A recent research preprint presents a novel cryptanalysis approach called 'Inverse Dimensionalization' targeting the SHA-256 hash function. The researchers found pairs of inputs producing outputs with an unusually high bit similarity—174 out of 256 bits matching—within seconds on modest hardware. This result is not a collision but indicates a statistically anomalous structural property of SHA-256. While no direct exploit or collision is demonstrated, the findings could have implications for the perceived cryptographic strength of SHA-256. The research is preliminary, with no known exploits in the wild, and its practical impact remains uncertain. European organizations relying on SHA-256 for data integrity, digital signatures, or blockchain technologies should monitor developments closely. Mitigation involves staying updated on cryptographic research and preparing for potential future vulnerabilities. Countries with significant financial, governmental, and technological sectors using SHA-256 extensively are most likely to be affected. The severity is assessed as medium due to the theoretical nature of the findings and lack of immediate exploitability.
The Clop ransomware group has been observed targeting Gladinet CentreStack servers to conduct data theft and extortion attacks. By compromising these file-sharing and cloud storage platforms, attackers exfiltrate sensitive data before deploying ransomware, increasing pressure on victims to pay. This threat is significant due to the critical role CentreStack plays in enterprise file synchronization and sharing, potentially exposing large volumes of corporate data. The attacks do not yet have known public exploits, but the high severity rating reflects the impact of combined data theft and ransomware. European organizations using CentreStack should be vigilant, as the threat could disrupt business operations and lead to data breaches. Mitigation requires specific hardening of CentreStack deployments, network segmentation, and enhanced monitoring for unusual activity. Countries with high adoption of cloud collaboration tools and significant enterprise sectors, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation and the severe consequences of data loss and operational disruption, this threat is assessed as high severity. Defenders must prioritize detection and response capabilities tailored to CentreStack environments to reduce risk.
Recent reports highlight new password spraying attacks targeting VPN gateways from Cisco and Palo Alto Networks (PAN). These attacks attempt to gain unauthorized access by systematically trying commonly used passwords across many accounts, aiming to avoid account lockouts. The threat is significant due to the critical role VPN gateways play in securing remote access for organizations. European organizations using Cisco and PAN VPN solutions are at risk, especially those with remote workforces. Attackers exploit weak or reused passwords without needing sophisticated exploits or zero-day vulnerabilities. The attacks do not currently have known exploits in the wild but are considered high priority due to their potential impact. Defenders should focus on enforcing strong password policies, implementing multi-factor authentication (MFA), and monitoring for unusual login attempts. Countries with high adoption of Cisco and PAN VPNs and significant remote workforce presence, such as Germany, the UK, France, and the Netherlands, are likely most affected. The threat severity is assessed as high given the ease of exploitation, potential for unauthorized access, and critical nature of VPN gateways in network security.
DIG AI is an uncensored AI assistant available on the darknet that facilitates criminal and terrorist activities by providing unrestricted guidance and support. It operates without typical content restrictions, enabling malicious actors to obtain advice on illegal operations, hacking, and other harmful actions. While not a direct software vulnerability, DIG AI represents a significant threat by lowering the barrier for criminals to access sophisticated AI-driven assistance. European organizations could face increased risks from more effective cyberattacks and coordinated criminal campaigns empowered by such AI tools. Mitigation requires enhanced monitoring of darknet activities, improved threat intelligence sharing, and targeted law enforcement actions. Countries with high digital infrastructure, active darknet markets, and strategic geopolitical importance in Europe are more likely to be affected. Given its facilitation of criminal activities and potential to amplify cyber threats, the severity is assessed as high. Defenders should focus on proactive darknet intelligence, AI misuse awareness, and strengthening cyber defenses against AI-augmented threats.
Cybercriminals are spreading the Stealka infostealer disguised as game cheats, mods, and pirated software. It targets sensitive information, cryptocurrency, and account credentials
Multiple threat clusters, including state-aligned and financially-motivated actors, are utilizing phishing tools to trick users into granting access to Microsoft 365 accounts via OAuth device code authorization. This technique leads to account takeovers, data exfiltration, and further compromises. Threat actors are leveraging the OAuth 2.0 device authorization grant flow to gain unauthorized access by approving various applications. Campaigns often begin with an initial message containing a URL, which initiates an attack sequence using Microsoft's legitimate device authorization process. Tools like SquarePhish2 and Graphish are being used to facilitate these attacks. Both cybercriminal groups and state-aligned actors have adopted this technique, with Russia-aligned threat actors being particularly active.
