The Kimwolf Botnet is a recently reported high-severity botnet threat that targets local networks. It is actively stalking local network environments to potentially compromise devices and expand its reach. While detailed technical specifics are limited, the botnet's presence on local networks suggests it may exploit network vulnerabilities or weak device security to propagate. There are no known exploits in the wild yet, but the threat is considered high priority due to its potential impact. European organizations could face risks including unauthorized access, data exfiltration, and disruption of network services. Mitigation requires enhanced local network monitoring, segmentation, and device hardening beyond generic advice. Countries with high IoT and networked device adoption, significant industrial infrastructure, or strategic geopolitical importance in Europe are more likely to be targeted. Given the botnet’s ability to infiltrate local networks without requiring user interaction or authentication, the suggested severity is high. Defenders should prioritize detection capabilities and proactive network hygiene to mitigate this emerging threat.
The VVS Discord Stealer is a malware strain designed to extract Discord user credentials and tokens. It employs Pyarmor, a Python obfuscation tool, to evade detection by security solutions and hinder analysis. Although no known exploits in the wild have been reported yet, its medium severity rating reflects the potential risk of credential theft and unauthorized account access. The malware primarily targets Discord users, which could include individuals and organizations using Discord for communication and collaboration. European organizations with significant Discord usage, especially in tech, gaming, and remote work sectors, may be at risk. Mitigation requires enhanced endpoint detection capabilities that can identify obfuscated Python malware, user education on phishing and suspicious downloads, and restricting Discord token storage or access. Countries with high Discord adoption and active gaming or tech communities, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the malware’s ability to compromise confidentiality without requiring user interaction beyond initial infection, the suggested severity is high. Defenders should prioritize monitoring for obfuscated Python malware and implement controls to protect Discord credentials.
Ryan Goldberg and Kevin Martin have admitted being affiliates of the BlackCat/Alphv ransomware group. The post Two US Cybersecurity Pros Plead Guilty Over Ransomware Attacks appeared first on SecurityWeek .
DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.
Two US cybersecurity experts have been found guilty of participating in an extortion scheme involving the ALPHV ransomware. This case highlights insider threats where individuals with cybersecurity expertise exploit their knowledge for criminal activities. Although no specific technical vulnerabilities or exploits are detailed, the involvement of trusted experts in ransomware operations raises concerns about the integrity of cybersecurity professionals. The threat does not currently have known exploits in the wild beyond this criminal activity. European organizations could be indirectly impacted due to the global reach of ALPHV ransomware campaigns. Mitigation should focus on insider threat detection, enhanced vetting, and monitoring of cybersecurity personnel. Countries with significant ransomware targeting history and high adoption of cybersecurity services may be more affected. Given the medium severity rating and lack of direct technical exploit details, the threat severity is assessed as medium. Defenders should remain vigilant about insider risks and ransomware extortion schemes involving trusted individuals.
Between December 19-22, 2025, EmEditor's official website suffered a security breach, causing the main download button to serve malicious software. The fake installer, signed by WALSHAM INVESTMENTS LIMITED, contained infostealer malware targeting login credentials, browser history, and VPN settings. It specifically targeted technical staff and government offices, stealing files and installing a fraudulent browser extension for remote control and cryptocurrency address swapping. Users who downloaded during this period are advised to check the digital signature, delete suspicious files, and change stored passwords. Emurasoft is investigating the incident and has apologized for the inconvenience.
The KMSAuto malware, linked to a Lithuanian suspect recently arrested, infected approximately 2.8 million systems globally. This malware is known for unauthorized activation of Microsoft software products, often bundled with additional malicious payloads. Although no CVSS score is available, the widespread infection and potential for system compromise indicate a medium severity threat. European organizations using unlicensed or pirated Microsoft software are particularly at risk, as KMSAuto targets such environments. The malware can lead to unauthorized access, data integrity issues, and potential lateral movement within networks. Mitigation requires organizations to enforce software licensing compliance, deploy endpoint detection tools capable of identifying KMSAuto variants, and conduct thorough network scans for infections. Countries with high Microsoft software usage and historical malware targeting, such as Germany, France, the UK, Poland, and the Baltic states, are most likely affected. The arrest may disrupt ongoing operations but does not eliminate the threat from existing infections. Defenders should prioritize detection and remediation efforts to reduce impact and prevent further spread.
The EmEditor homepage download button was compromised and served malware to users for a period of four days. This incident involved the official download link being manipulated to deliver malicious payloads, potentially infecting users who attempted to download the software during that timeframe. Although no specific affected versions or malware details were disclosed, the attack represents a supply chain compromise risk. The threat was identified through Reddit InfoSec discussions and reported by hackread.com, but with minimal technical details and no known exploits in the wild. European organizations using EmEditor or downloading it during the affected period could have been exposed to malware infection, risking confidentiality and integrity of their systems. Mitigation requires verifying software integrity, using alternative trusted download sources, and monitoring for suspicious activity. Countries with higher EmEditor usage and strong software development sectors, such as Germany, France, and the UK, are more likely to be impacted. Given the ease of exploitation through a trusted website and the potential for malware infection, the severity is assessed as high despite limited technical details. Defenders should prioritize verifying downloads and enhancing endpoint detection capabilities.
