Threats affecting Spain

ThreatFox IOCs for 2025-12-11

Indicator#type:osint#tlp:whiteGermany+5

DroidLock is a newly identified Android malware that locks infected devices and demands a ransom to restore access. It operates by taking control of the device's lock screen, effectively denying user access until payment is made. Although no specific affected Android versions are listed, the malware targets mobile users broadly. There are currently no known exploits in the wild beyond initial reports, and technical details remain limited. The malware represents a high-severity threat due to its potential to disrupt device availability and extort users. European organizations with employees using Android devices for business risk operational disruption and data access issues. Mitigation requires proactive mobile device management, user education on avoiding suspicious apps, and rapid incident response capabilities. Countries with high Android adoption and significant mobile workforce presence, such as Germany, France, the UK, Italy, and Spain, are most likely to be impacted. Given the ransomware nature, ease of exploitation via social engineering or malicious apps, and significant impact on availability and confidentiality, the threat severity is assessed as high. Defenders should prioritize detection of suspicious lock screen behavior and ensure robust backup and recovery procedures for mobile endpoints.

Malware#infosecnews#redditGermany+7

A torrent distribution of Leonardo DiCaprio’s movie "One Battle After Another" has been identified as a vector for the Agent Tesla malware. Agent Tesla is a well-known information stealer that targets credentials and sensitive data from infected systems. The malware is typically distributed via malicious downloads, including pirated content such as torrents. This threat poses a medium risk due to the potential for credential theft and data compromise, especially for users who download pirated media. European organizations could be impacted if employees or users inadvertently download such torrents on corporate or personal devices connected to corporate networks. Mitigation requires user education on the risks of pirated content, network monitoring for malware indicators, and endpoint protection with behavioral detection capabilities. Countries with high torrent usage and significant media consumption, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s capability to steal sensitive information and the ease of exploitation via social engineering, the suggested severity is medium. Defenders should prioritize awareness campaigns and technical controls to prevent infection and lateral movement within networks.

News#infosecnews#redditGermany+6

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

NANOREMOTE is a newly identified Windows backdoor malware closely related to the previously known FINALDRAFT malware family. It uniquely leverages the Google Drive API for stealthy data exfiltration and payload staging, complicating detection efforts. The malware communicates with a hardcoded IP over HTTP using encrypted and compressed JSON data and supports 22 command handlers for system reconnaissance, file operations, and command execution. Its modular design includes a task management system for file transfers and incorporates open-source components. NANOREMOTE’s similarity to FINALDRAFT indicates a shared codebase and development environment, suggesting ongoing evolution of this threat. Although no known exploits are reported in the wild yet, its capabilities pose a medium risk. Detection is challenging due to its use of legitimate cloud services for malicious activity. European organizations should be vigilant, especially those with Windows environments and reliance on Google Drive services.

Malware#command execution#file exfiltrationGermany+5

This threat involves a detailed guide posted on Reddit describing how to conduct a covert red team phishing campaign, including reconnaissance and adversary-in-the-middle (AITM) session capture techniques. Although it does not provide direct exploits or malware, it offers tactical knowledge that could be leveraged by threat actors to craft sophisticated phishing attacks. The post lacks specific details on creating a Microsoft 365 proxy configuration, leaving that as an exercise for readers, which may limit immediate exploitation. No known exploits are currently in the wild based on this information. The threat is categorized as medium severity due to its potential to facilitate targeted phishing campaigns that could compromise credentials and session integrity. European organizations, especially those heavily reliant on Microsoft 365 and similar cloud services, could be at risk if threat actors apply these techniques. Mitigation requires advanced phishing detection, user training focused on AITM attack vectors, and enhanced monitoring of session anomalies. Countries with high adoption of Microsoft 365 and significant exposure to APT activity, such as the UK, Germany, France, and the Netherlands, are more likely to be targeted. The threat does not require direct software vulnerabilities or exploits but depends on social engineering and technical interception methods, making it moderately difficult to execute but impactful if successful.

Phishing#netsec#redditGermany+5

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a significant threat due to its dual mission. The attack chain involves a fake Teams website, malicious ZIP files, and binary data retrieval from XML and JSON files. The malware exploits rundll32.exe for binary proxy execution and establishes C2 communication. Attribution to Silver Fox is based on overlapping infrastructure and links to previous campaigns. Organizations with global operations, especially in China, are advised to implement robust security measures and logging capabilities to defend against this evolving threat.

