Threats affecting Spain

A ransomware attack on Covenant Health resulted in a data breach affecting over 478,000 individuals. The attack involved malware that encrypted or compromised sensitive health data, leading to significant exposure of personal information. Although no specific exploited vulnerabilities or affected software versions are detailed, the breach highlights the ongoing risk ransomware poses to healthcare organizations. There is no indication of known exploits in the wild beyond this incident. The breach underscores the importance of robust cybersecurity measures in protecting sensitive health data. European healthcare organizations face similar risks due to comparable threat landscapes and regulatory environments. Mitigation requires targeted strategies including network segmentation, advanced endpoint detection, and incident response readiness. Countries with large healthcare sectors and high adoption of similar IT infrastructure are most at risk. The severity is assessed as high due to the scale of data exposure, potential for patient harm, and operational disruption. Defenders should prioritize proactive ransomware defenses and comprehensive data protection protocols.

Malware#infosecnews#redditGermany+7

A critical security threat has emerged involving over 10,000 Fortinet firewalls that are vulnerable to an actively exploited two-factor authentication (2FA) bypass. This vulnerability allows attackers to circumvent the additional security layer provided by 2FA, potentially gaining unauthorized access to firewall management interfaces. The exploitation of this flaw can lead to severe consequences including network compromise, data breaches, and disruption of services. European organizations using Fortinet firewalls are at significant risk, especially those in sectors with high reliance on secure perimeter defenses. The threat is rated high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation without requiring user interaction. Immediate mitigation steps include applying vendor patches once available, restricting administrative access via VPN or IP whitelisting, and enhancing network monitoring for suspicious activities. Countries with high Fortinet market penetration and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Defenders must prioritize this threat to prevent widespread compromise and maintain network security.

Breach#infosecnews#redditGermany+7

The Kimwolf Botnet is a recently reported high-severity botnet threat that targets local networks. It is actively stalking local network environments to potentially compromise devices and expand its reach. While detailed technical specifics are limited, the botnet's presence on local networks suggests it may exploit network vulnerabilities or weak device security to propagate. There are no known exploits in the wild yet, but the threat is considered high priority due to its potential impact. European organizations could face risks including unauthorized access, data exfiltration, and disruption of network services. Mitigation requires enhanced local network monitoring, segmentation, and device hardening beyond generic advice. Countries with high IoT and networked device adoption, significant industrial infrastructure, or strategic geopolitical importance in Europe are more likely to be targeted. Given the botnet’s ability to infiltrate local networks without requiring user interaction or authentication, the suggested severity is high. Defenders should prioritize detection capabilities and proactive network hygiene to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+9

Flock, a provider of AI-enabled surveillance cameras, has exposed its devices, potentially allowing unauthorized access to video feeds and sensitive data. This exposure raises concerns about privacy violations and unauthorized surveillance. The threat involves AI-powered cameras that may be accessible due to misconfigurations or vulnerabilities. Although no known exploits are currently in the wild, the medium severity rating reflects the potential risks to confidentiality and privacy. European organizations using Flock cameras could face data breaches and compliance issues under GDPR. Mitigation requires immediate review of device configurations, network segmentation, and strict access controls. Countries with higher adoption of smart surveillance and strong privacy regulations, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation through exposed devices and the sensitivity of surveillance data, the suggested severity is medium. Defenders should prioritize securing AI surveillance infrastructure to prevent unauthorized access and data leakage.

News#infosecnews#redditGermany+6

A phishing campaign is abusing Google Cloud applications to impersonate legitimate Google emails, deceiving recipients into trusting malicious messages. Attackers leverage the credibility of Google Cloud infrastructure to bypass traditional email security filters and increase the success rate of phishing attempts. This technique enables threat actors to send emails that appear authentic, potentially leading to credential theft, malware deployment, or further social engineering attacks. The campaign is currently assessed as medium severity due to its potential impact and ease of exploitation without requiring user interaction beyond opening the email. European organizations, especially those heavily reliant on Google Workspace and cloud services, face increased risk. Mitigation requires enhanced email filtering, user awareness training focused on recognizing subtle phishing cues, and strict verification of email sources even when messages appear to come from trusted domains. Countries with high adoption of Google services and significant cloud infrastructure usage, such as the UK, Germany, France, and the Netherlands, are most likely to be targeted. Given the campaign's use of trusted cloud platforms to impersonate legitimate emails, defenders must remain vigilant and implement layered security controls to reduce exposure.

Phishing#infosecnews#redditGermany+6

A newly disclosed Windows persistence technique leverages NTUSER. MAN file writes to achieve registry-based persistence without triggering registry callback detections in Endpoint Detection and Response (EDR) systems. This method bypasses common monitoring mechanisms by avoiding direct registry calls to HKCU, making it stealthy and effective for medium integrity persistence. Although no known exploits are currently in the wild, the technique poses a medium severity risk due to its evasion capabilities and potential for undetected persistence. European organizations relying on Windows environments and EDR solutions that monitor registry callbacks should be aware of this threat. Mitigation requires enhanced monitoring of NTUSER. MAN file modifications and behavioral analysis beyond traditional registry callback detection. Countries with high Windows adoption and advanced cyber threat landscapes, such as Germany, France, and the UK, are likely more exposed. The technique’s stealth and ease of implementation elevate its risk profile, warranting proactive defensive measures.

