RansomHouse, a ransomware-as-a-service operated by the Jolly Scorpius group, has upgraded its encryption capabilities with a new version of its Mario ransomware component. This upgrade introduces a sophisticated two-stage encryption process, enhanced memory management, and dynamic file processing, making the ransomware more efficient and harder to analyze. The attack chain involves MrAgent managing deployments and Mario performing file encryption, primarily targeting virtualized environments such as ESXi servers. Although no known exploits are currently in the wild, the improvements signal a trend toward more resilient ransomware variants. European organizations using virtualized infrastructure are at risk, especially those with ESXi deployments. The threat requires no known CVE but poses a medium severity risk due to its complexity and potential impact on availability and data confidentiality. Mitigation should focus on securing virtualization platforms, monitoring for indicators of compromise, and implementing robust backup and recovery strategies. Countries with high virtualization adoption and critical infrastructure reliance on virtual environments are most likely to be affected.
The trucking industry group has released its 2026 Transportation Industry Cybersecurity Trends Report. The post NMFTA Warns of Surge and Sophistication of Cyber-Enabled Cargo Theft appeared first on SecurityWeek .
The Askul data breach resulted from a ransomware attack that exposed over 700,000 records, compromising sensitive information. This incident highlights the growing threat of ransomware targeting corporate networks and the consequential data leaks. The breach likely involved unauthorized access followed by data exfiltration before encryption. European organizations, especially those with supply chain or business ties to Askul, may face indirect impacts such as data privacy concerns and regulatory scrutiny. Mitigation requires enhanced ransomware defenses, including network segmentation, robust backup strategies, and continuous monitoring for anomalous activity. Countries with significant logistics, retail, or supply chain sectors, such as Germany, France, and the UK, are more likely to be affected due to their economic ties and market penetration of similar services. Given the high volume of exposed records and the nature of ransomware attacks, the severity is assessed as high. Defenders should prioritize incident response readiness and data protection measures to mitigate similar threats.
The malware provides full device control and real-time surveillance capabilities like those of advanced spyware. The post New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps appeared first on SecurityWeek .
Hackers claim to have stolen 94GB of Pornhub Premium users' watch histories, potentially exposing sensitive personal data related to adult content consumption. Although the claim originates from a Reddit post linking to a third-party news site, there is minimal technical detail or confirmation of the breach. The data allegedly includes detailed user activity logs, which could lead to privacy violations and reputational damage for affected individuals. There is no evidence of known exploits in the wild or patches available. The impact on European organizations is indirect but significant for privacy compliance and user trust, especially given GDPR regulations. Mitigation focuses on monitoring for data leaks, enhancing user data protection, and preparing incident response plans. Countries with higher Pornhub usage and strong privacy enforcement, such as Germany, France, and the UK, are more likely to be affected. Given the sensitivity of the data and potential privacy impact, the severity is assessed as medium. Defenders should prioritize data leak detection and user notification readiness.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting multiple Fortinet products to its Known Exploited Vulnerabilities catalog. Although no specific CVSS score or detailed technical information is provided, the flaw is considered medium severity and currently has no known exploits in the wild. This vulnerability impacts Fortinet devices, which are widely used for network security, including firewalls and VPNs, making it a relevant concern for organizations relying on these products. European organizations using Fortinet products should be aware of this addition to CISA's catalog and prioritize monitoring and patching once updates become available. The threat does not require user interaction but may allow unauthorized access or disruption if exploited. Countries with significant Fortinet deployments and critical infrastructure reliance on these devices are at higher risk. Immediate mitigation steps include reviewing Fortinet advisories, applying patches promptly, and enhancing network monitoring for suspicious activity. Given the medium severity and lack of known exploits, the threat should be taken seriously but does not currently represent an urgent crisis.