Malware#false flag#valleyratChina+6

SOAPwn is a security research finding that demonstrates exploitation techniques targeting . NET Framework applications using HTTP client proxies and WSDL (Web Services Description Language). The research reveals how attackers can leverage misconfigurations or vulnerabilities in HTTP proxy handling and WSDL processing to compromise . NET applications. Although no known exploits are currently observed in the wild, the threat highlights a medium-severity risk due to potential unauthorized access or code execution. European organizations using . NET Framework applications that consume SOAP services via HTTP proxies should be aware of this threat. Mitigations include careful configuration of HTTP clients, validation of WSDL inputs, and restricting proxy usage. Countries with significant . NET enterprise deployments and critical infrastructure relying on SOAP-based services are more likely to be impacted.

Tool#netsec#redditGermany+7

The FBI has issued a warning about scams involving fake videos used to deceive victims, typically as part of phishing campaigns. These scams leverage manipulated or fabricated video content to trick users into divulging sensitive information or performing actions that compromise security. While no specific software vulnerabilities are exploited, the threat relies on social engineering and the increasing sophistication of video forgery techniques. The threat is classified as medium severity due to its potential to impact confidentiality and integrity through deception, though it does not directly affect system availability. European organizations are at risk, especially those with high exposure to phishing attacks and those in sectors targeted by fraudsters. Mitigation requires enhanced user awareness training focused on recognizing fake video content, deployment of advanced email and web filtering solutions, and verification protocols for video-based communications. Countries with large digital economies and high internet penetration, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant data compromise, the suggested severity is medium. Defenders should prioritize user education and implement multi-factor verification for sensitive transactions involving video communications.

Phishing#infosecnews#redditGermany+6

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

MalwareGermanyFrance+8

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added newly discovered vulnerabilities affecting Microsoft Windows and WinRAR to its Known Exploited Vulnerabilities catalog. These flaws have been identified as actively exploited or highly likely to be exploited, prompting increased attention from security professionals. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates a significant risk to systems running these widely used software products. The vulnerabilities are currently rated as medium severity, with no confirmed exploits in the wild reported yet. European organizations using Microsoft Windows and WinRAR should be vigilant, as these products are ubiquitous across enterprises and consumers. The threat could impact confidentiality, integrity, and availability if exploited, especially in environments where these applications are critical. Mitigation requires timely patching once updates are available, enhanced monitoring for suspicious activity, and restricting WinRAR usage or applying configuration hardening. Countries with high adoption of Microsoft Windows and WinRAR, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

News#infosecnews#redditGermany+7

The DeadLock ransomware campaign employs a new Bring Your Own Vulnerable Driver (BYOVD) loader exploiting CVE-2024-51324, a vulnerability in Baidu Antivirus driver, to evade endpoint detection and response (EDR) tools. Attackers use PowerShell scripts to bypass User Account Control (UAC), disable Windows Defender, terminate security services, and delete volume shadow copies, facilitating ransomware deployment. DeadLock ransomware targets Windows systems with a custom stream cipher encryption using time-based cryptographic keys, employing advanced techniques such as recursive directory traversal, memory-mapped file I/O, and multi-threaded processing. Initial access is gained through compromised accounts, followed by system registry modifications, remote access establishment, reconnaissance, lateral movement, and defense impairment. Although no known exploits are currently in the wild, the sophisticated use of BYOVD and defense evasion techniques poses a significant threat to organizations. The attack complexity and multi-stage process highlight the need for targeted mitigation strategies. This threat is particularly relevant to European organizations using Baidu Antivirus or similar vulnerable drivers and those with Windows-based infrastructure. The suggested severity is high due to the potential for widespread impact, ease of defense evasion, and the ransomware’s destructive capabilities.

EPSS 0.5%Malware#deadlock#edr evasionGermany+9

Doctor Web experts have discovered a unique malware called Trojan.ChimeraWire targeting Windows computers. This trojan simulates user actions to artificially boost website rankings in search engine results. It uses the Google Chrome browser in debug mode and employs various techniques to avoid detection. The malware is distributed through multiple infection chains involving different downloaders and exploits. ChimeraWire's functionality includes automated CAPTCHA solving and simulating user clicks on websites. While currently focused on simple clicker tasks, the trojan's underlying tools have potential for more advanced malicious activities, such as form filling, web scraping, and cyber espionage. The researchers expect future versions of ChimeraWire to implement these additional features.

Malware#chimerawire#clickerGermany+5

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.