News#netsec#redditGermany+5

Ryan Goldberg and Kevin Martin have admitted being affiliates of the BlackCat/Alphv ransomware group. The post Two US Cybersecurity Pros Plead Guilty Over Ransomware Attacks appeared first on SecurityWeek .

MalwareGermanyFrance+5

The Qilin ransomware group hacked the healthcare organization and stole data from its systems in May 2025. The post Covenant Health Data Breach Impacts 478,000 Individuals appeared first on SecurityWeek .

BreachGermanyFrance+5

GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday. The post Adobe ColdFusion Servers Targeted in Coordinated Campaign appeared first on SecurityWeek .

CampaignGermanyFrance+4

The RondoDox botnet exploits a critical vulnerability known as React2Shell to compromise IoT devices and web servers. This flaw allows attackers to execute arbitrary code remotely, enabling the hijacking of vulnerable systems to incorporate them into the botnet. Although no specific affected versions or patches have been disclosed yet, the threat is considered critical due to the potential scale and impact. European organizations operating IoT infrastructure or web services are at risk, especially those with devices lacking timely security updates. The botnet could be leveraged for large-scale DDoS attacks, data exfiltration, or further network infiltration. Mitigation requires proactive network monitoring, segmentation of IoT devices, and rapid deployment of vendor patches once available. Countries with high IoT adoption and significant web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the ease of exploitation and critical impact on confidentiality, integrity, and availability, the suggested severity is critical. Defenders should prioritize detection and containment efforts immediately to prevent widespread compromise.

Botnet#infosecnews#redditGermany+5

A hacker claims to have breached the European Space Agency (ESA) and is selling 200GB of stolen data. The breach was disclosed via a Reddit post linking to an external news source, but technical details and verification remain minimal. The compromised data volume suggests a significant exfiltration of sensitive information, potentially impacting ESA's confidentiality and operational security. No known exploits or vulnerabilities have been publicly identified, and there is no evidence of active exploitation beyond the data sale claim. European organizations, especially those in aerospace and governmental sectors, could face increased risk from secondary attacks leveraging this breach. Mitigation requires immediate internal investigation, enhanced monitoring for data exfiltration, and tightening of access controls. Countries with strong aerospace sectors and ESA involvement, such as France, Germany, Italy, Spain, and the Netherlands, are most likely to be affected. Given the high potential impact on confidentiality and the strategic importance of ESA, the suggested severity is high. Defenders should prioritize verifying the breach, assessing data sensitivity, and preparing incident response plans accordingly.

Breach#infosecnews#redditFrance+6

In 2025, there was a significant increase in rogue ScreenConnect installations, part of a broader trend of threat actors abusing remote monitoring and management tools (RMMs). These tools were used to gain access, blend in, move laterally, and maintain persistence in target systems. Attackers employed various social engineering tactics to trick employees into downloading malicious RMMs. Common lures included fake Social Security statements, invitations, and financial documents. The Huntress Security Operations Center identified recurring patterns in lures, domains, and file hashes associated with these attacks. Some campaigns showed signs of targeting specific industries, such as accounting firms. The article provides detailed examples of attack patterns, top malicious domains, and file hashes observed throughout the year.

Malware#lures#social engineeringGermany+5

The DarkSpectre browser extension campaigns have compromised approximately 8.8 million users worldwide by distributing malicious browser extensions. These campaigns involve extensions that likely perform unauthorized data collection, user tracking, or other malicious activities, impacting user privacy and security. Although no specific affected versions or exploits in the wild are detailed, the scale of impact and exposure indicates a high-severity threat. European organizations using popular browsers susceptible to these extensions are at risk of data leakage and potential downstream attacks. The threat does not require user authentication but likely depends on user installation of malicious extensions, making user awareness critical. Mitigation involves proactive monitoring of browser extensions, enforcing strict extension policies, and educating users about risks. Countries with high browser usage and significant digital economies, such as Germany, France, and the UK, are most likely to be affected. Given the broad impact on confidentiality and potential integrity of user data, ease of exploitation through extension installation, and large affected user base, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and strengthen endpoint security controls.