The Chinese Ink Dragon threat group has been identified as operating covertly within European government networks, engaging in a cyber espionage campaign. This activity involves persistent unauthorized access, likely aimed at intelligence gathering and strategic advantage. The campaign is considered high severity due to the sensitive nature of the targets and the potential impact on government confidentiality and operations. Although specific technical details and indicators of compromise are limited, the threat actor’s presence in critical government infrastructure poses significant risks. European organizations, especially government entities, face risks including data exfiltration, disruption of services, and compromise of sensitive information. Mitigation requires targeted network monitoring, enhanced threat hunting, and strict access controls tailored to government environments. Countries with high government digitalization and geopolitical relevance to China are most at risk. Given the stealth and persistence of the group, the threat is assessed as high severity, reflecting the potential for substantial confidentiality and integrity impacts without requiring user interaction. Defenders should prioritize detection and response capabilities focused on advanced persistent threat behaviors.
LKQ said the personal information of thousands of individuals was compromised as a result of the hacker attack. The post Auto Parts Giant LKQ Confirms Oracle EBS Breach appeared first on SecurityWeek .
A spear phishing campaign targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism was discovered in September 2025. The attack, attributed to BlindEagle, utilized a compromised email account within the organization to bypass security controls. The campaign employed a sophisticated multi-layer attack chain, including a fake web portal, nested JavaScript and PowerShell scripts, steganography, and the deployment of Caminho as a downloader for DCRAT. The attack leveraged legal-themed lures, in-memory execution, and abuse of legitimate services like Discord. BlindEagle's evolution in tactics and use of new tools like Caminho demonstrates their ongoing threat to Colombian institutions.
SoundCloud has suffered a significant cyberattack resulting in a data breach that affects approximately 20% of its user base. The breach was publicly disclosed via Reddit and reported by hackread.com, highlighting the compromise of user data. Although specific technical details and exploited vulnerabilities have not been disclosed, the incident is classified as high severity due to the scale of affected users and potential data exposure. There is no indication that known exploits are currently in the wild, and the discussion level remains minimal. European organizations and users of SoundCloud may face risks related to personal data exposure and potential follow-on phishing or credential stuffing attacks. Mitigation focuses on user awareness, enhanced monitoring, and SoundCloud implementing stronger security controls and transparent communication. Countries with high SoundCloud user penetration and strong digital music markets, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the breach scale and potential impact on confidentiality and integrity of user data, the suggested severity is high. Defenders should prioritize incident response, user notification, and proactive threat hunting to mitigate further risks.
Hypervisors, the core components of virtualization environments, have become attractive targets for ransomware attacks due to their critical role in managing multiple virtual machines. Compromising a hypervisor can enable attackers to encrypt or disrupt numerous virtual machines simultaneously, amplifying the impact of ransomware campaigns. This threat highlights the increasing trend of ransomware actors focusing on virtualization infrastructure to maximize damage and ransom demands. European organizations relying heavily on virtualized environments, especially in sectors like finance, healthcare, and government, face elevated risks. The ease of exploitation depends on the presence of vulnerabilities or misconfigurations in hypervisor platforms, often requiring some level of access or privilege escalation. Mitigation involves rigorous patch management, network segmentation, strict access controls, and continuous monitoring of virtualization layers. Countries with high adoption of virtualization technologies and critical infrastructure sectors, such as Germany, France, and the UK, are particularly at risk. Given the potential for widespread disruption and data loss, this threat is assessed as high severity. Defenders should prioritize securing hypervisor environments to prevent ransomware from leveraging this attack vector.
The state of Texas has initiated legal action against certain television manufacturers accused of covertly capturing screenshots of users' viewing content without consent. This practice raises significant privacy and data protection concerns, as it involves unauthorized surveillance and potential sale of personal viewing data. Although no specific technical vulnerabilities or exploits have been disclosed, the incident highlights risks related to unauthorized data collection embedded within consumer electronics. European organizations and consumers could face similar privacy infringements if such practices are widespread or if devices with similar capabilities are marketed in Europe. The threat primarily impacts confidentiality and user privacy rather than direct system integrity or availability. Mitigation involves strict regulatory enforcement, consumer awareness, and scrutiny of device firmware and software for unauthorized data collection. Countries with high smart TV adoption and strong privacy regulations, such as Germany, France, and the UK, are particularly relevant in this context. Given the covert nature of the data collection and the potential for widespread privacy violations without user consent, the suggested severity is high. Defenders should focus on privacy audits, vendor transparency, and legal compliance to mitigate risks.
new phishing scam is exploiting Telegram’s built-in Mini Apps: fraudsters are running fake giveaways to steal accounts. Here’s how to protect yourself.
Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.
A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption function and diverse decoy behaviors. Infrastructure overlaps and Korean language comments link this activity to Kimsuky. The threat actor employs sophisticated phishing techniques and leverages QR codes to redirect victims to malicious downloads. The malware requests extensive permissions and implements keylogging, audio recording, and data exfiltration. Multiple C&C servers were identified, some hosting Naver and Kakao phishing sites.
The Urban VPN browser extension and related extensions from the same publisher have been found to covertly harvest AI chat conversations from millions of users. Hidden scripts injected into AI chat services intercept all prompts and responses, capturing conversation content, timestamps, and session metadata. This data is sent back to Urban VPN’s servers regardless of whether the VPN is active, and users cannot opt out except by uninstalling the extension. The data collection feature was silently introduced via an auto-update in July 2025, affecting over 8 million installs. Despite advertising an “AI protection” feature, the extension fails to prevent data exfiltration and merely warns users about data sharing. Users who have used these extensions with AI chat services should consider their interactions compromised and remove the extension immediately.
This discussion highlights a technique used by headless bots to evade detection by mimicking WebView browser behaviors, specifically by exploiting inconsistencies in Sec-Fetch headers and Client Hints. The technique allows automated tools to appear as legitimate WebView clients, complicating bot detection mechanisms that rely on these HTTP header signals. While not a vulnerability or exploit itself, this method can be leveraged by attackers to bypass security controls designed to block automation and scraping. The threat is primarily relevant to web application defenders who rely on Sec-Fetch and Client Hints for bot mitigation. There is no known exploit in the wild, and the discussion is based on a recent Reddit post linking to a blog analysis. European organizations with web-facing services that use these headers for bot detection may face increased risk of automated abuse. Mitigation requires enhancing detection beyond header inspection, including behavioral analysis and fingerprinting. Countries with large digital economies and advanced web services are more likely to be impacted. The severity is assessed as medium due to the indirect nature of the threat and the requirement for sophisticated bot implementation.
A high-severity authentication bypass vulnerability affecting Fortinet FortiGate devices using SAML SSO has been reported and is under active attack. The flaw allows attackers to bypass SAML-based authentication, potentially gaining unauthorized access without valid credentials. Although no CVE or patch information is currently available, the threat is considered high priority due to the critical role FortiGate devices play in network security. European organizations relying on FortiGate for perimeter defense and VPN access are at risk of compromise, data breaches, and network infiltration. Mitigation requires immediate review of SAML configurations, monitoring for suspicious authentication attempts, and applying any forthcoming vendor advisories. Countries with high Fortinet market penetration and strategic infrastructure are most vulnerable. The ease of exploitation and impact on confidentiality and integrity justify a high severity rating. Defenders must prioritize detection and containment while awaiting official patches.
European authorities have dismantled a call center fraud ring operating in Ukraine that targeted European victims. This criminal operation used call centers to conduct fraudulent activities, likely involving social engineering and financial scams. While no specific technical vulnerabilities or exploits are detailed, the disruption of this organized crime group highlights ongoing risks from call center fraud schemes. The threat primarily impacts European organizations and individuals susceptible to social engineering attacks. The operation's takedown reduces immediate risk but underscores the need for vigilance against similar fraud tactics. Ukrainian-based fraud rings have historically targeted European countries due to geographic proximity and language capabilities. The threat does not involve software vulnerabilities but represents a significant social engineering and financial fraud risk. European entities should enhance awareness and detection of call center fraud attempts. Countries with strong economic ties and large populations are more likely to be targeted.