CISA has flagged a critical vulnerability in the ASUS Live Update utility following evidence of active exploitation. This flaw affects the ASUS Live Update software, which is used to deliver firmware and driver updates to ASUS devices. The vulnerability is considered critical due to its potential to allow attackers to execute arbitrary code with elevated privileges, potentially compromising system integrity and confidentiality. Although specific affected versions and technical details are not provided, the active exploitation indicates a high risk to users of ASUS hardware relying on this update mechanism. European organizations using ASUS devices are at risk, especially those in sectors with high-value targets. Mitigation requires immediate attention to update or disable the vulnerable update utility and monitor for suspicious activity. Countries with significant ASUS market penetration and strategic IT infrastructure, such as Germany, France, and the UK, are likely most affected. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation, and active exploitation evidence, the severity is assessed as critical. Defenders should prioritize patching, network segmentation, and endpoint monitoring to reduce exposure.
The Kimsuky threat actor is distributing the DocSwap Android malware through QR code phishing campaigns that impersonate legitimate delivery applications. This malware targets Android devices by tricking users into scanning malicious QR codes, leading to the installation of the malware under the guise of a delivery app. Once installed, DocSwap can potentially exfiltrate sensitive data and perform unauthorized actions on the infected device. The campaign leverages social engineering via QR codes, which are increasingly used in contactless interactions, making it a significant risk vector. European organizations, particularly those with employees or customers using Android devices and relying on delivery services, may be targeted. The threat is rated as high severity due to the malware’s capabilities and the ease of exploitation through user interaction. Mitigation requires targeted user awareness about QR code risks, deployment of mobile threat defense solutions, and strict app installation policies. Countries with high Android usage and significant logistics or delivery sectors, such as Germany, France, and the UK, are more likely to be affected. Given the lack of a CVSS score, the threat is assessed as high severity based on its impact and exploitation method.
France’s counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry The post France Probes ‘Foreign Interference’ After Remote Control Malware Found on Passenger Ferry appeared first on SecurityWeek .
A 22-year-old individual was arrested in France following a hack targeting the French Interior Ministry's systems. While specific technical details of the breach are not disclosed, the incident highlights a successful compromise of a critical government entity. No known exploits or vulnerabilities have been publicly identified in relation to this attack. The severity is assessed as medium, reflecting potential risks to confidentiality and integrity of sensitive governmental data. European organizations, especially governmental bodies, should be vigilant about similar threats. Mitigation should focus on strengthening access controls, monitoring for anomalous activity, and incident response readiness. France is the primary affected country, with potential implications for other European nations due to interconnected governmental and security operations. Given the lack of detailed technical information, the threat's severity is rated medium based on the impact on a high-value target and the apparent unauthorized access. Defenders should prioritize securing critical infrastructure and sharing threat intelligence across European security agencies.
Recent research by ActiveFence evaluated seven major large language models (LLMs) for vulnerabilities related to hate speech, disinformation, fraud, and child safety. The study found that 44% of LLM outputs were risky, with 68% of unsafe outputs related to hate speech, indicating significant weaknesses in content moderation and abuse prevention. Fraud-related outputs were comparatively better managed, but hate speech and child safety remain critical gaps. No tested model was fully safe, highlighting systemic risks in current LLM deployments. This threat is not a traditional software vulnerability but an exploitation of AI model behavior that can propagate harmful content. European organizations using or deploying LLMs should be aware of these risks, especially in sectors sensitive to hate speech and child protection. Mitigation requires tailored content filtering, continuous red-teaming, and collaboration with specialized threat intelligence providers. Countries with high AI adoption and strict regulatory environments around hate speech and child safety are most likely to be affected. Given the broad impact on confidentiality, integrity of information, and potential societal harm, and the ease of exploitation via user prompts, this threat is assessed as high severity.
A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.
