Threats affecting Spain

Key Findings Introduction Check Point Research tracks a sustained, highly capable espionage cluster, which we refer to as Ink Dragon, and is referenced in other reports as CL-STA-0049, Earth Alux, or REF7707. This cluster is assessed by several vendors to be PRC-aligned. Since at least early 2023, Ink Dragon has repeatedly targeted government, telecom, and […] The post Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation appeared first on Check Point Research .

CampaignGermanyFrance+6

Askul, a company presumably operating in Japan, has confirmed a ransomware attack resulting in the theft of approximately 740,000 customer records. The attack involved unauthorized access and data exfiltration, typical of ransomware incidents where attackers encrypt data and demand ransom while threatening or executing data leaks. Although no specific technical details about the ransomware variant or exploitation vectors are provided, the breach's scale and data sensitivity classify this as a high-severity incident. European organizations should be aware of similar ransomware threats targeting customer data, as such attacks can disrupt operations and lead to regulatory penalties under GDPR. Mitigation should focus on robust backup strategies, network segmentation, continuous monitoring for unusual activity, and incident response preparedness. Countries with significant business ties to Japan or with large multinational corporations using similar supply chains may be more exposed. Given the data theft and ransomware nature, the suggested severity is high due to the impact on confidentiality and availability, ease of exploitation by ransomware actors, and the broad scope of affected data.

Malware#infosecnews#redditGermany+6

Google plans to discontinue its Dark Web Monitoring tool in February 2026. This tool currently helps users and organizations detect if their credentials or sensitive data have been exposed on dark web forums and marketplaces. The shutdown means users will lose a valuable resource for early detection of data breaches involving their information. While this is not a direct vulnerability or exploit, the removal of this monitoring capability could increase risk exposure if alternative solutions are not adopted. European organizations relying on this service may face challenges in timely breach detection, potentially impacting incident response. The threat landscape remains unchanged, but the reduction in monitoring tools could indirectly elevate risk. Organizations should proactively seek replacement services and enhance internal monitoring to compensate. Countries with high digital adoption and strong regulatory requirements for data protection are likely to be most affected. Overall, this event represents a strategic shift in available cybersecurity resources rather than an active exploit or vulnerability.

Tool#infosecnews#redditGermany+6

The French Interior Ministry has publicly disclosed that hackers breached its email servers, potentially compromising sensitive government communications. While detailed technical information about the breach is not available, the incident highlights a significant security failure within a critical government infrastructure. No known exploits or vulnerabilities have been reported in the wild related to this breach. The attack likely targeted confidential information, risking exposure of sensitive data and undermining trust in government cybersecurity. European organizations, especially governmental bodies, should be alert to similar threats. Mitigation requires enhanced email security protocols, continuous monitoring, and incident response readiness. Given the strategic importance of France and its government institutions, this breach may have wider geopolitical implications. Countries with close ties or similar infrastructure may also be at increased risk. The severity is assessed as medium due to the breach of confidentiality and potential for further exploitation, despite limited public technical details and no evidence of widespread exploitation.

News#infosecnews#redditFrance+6

The 700Credit data breach exposed sensitive personal information of approximately 5.6 million consumers, including Social Security Numbers (SSNs). This breach represents a significant compromise of confidential consumer data, potentially enabling identity theft and fraud. The breach was reported recently and has been classified as high severity due to the nature and volume of data exposed. There are no known exploits in the wild related to this breach, but the impact remains critical given the sensitivity of the information. European organizations that handle consumer credit data or have partnerships with 700Credit or similar entities could face indirect risks from this breach. Mitigation requires enhanced monitoring for fraudulent activities, notification to affected individuals, and strengthening data protection measures. Countries with large financial sectors and high consumer credit usage in Europe are more likely to be affected. The breach severity is assessed as critical due to the exposure of SSNs, the ease of exploitation by malicious actors, and the broad scope of affected individuals. Defenders should prioritize incident response, customer communication, and review of third-party data security practices.

Breach#infosecnews#redditGermany+6

DDoSia, a participatory DDoS tool created by Russian hacktivists in 2022, is operated by the pro-Russian group NoName057(16). It relies on volunteers to contribute network resources for attacks, primarily targeting Ukraine, European allies, and NATO states. Censys has monitored DDoSia since mid-2025, observing an average of 6 control servers with short lifespans. The tool uses a multi-layered control infrastructure, with systems typically hosted on VPS providers. Despite law enforcement disruption in July 2025, DDoSia quickly reconstituted and resumed operations. The infrastructure is characterized by rapid changes, with most servers active for less than 24 hours. Attacks focus on government, military, transportation, public utilities, financial, and tourism sectors.

