ability to disrupt operations, exfiltrate sensitive data, and demand ransom payments. Mitigation requires proactive network monitoring, strict endpoint security controls, and rapid incident response planning tailored to detect and contain modular malware behaviors. Countries with high adoption of Windows-based enterprise environments and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are particularly vulnerable. Given the malware's complexity, potential for widespread impact, and ease of deployment without requiring user interaction, the threat severity is assessed as high. Defenders should prioritize detection of unusual plugin activity and ransomware behaviors associated with XWorm to prevent significant operational and financial damage.
A high-severity security flaw has been identified in the Unity game engine, as warned by Steam and Microsoft, potentially exposing gamers to cyberattacks. This vulnerability could allow attackers to exploit weaknesses in Unity-based games, leading to unauthorized code execution or data compromise. Although no known exploits are currently active in the wild, the flaw poses significant risks due to Unity's widespread use in game development. European organizations involved in gaming, game distribution, or related services may face increased risks, especially those with large user bases or development teams using Unity. Mitigation requires prompt patching once updates are available, enhanced monitoring of game-related network traffic, and applying strict security controls around game execution environments. Countries with strong gaming industries and large gamer populations, such as Germany, France, and the UK, are more likely to be affected. Given the potential for high impact on confidentiality and integrity, ease of exploitation, and broad scope, the suggested severity is high. Defenders should prioritize awareness, patch management, and user education to reduce exposure.
A recently reported security threat involves the potential for attackers to take remote control over industrial generators. While detailed technical specifics are limited, the threat highlights vulnerabilities in the control systems of industrial generators that could be exploited remotely. This could allow adversaries to manipulate generator operations, potentially causing disruptions in power supply or damaging critical infrastructure. The threat is currently assessed as medium severity, with no known exploits in the wild and minimal public discussion. European organizations relying on industrial generators for critical power backup or infrastructure support could face operational risks if targeted. Mitigation requires focused security measures on industrial control systems, including network segmentation, strict access controls, and continuous monitoring for anomalous activity. Countries with significant industrial sectors and critical infrastructure dependent on such generators are more likely to be affected. Given the potential impact on availability and integrity of power systems, and the ease of remote exploitation, this threat is assessed as medium severity. Defenders should prioritize securing generator control interfaces and enhancing incident response capabilities.