Campaign#domain spoofing#fileless executionGermany+9

The Spiderman Phishing Kit is a newly identified phishing toolkit targeting European banks, designed to steal user credentials in real-time. It enables attackers to capture login details as victims interact with fake banking websites. The kit is reported via Reddit and linked from a cybersecurity news source, indicating emerging threat activity but with minimal current discussion or exploitation evidence. This phishing campaign focuses on European financial institutions, potentially impacting customer data confidentiality and banking operations. The attack requires user interaction, typically through deceptive emails or messages leading to fraudulent sites. No known exploits or patches exist yet, and the threat is assessed as medium severity due to its targeted nature and real-time credential theft capability. European organizations, especially banks and their customers, should be vigilant and implement specific anti-phishing controls. Countries with significant banking sectors and high internet banking adoption are more likely to be targeted. Immediate mitigation includes enhanced email filtering, user awareness training, and multi-factor authentication enforcement. Given the lack of CVSS score, the threat is assessed as medium severity considering the impact on confidentiality and the need for user interaction for exploitation.

Phishing#infosecnews#redditGermany+7

Fortinet has disclosed critical authentication bypass vulnerabilities affecting FortiCloud's Single Sign-On (SSO) login mechanism. These flaws allow attackers to circumvent authentication controls, potentially gaining unauthorized access to FortiCloud management interfaces without valid credentials. Although no known exploits are currently observed in the wild, the critical severity rating underscores the urgency for organizations to address these issues promptly. The vulnerabilities impact the confidentiality and integrity of cloud-managed Fortinet devices and services, posing significant risks to network security. European organizations relying on FortiCloud for centralized device management and SSO are particularly at risk. Mitigation requires immediate application of vendor patches once available, strict monitoring of FortiCloud access logs, and implementing compensating controls such as multi-factor authentication and network segmentation. Countries with high Fortinet market penetration and critical infrastructure deployments, including Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected. Given the ease of exploitation without authentication and the broad impact on cloud-managed security infrastructure, the suggested severity is critical. Defenders must prioritize patch management and enhance monitoring to prevent potential unauthorized access and lateral movement within networks.

News#infosecnews#redditGermany+7

The Broadside botnet is a malware campaign targeting TBK brand DVR devices, raising concerns particularly for maritime logistics sectors that rely on these devices. This botnet infects vulnerable DVRs to conscript them into a larger network of compromised devices, potentially enabling distributed denial-of-service (DDoS) attacks or other malicious activities. Although no known exploits are currently active in the wild, the threat is considered medium severity due to the potential impact on maritime operations and critical infrastructure. The botnet's focus on TBK DVRs, which are commonly used in maritime logistics for surveillance and monitoring, highlights a strategic targeting of supply chain and port security systems. European organizations involved in maritime transport and port operations could face operational disruptions and data confidentiality risks if infected. Mitigation requires targeted actions such as network segmentation of DVR devices, strict access controls, firmware updates where available, and enhanced monitoring for unusual network traffic patterns. Countries with significant maritime trade and port infrastructure, such as the Netherlands, Germany, Belgium, Spain, and Italy, are most likely to be affected. Given the medium severity, the threat demands proactive defense measures but does not currently indicate widespread exploitation or critical system compromise. Defenders should prioritize securing TBK DVR devices and related maritime logistics systems to prevent botnet infiltration and potential service disruptions.

Malware#infosecnews#redditNetherlands+6

Ransomware IAB is a newly reported malware strain that abuses Endpoint Detection and Response (EDR) solutions to execute its payload stealthily, evading traditional detection mechanisms. By leveraging the trust and elevated privileges of EDR software, the ransomware can bypass security controls and maintain persistence on infected systems. Although no known exploits are currently observed in the wild, the technique represents a sophisticated escalation in ransomware tactics. European organizations relying heavily on EDR solutions for endpoint security may face increased risk due to this stealthy execution method. The threat is assessed as high severity given its potential to compromise confidentiality, integrity, and availability without requiring user interaction. Mitigation requires advanced monitoring of EDR behavior, strict application control policies, and rapid incident response capabilities. Countries with high adoption of EDR technologies and critical infrastructure sectors are most likely to be targeted. Immediate attention to this emerging threat is recommended to prevent impactful ransomware incidents in Europe.

Malware#infosecnews#redditGermany+7

A teenager in Spain was arrested for stealing 64 million personal data records, highlighting a significant data breach incident. The stolen data likely includes sensitive personal information, posing risks of identity theft and fraud. Although no specific technical details about the breach method or affected systems are provided, the scale of the data theft indicates a major compromise. European organizations face increased risks from such large-scale data breaches, especially regarding compliance with GDPR and potential reputational damage. Mitigation requires enhanced data protection measures, continuous monitoring, and incident response readiness. Spain and other European countries with high digital adoption and large data repositories are particularly vulnerable. The severity of this threat is high due to the volume of data compromised and the potential impact on confidentiality and privacy. Defenders should prioritize data security audits, access controls, and employee awareness to prevent similar incidents. No known exploits or patches are mentioned, emphasizing the need for proactive security strategies.

News#infosecnews#redditSpain+5