Malware#ddosia#ddosUkraine+9

A Russian APT group has been conducting targeted phishing campaigns against government entities in the Baltic and Balkan regions since at least 2023. The attackers use spoofed email attachments mimicking official documents to trick victims into submitting credentials on sophisticated fake login pages. These phishing pages feature blurred backgrounds and complex password validation, yet stolen credentials are exfiltrated regardless of password strength. The campaign specifically targets countries including Moldova, Ukraine, Lithuania, Bosnia and Herzegovina, Macedonia, Montenegro, Spain, and Bulgaria. The stolen credentials are sent to third-party services, enabling potential unauthorized access to sensitive government systems. This ongoing campaign poses a medium-level threat due to its targeted nature and potential for credential theft leading to further compromise. Defenders should focus on phishing awareness, email filtering, and credential monitoring to mitigate risks. The threat is particularly relevant to European government organizations in the affected regions due to geopolitical tensions and strategic importance.

Campaign#phishing#eastern europeBulgaria+7

ThreatFox IOCs for 2025-12-16

Indicator#type:osint#tlp:whiteGermany+5

Hackers have stolen Premium member activity data from PornHub and are extorting the company. The breach involves sensitive user information related to premium subscriptions, potentially exposing user privacy and leading to reputational damage. Although no known exploits are currently active in the wild, the incident highlights risks associated with data protection in adult content platforms. European organizations, especially those handling sensitive user data, should be aware of the implications of such breaches. The threat underscores the importance of securing user databases and monitoring for extortion attempts. Mitigation requires enhanced data security measures, incident response readiness, and user privacy protections. Countries with significant adult content market penetration and strong privacy regulations may be more affected. The severity is assessed as high due to the sensitive nature of the data, potential for user harm, and extortion risk. Defenders must prioritize protecting sensitive user data and preparing for extortion scenarios.

News#infosecnews#redditGermany+6

A widely used Chrome browser extension has been discovered intercepting millions of users' AI chat data, potentially exposing sensitive conversational information. This interception could lead to privacy violations and unauthorized data collection. The threat involves a malicious or compromised extension operating within users' browsers, capturing AI chat interactions without consent. Although no known exploits in the wild have been reported yet, the scale of affected users and the sensitivity of intercepted data elevate the risk. European organizations using this extension or similar AI chat tools via browsers are at risk of data leakage and privacy breaches. Attackers could leverage intercepted data for espionage, fraud, or further attacks. Mitigation requires immediate review and removal of suspicious extensions, enhanced monitoring of browser activity, and user awareness campaigns. Countries with high Chrome browser usage and significant AI adoption, such as Germany, France, and the UK, are most likely impacted. Given the ease of exploitation and potential confidentiality impact, the threat severity is assessed as high.

News#infosecnews#redditGermany+6

A detailed guide on detecting and responding to forgotten and outdated servers, API endpoints, user accounts, websites, and other IT assets.

Analysis#webGermany+7

Google has linked multiple Chinese hacking groups to attacks leveraging the React2Shell vulnerability, a critical security flaw affecting systems that use the React2Shell component. These attacks are part of a broader campaign targeting organizations globally, with a high severity rating due to the potential for remote code execution and system compromise. Although no known exploits are currently in the wild, the association with state-sponsored groups increases the threat's credibility and urgency. European organizations using affected systems are at risk of espionage, data theft, and operational disruption. Mitigation requires immediate patching of vulnerable components, enhanced network monitoring for suspicious activity, and restricting exposure of vulnerable services. Countries with significant technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are likely to be primary targets. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize detection and response capabilities to mitigate potential intrusions linked to this campaign.

News#infosecnews#redditGermany+7

The 700Credit data breach has exposed sensitive information of approximately 5.8 million customers associated with vehicle dealerships. This breach potentially involves personal and financial data collected during credit checks and financing processes. Although specific technical details of the breach vector are not disclosed, the scale and nature of the compromised data pose significant risks of identity theft, financial fraud, and reputational damage. European organizations connected to vehicle financing or dealerships may face indirect impacts, especially if they share data or systems with affected U. S. -based entities. Mitigation requires enhanced monitoring for fraudulent activities, strict access controls, and thorough vendor risk assessments. Countries with substantial automotive markets and financial services sectors, such as Germany, France, and the UK, are more likely to be affected due to their economic ties and data exchange with U. S.

Breach#infosecnews#redditGermany+5

AI can be used by extremist groups to pump out propaganda or deepfakes at scale, widening their reach and expanding their influence. The post Militant Groups Are Experimenting With AI, and the Risks Are Expected to Grow appeared first on SecurityWeek .