The Kimwolf botnet has compromised approximately 1.8 million Android TV devices globally, leveraging them to conduct large-scale distributed denial-of-service (DDoS) attacks. This botnet exploits vulnerabilities in Android TV platforms to gain control without requiring user interaction or authentication. The hijacked devices are then orchestrated to flood targeted networks with traffic, disrupting services and causing outages. European organizations relying on Android TV infrastructure or connected smart devices may face increased risk of service disruption and collateral damage from these attacks. The botnet's scale and use of consumer IoT devices make mitigation challenging, requiring coordinated efforts between device manufacturers, network operators, and end users. Countries with high adoption rates of Android TV and significant digital infrastructure are particularly vulnerable. Immediate mitigation involves network-level traffic filtering, device firmware updates, and enhanced monitoring for unusual traffic patterns. Given the ease of exploitation and broad impact, this threat is assessed as high severity for affected entities in Europe.
A Chinese-nexus advanced persistent threat actor, UAT-9686, is actively targeting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The campaign, ongoing since late November 2025, exploits non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor called AquaShell. Additional tools observed include AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing. The attackers can execute encoded commands in the system shell and create reverse connections to attacker-controlled servers. This sophisticated attack aligns with tactics used by other Chinese APT groups, raising concerns about potential widespread impact on email security infrastructure.
A recently reported security threat involves hackers potentially taking control of car dashboards by exploiting vulnerabilities in the vehicle's modem. This attack vector targets the modem component that connects the car to external networks, allowing remote access to critical vehicle systems such as the dashboard interface. Although no specific affected versions or exploits in the wild have been confirmed, the threat is rated as high severity due to the potential impact on vehicle safety and driver information integrity. European organizations involved in automotive manufacturing, fleet management, and connected car services could face significant risks. Mitigation requires a combination of secure modem firmware updates, network segmentation within vehicle systems, and rigorous security testing of telematics components. Countries with strong automotive industries and high adoption of connected vehicles, such as Germany, France, and Italy, are most likely to be affected. Given the ease of remote exploitation and the critical nature of vehicle control systems, this threat is assessed as high severity. Defenders should prioritize monitoring telematics security, applying vendor patches promptly, and implementing intrusion detection for vehicle networks.
I have already talked about various React2Shell exploit attempts we have observed in the last weeks. But new varieties of the exploit are popping up, and the most recent one is using this particular version of the exploit:
A recent critical cybersecurity threat highlights how misconfigured network devices have become a significant attack vector targeting critical infrastructure, with Russia reportedly pivoting to exploit these weaknesses. The threat involves attackers leveraging improperly secured network equipment to gain unauthorized access, potentially disrupting essential services. Although no known exploits are currently active in the wild, the risk remains high due to the critical nature of affected systems and the ease with which misconfigurations can be exploited. European critical infrastructure entities, especially those relying on legacy or poorly managed network devices, face elevated risks. Mitigation requires thorough configuration audits, network segmentation, and enhanced monitoring tailored to detect anomalous device behavior. Countries with significant industrial control systems and critical infrastructure sectors, such as Germany, France, and the UK, are particularly vulnerable given their technological landscape and geopolitical relevance. The threat severity is assessed as critical due to the potential for widespread disruption, ease of exploitation, and the high-value nature of targeted assets. Defenders should prioritize immediate configuration reviews and implement strict access controls to mitigate this emerging risk.
The ClickFix attack is a social engineering malware campaign that tricks users into installing the DarkGate malware by presenting a fake browser fix prompt. This malware installation method relies on deceiving users rather than exploiting technical vulnerabilities. DarkGate is a known malware family capable of data theft and remote access, posing risks to confidentiality and system integrity. The attack does not currently have known exploits in the wild but is considered medium severity due to its potential impact and user interaction requirement. European organizations are at risk primarily through end-user exposure to malicious web content or phishing campaigns. Mitigation requires user education, strict browser security policies, and endpoint detection capabilities. Countries with high internet usage, significant business sectors reliant on browser-based workflows, and historical malware targeting are more likely to be affected. Given the attack vector and impact, the threat severity is assessed as medium. Defenders should focus on awareness, monitoring, and blocking suspicious browser prompts or downloads.
Parked domains are increasingly being weaponized through direct search advertising, posing significant risks to users. The investigation found that over 90% of visits to parked domains led to scams, malware, or unwanted content. Three key actors were identified: one using lookalike domains and mail collection, another employing sophisticated 'double fast flux' techniques, and a third exploiting DNS configuration typos. These actors actively profile visitors and selectively redirect traffic to malicious advertisers. The complexity of the advertising ecosystem makes it difficult to trace the origin of threats. Recent policy changes and the rise of AI may inadvertently increase risks associated with parked domains.
