A malicious email campaign exploits workforce anxieties by disguising itself as internal HR announcements about layoffs. The emails contain a RAR archive with a double-extension executable masquerading as a PDF document. Upon execution, the file deploys Remcos RAT, a remote access tool, which establishes persistence, collects system information, and prepares the infected host for remote access. The malware uses NSIS compilation to conceal its intent and creates configuration files and registry entries for victim identification and persistence. The campaign highlights the ongoing exploitation of current organizational trends by threat actors to gain initial access to targeted systems.
Ransomware groups have started using the Shanya EXE packer to obfuscate their EDR (Endpoint Detection and Response) evasion tools, complicating detection and mitigation efforts. This technique allows malware to hide components that disable or bypass security software, increasing the likelihood of successful ransomware deployment. The use of such packers enhances the stealth and persistence of ransomware attacks, posing a significant risk to organizations. European entities, especially those with critical infrastructure and high-value data, face increased exposure due to this evolving tactic. Mitigation requires advanced behavioral analysis, updated detection signatures, and strict application control policies. Countries with high ransomware activity and widespread use of targeted software are at greater risk. Given the high impact on confidentiality, integrity, and availability, combined with the ease of exploitation once initial access is gained, this threat is assessed as high severity. Defenders must prioritize monitoring for packed executables and strengthen endpoint defenses accordingly.
Vitas, the largest for-profit hospice chain in the United States, discovered a cybersecurity intrusion in October. The post Over 300,000 Individuals Impacted by Vitas Hospice Data Breach appeared first on SecurityWeek .
Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses phishing lures with the ClickFix technique to distribute CastleLoader. Another cluster, TAG-161, impersonates Booking.com and employs similar techniques. The analysis also uncovered potential links to the online persona "Sparja" and the broader cybercriminal ecosystem. GrayBravo demonstrates rapid evolution, technical sophistication, and adaptability in response to public exposure. The report recommends various security measures to defend against these threats.
The ChrimeraWire Trojan is a Windows-targeting malware that impersonates Google Chrome activity to manipulate search engine rankings. It operates by faking user interactions with Chrome, potentially skewing search results for malicious benefit. Although no specific affected versions or exploits in the wild are currently documented, the malware represents a medium-severity threat due to its ability to undermine search integrity and potentially facilitate broader malicious campaigns. European organizations involved in digital marketing, SEO services, or those relying heavily on search engine traffic could be impacted. The Trojan does not require user interaction beyond initial infection and targets Windows systems, which are widely used across Europe. Mitigation requires enhanced endpoint detection focusing on anomalous browser behavior, network traffic analysis for fake search queries, and strict application whitelisting. Countries with significant digital economies and high Windows usage, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the medium severity, the threat primarily impacts integrity and availability of search-related services but does not currently indicate direct data theft or system destruction. Defenders should prioritize monitoring for unusual Chrome activity patterns and ensure robust malware detection capabilities are in place.
JS#SMUGGLER is a threat actor or campaign leveraging compromised legitimate websites to deliver the NetSupport Remote Access Trojan (RAT). The attack involves injecting malicious JavaScript payloads into trusted sites, which then silently deploy NetSupport RAT onto victims' systems. This RAT enables attackers to gain persistent remote access, potentially leading to data theft, espionage, or further network compromise. The threat is considered high severity due to the use of trusted sites for delivery, the capabilities of NetSupport RAT, and the stealthy infection vector. European organizations relying on web traffic from compromised sites are at risk, especially those with remote workforce or critical infrastructure. Mitigation requires proactive monitoring of web assets, enhanced endpoint detection, and network segmentation to limit RAT impact. Countries with high internet usage, significant remote workforces, and strategic industries are more likely targets. Given the ease of exploitation via compromised sites and the high impact on confidentiality and integrity, the threat is assessed as high severity. Defenders should prioritize detection of unusual RAT activity and patch any web application vulnerabilities that could lead to site compromise.