Mustang Panda, a known threat actor, has deployed a signed kernel-mode rootkit to stealthily load the TONESHELL backdoor on targeted systems. This advanced malware leverages a legitimate digital signature to evade detection and gain deep system privileges, enabling persistent and covert access. The rootkit operates at the kernel level, allowing it to manipulate core OS functions and hide its presence effectively. Although no known exploits are currently observed in the wild, the sophistication and stealth capabilities of this threat pose a significant risk. European organizations, especially those in critical infrastructure and government sectors, could face severe confidentiality and integrity breaches if targeted. Mitigation requires advanced endpoint detection, strict driver signature enforcement, and continuous monitoring for anomalous kernel activity. Countries with high adoption of Windows systems and strategic geopolitical relevance are most likely to be affected. Given the high potential impact and complexity of exploitation, this threat is assessed as high severity. Defenders must prioritize detection of signed kernel drivers and implement layered security controls to prevent unauthorized kernel-level code execution.
A hacker involved in distributing the KMSAuto malware campaign, which amassed approximately 2.8 million downloads, has been arrested. KMSAuto is a known malware family often disguised as software activation tools, commonly used to illegally activate Microsoft products. The campaign's large scale indicates widespread infection potential, posing risks to confidentiality and system integrity. Although no specific affected versions or exploits in the wild are detailed, the malware's presence on millions of systems suggests significant impact. European organizations are at risk due to the popularity of Microsoft products and the prevalence of software piracy tools like KMSAuto. Mitigation requires targeted detection of KMSAuto variants, user education against unauthorized activation tools, and robust endpoint protection. Countries with high Microsoft usage and historical malware infection rates, such as Germany, France, the UK, Italy, and Spain, are most likely affected. Given the malware's broad reach, ease of distribution, and potential for persistent compromise, the threat severity is assessed as high. Defenders should focus on proactive monitoring, incident response readiness, and user awareness to reduce infection vectors.
A Romanian energy provider has been targeted by the Gentlemen ransomware, a high-severity malware threat that encrypts critical data and demands ransom payments. The attack highlights the ongoing risk ransomware poses to critical infrastructure sectors, particularly energy providers. Although detailed technical specifics and indicators of compromise are limited, the incident underscores the potential for operational disruption and data loss. European energy organizations should be vigilant given the strategic importance of energy infrastructure and the increasing ransomware activity targeting this sector. Mitigation requires tailored defenses including network segmentation, robust backup strategies, and proactive threat hunting. Countries with significant energy infrastructure and historical ransomware targeting, such as Romania and neighboring EU states, are at elevated risk. The threat is assessed as high severity due to its impact on availability and integrity, ease of exploitation once initial access is gained, and the critical nature of the affected sector. Defenders must prioritize detection and response capabilities to mitigate potential cascading effects on energy supply and national security.
A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.
In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated with the HoneyMyte APT group. The attacks, which began in February 2025, primarily target government organizations in Southeast and East Asia, especially Myanmar and Thailand. The malware uses various techniques to evade detection, including API obfuscation, process protection, and registry key protection. The ToneShell backdoor communicates with command-and-control servers using fake TLS headers and supports remote operations such as file transfer and shell access.
A critical zero-day vulnerability has been discovered in XSpeeder devices, affecting approximately 70,000 units. The vendor has reportedly ignored alerts about this flaw, leaving these devices exposed to potential exploitation. Although no known exploits are currently observed in the wild, the vulnerability's critical nature suggests it could allow attackers to compromise device confidentiality, integrity, or availability. The lack of patches or vendor response increases the risk for organizations relying on these devices. European organizations using XSpeeder devices should urgently assess their exposure and implement compensating controls. Countries with higher adoption of these devices and strategic infrastructure relying on them are at greater risk. Immediate mitigation steps include network segmentation, monitoring for unusual activity, and restricting device access. Given the critical severity and vendor inaction, proactive defense is essential to prevent potential exploitation.
For the latest discoveries in cyber research for the week of 29th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Romanian Waters, the country’s national water management authority, was hit by a ransomware attack that resulted in nearly 1,000 computer systems across national and regional offices being encrypted. The attack affected geographic […] The post 29th December – Threat Intelligence Report appeared first on Check Point Research .
The ‘download’ button on the official EmEditor website served a malicious installer. The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek .
The MongoBleed vulnerability is a high-severity flaw that leads to leakage of MongoDB secrets, exposing approximately 87,000 servers worldwide. This breach allows attackers to extract sensitive database credentials and potentially access confidential data. Although no known exploits are currently active in the wild, the scale of exposed servers and the nature of leaked secrets pose a significant risk. European organizations using MongoDB without adequate protections are vulnerable to unauthorized data access and potential data breaches. The threat primarily impacts confidentiality and integrity of data, with possible availability issues if attackers manipulate or delete data. Mitigation requires immediate auditing of MongoDB deployments, securing credentials, and applying any available patches or configuration changes to prevent unauthorized access. Countries with high MongoDB adoption and critical infrastructure relying on these databases are at greater risk. Given the ease of exploitation without authentication and the broad exposure, the severity is assessed as high. Defenders should prioritize monitoring for unusual database access patterns and enforce strict access controls to mitigate this threat.
A newly discovered vulnerability in MongoDB allows unauthenticated attackers to read uninitialized memory, potentially exposing sensitive data. This flaw affects certain MongoDB versions, though specific affected versions have not been disclosed. The vulnerability does not require authentication or user interaction, increasing its risk. While no known exploits are currently in the wild, the high severity rating indicates significant potential impact. European organizations using MongoDB, especially those with large deployments or sensitive data, could be at risk. Mitigation requires monitoring for official patches and applying them promptly once available. Additional protective measures include network segmentation, restricting database access, and enhanced monitoring for anomalous activity. Countries with high MongoDB adoption and critical infrastructure relying on it are more likely to be targeted. Given the nature of the flaw, the suggested severity is high due to ease of exploitation and potential confidentiality breaches. Defenders should prioritize awareness and readiness to patch this vulnerability to prevent data leakage.