NewsFranceGermany+7

Google has also mentioned seeing React2Shell attacks conducted by Iranian threat actors. The post Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery appeared first on SecurityWeek .

MalwareGermanyFrance+5

A massive MongoDB database containing 16TB of data has been exposed, leaking approximately 4.3 billion lead generation records. This exposure likely results from misconfigured database instances accessible without proper authentication or security controls. Although no known exploits are currently in the wild, the sheer volume of sensitive personal and business lead data presents significant confidentiality risks. European organizations relying on MongoDB or handling lead generation data could face privacy violations and regulatory penalties if their data is similarly exposed. Attackers could leverage this data for phishing, fraud, or identity theft. Mitigation requires immediate auditing of MongoDB deployments, enforcing strong authentication, network segmentation, and continuous monitoring for unauthorized access. Countries with high MongoDB adoption and large marketing sectors, such as the UK, Germany, and France, are most at risk. Given the ease of exploitation through misconfiguration and the extensive data exposure, the severity is assessed as high. Defenders must prioritize securing database instances and validating access controls to prevent similar breaches.

News#infosecnews#redditGermany+5

For the latest discoveries in cyber research for the week of 15th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Indian government confirmed cyber incidents involving GPS spoofing at seven major airports, including Delhi, Mumbai, Kolkata, and Bengaluru. The attack affected aircrafts using GPS-based landing procedures. Despite signal disruption to navigation […] The post 15th December – Threat Intelligence Report appeared first on Check Point Research .

AnalysisFranceGermany+10

Hamas-linked threat actors have been reported to deploy AshTag malware targeting diplomatic offices. The malware campaign appears focused on espionage activities against diplomatic entities, aiming to compromise sensitive communications and data. The threat is currently assessed as medium severity, with no known exploits in the wild or detailed technical indicators publicly available. The attack vector and infection methods remain unclear, limiting immediate detection and response capabilities. European diplomatic missions and foreign affairs offices could be potential targets due to their strategic importance. Mitigation requires enhanced monitoring of diplomatic networks, threat intelligence sharing, and strict access controls. Countries with significant diplomatic presence and geopolitical relevance in Middle East affairs are at higher risk. Given the limited technical details and absence of widespread exploitation, the overall risk is medium but warrants vigilance. Defenders should prioritize intelligence gathering and network segmentation to reduce exposure.

Malware#infosecnews#redditFrance+8

A significant data breach at Coupang, a major e-commerce company, has compromised the personal information of approximately 33.7 million users, leading to the resignation of its CEO. The breach was publicly reported via Reddit and covered by cybersecurity news outlets. Although technical details about the breach vector or exploited vulnerabilities are not provided, the scale indicates a severe compromise of user data. No known exploits or patches have been disclosed yet. The breach poses substantial risks to confidentiality and privacy, potentially enabling identity theft, fraud, and reputational damage. European organizations should be alert to similar threats targeting large e-commerce platforms and ensure robust data protection measures. Countries with strong e-commerce markets and data protection regulations, such as Germany, France, and the UK, may be particularly sensitive to such incidents. Given the breach's scale and impact on user data confidentiality, the severity is assessed as high. Immediate mitigation includes reviewing third-party vendor security, enhancing monitoring for unusual data access, and preparing incident response plans focused on data breach containment and notification compliance.

Breach#infosecnews#redditGermany+6

CERT-FR has issued a recommendation to completely deactivate Wi-Fi whenever it is not in use to reduce attack surfaces and prevent potential unauthorized access. This advisory highlights the risks associated with leaving Wi-Fi enabled unnecessarily, which can expose devices and networks to various wireless attacks such as unauthorized access, man-in-the-middle, and exploitation of Wi-Fi protocol vulnerabilities. Although no specific vulnerability or exploit is detailed, the guidance aims to mitigate risks by minimizing wireless exposure. European organizations, especially those with sensitive data or critical infrastructure, should consider this practice to enhance their security posture. The recommendation is particularly relevant for environments where Wi-Fi is not continuously needed, such as offices after hours or industrial settings. Countries with high adoption of Wi-Fi-enabled devices and critical infrastructure reliant on wireless connectivity are more likely to benefit from this advice. Given the medium severity rating and lack of known exploits, the threat is more about reducing risk exposure than responding to an active exploit. Practical mitigation includes disabling Wi-Fi radios when idle, enforcing strict network access controls, and monitoring for unauthorized wireless activity. This advisory serves as a reminder that wireless interfaces represent a persistent attack vector and should be managed proactively to reduce potential compromise.

News#infosecnews#redditFrance+7