Breach#infosecnews#redditGermany+6

The Everest ransomware group has reportedly leaked 1TB of stolen data from ASUS, a major technology company. This incident involves a significant data breach resulting from a ransomware attack, where attackers exfiltrated sensitive corporate data before encrypting systems. Although no specific affected versions or exploited vulnerabilities are detailed, the leak highlights the ongoing threat ransomware groups pose to large enterprises. The attack's medium severity suggests moderate impact, but the large volume of leaked data could have serious confidentiality implications. European organizations, especially those in the technology supply chain or with partnerships with ASUS, may face indirect risks such as data exposure or secondary attacks. Mitigation should focus on enhancing network segmentation, monitoring for data exfiltration, and securing third-party vendor relationships. Countries with strong technology sectors and close economic ties to ASUS, such as Germany, France, and the UK, are more likely to be affected. Given the data leak scale and ransomware context, the threat severity is assessed as high due to potential confidentiality loss and operational disruption. Defenders should prioritize incident response readiness and data leak detection capabilities to mitigate similar threats.

Malware#infosecnews#redditGermany+5

Two US cybersecurity experts have been found guilty of participating in an extortion scheme involving the ALPHV ransomware. This case highlights insider threats where individuals with cybersecurity expertise exploit their knowledge for criminal activities. Although no specific technical vulnerabilities or exploits are detailed, the involvement of trusted experts in ransomware operations raises concerns about the integrity of cybersecurity professionals. The threat does not currently have known exploits in the wild beyond this criminal activity. European organizations could be indirectly impacted due to the global reach of ALPHV ransomware campaigns. Mitigation should focus on insider threat detection, enhanced vetting, and monitoring of cybersecurity personnel. Countries with significant ransomware targeting history and high adoption of cybersecurity services may be more affected. Given the medium severity rating and lack of direct technical exploit details, the threat severity is assessed as medium. Defenders should remain vigilant about insider risks and ransomware extortion schemes involving trusted individuals.

Malware#infosecnews#redditGermany+7

Disney has agreed to pay $10 million to settle a lawsuit alleging violations of children's data privacy on YouTube. The case centers on claims that Disney improperly collected and used personal data from children without adequate consent or safeguards, violating privacy regulations. While this is a significant legal and financial consequence for Disney, it does not represent a direct technical vulnerability or exploit. The settlement highlights the increasing regulatory scrutiny on companies handling children's data, especially in digital and online platforms. European organizations should note the importance of compliance with data protection laws such as GDPR and the ePrivacy Directive, which impose strict requirements on processing children's personal data. This case underscores the risks of non-compliance, including costly legal actions and reputational damage. No active exploits or technical attack vectors are associated with this event. Organizations should review their data collection practices, especially for minors, and ensure transparency, parental consent, and data minimization. Countries with strong data protection enforcement and significant digital media markets, such as Germany, France, and the UK, are particularly relevant in this context. Overall, this incident is a legal and compliance issue rather than a cybersecurity threat or vulnerability requiring technical mitigation.

News#infosecnews#redditGermany+6

The Cl0p ransomware group has leaked 450GB of stolen data containing records of 30,000 Korean Air employees. This data breach exposes sensitive personal and possibly professional information, posing risks of identity theft, phishing, and reputational damage. Although no CVSS score is assigned, the breach is assessed as medium severity due to the volume and sensitivity of data exposed. European organizations, especially those in the aviation sector or with business ties to Korean Air, may face indirect impacts such as targeted phishing or supply chain risks. Mitigation should focus on monitoring for phishing attempts, enhancing employee awareness, and reviewing third-party risk management. Countries with significant aviation industries and strong economic ties to South Korea, such as Germany, France, and the UK, are more likely to be affected. The threat does not involve active exploitation of vulnerabilities but results from a prior compromise and data exfiltration by a known ransomware group. Defenders should prioritize detection of related phishing campaigns and strengthen incident response capabilities.

News#infosecnews#redditGermany+5

The European Space Agency is conducting an investigation and says external science servers have been compromised. The post European Space Agency Confirms Breach After Hacker Offers to Sell Data appeared first on SecurityWeek .

BreachFranceGermany+5

The U. S. Treasury has lifted sanctions on three individuals linked to Intellexa and Predator spyware, a development that may influence the regulatory and threat landscape surrounding these spyware tools. Intellexa and Predator spyware have been associated with surveillance and cyber espionage activities, often targeting activists, journalists, and political opponents. Although no new technical vulnerabilities or exploits are reported in this announcement, the removal of sanctions could affect the availability and distribution of these spyware tools. European organizations should be aware of potential shifts in spyware deployment or vendor operations resulting from this policy change. The threat does not involve direct exploitation or vulnerabilities but relates to geopolitical and regulatory factors impacting spyware proliferation. Mitigation should focus on enhanced detection capabilities for spyware behaviors and monitoring of communications for signs of Predator or Intellexa spyware activity. Countries with significant use of surveillance technology or high-profile political targets, such as France, Germany, Italy, Spain, and the UK, may be more affected. Given the indirect nature of the threat and absence of new exploits, the suggested severity is medium.

News#infosecnews#redditFrance+4

ThreatFox IOCs for 2025-12-31

Indicator#type:osint#tlp:whiteGermany+6