Cybercriminals are increasingly manipulating online photos to fabricate virtual kidnapping scenarios, demanding ransoms from victims or their families. This social engineering tactic leverages altered images to create believable threats without physical abduction. The FBI has highlighted this emerging trend, emphasizing the psychological pressure on victims. Although no direct software vulnerabilities are exploited, the threat exploits human trust and fear. European organizations and individuals may face increased targeting due to widespread social media use and digital photo sharing. The threat's medium severity reflects its significant impact on confidentiality and integrity of personal safety perceptions, despite lacking technical exploitation. Mitigation requires enhanced public awareness, verification protocols, and law enforcement collaboration. Countries with high social media penetration and affluent populations are more vulnerable. This threat underscores the evolving nature of cybercrime blending digital manipulation with psychological tactics.
A new campaign leveraging JS#SMUGGLER techniques is distributing the NetSupport RAT malware through compromised websites targeting Windows users. The attack involves malicious JavaScript payloads that bypass traditional detection by smuggling code to deliver the remote access trojan. Once infected, systems can be remotely controlled by attackers, risking data confidentiality, integrity, and availability. This campaign is currently observed in the wild but with minimal discussion and no known exploits reported yet. European organizations using Windows systems and frequently accessing web resources are at risk, especially those in sectors targeted by RATs for espionage or disruption. Mitigation requires advanced web filtering, endpoint detection tuned for RAT behaviors, and user awareness to avoid suspicious sites. Countries with high Windows usage and strategic importance in cyber espionage are more likely to be affected. The threat severity is assessed as medium due to the complexity of exploitation and the potential impact on affected systems. Defenders should prioritize monitoring for unusual network activity and implement layered defenses against web-based malware delivery.
Chrome’s new agentic browsing protections include user alignment critic, expanded origin-isolation capabilities, and user confirmations. The post Google Fortifies Chrome Agentic AI Against Indirect Prompt Injection Attacks appeared first on SecurityWeek .
The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.
GhostPenguin is a newly discovered, undocumented Linux backdoor malware identified through AI-driven threat hunting. It is a multi-threaded C++ program that establishes remote shell access and file system manipulation capabilities over an encrypted UDP channel using RC5 encryption. The malware employs a structured handshake and thread synchronization for registration, heartbeat, and command delivery, making it stealthy and evasive. Although still in development with debug artifacts present, GhostPenguin's capabilities include remote shell, file and directory operations, and encrypted communications. No known exploits are currently in the wild, and it was found in zero-detection samples on VirusTotal. The malware targets Linux systems, which are widely used in European enterprises and infrastructure. Detection was enabled by custom YARA rules and AI profiling, highlighting the importance of advanced threat hunting techniques. The threat poses a medium severity risk due to its stealth, remote control features, and potential for lateral movement within networks.
China-linked threat actors rapidly weaponized the React2Shell vulnerability shortly after its public disclosure, indicating a swift exploitation attempt in the wild. React2Shell is a critical remote code execution vulnerability affecting systems that use the React framework or related components. Although no confirmed exploits in the wild have been reported yet, the speed of weaponization suggests imminent risk. European organizations using vulnerable React-based applications or AWS services could face unauthorized code execution, leading to data breaches, service disruption, or lateral movement within networks. Mitigation requires immediate patching, monitoring for suspicious activity, and restricting access to vulnerable services. Countries with significant cloud adoption and software development sectors, such as Germany, the UK, France, and the Netherlands, are at higher risk. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize rapid vulnerability management and threat hunting to prevent compromise.
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .
Ransomware payments reached the highest level in 2023, at $1.1 billion paid in 1,512 reported incidents. The post Ransomware Payments Surpassed $4.5 Billion: US Treasury appeared first on SecurityWeek .
CVE-2025-14208 is a medium severity command injection vulnerability in the D-Link DIR-823X router firmware up to version 20250416. The flaw exists in the /goform/set_wan_settings endpoint, specifically in the sub_415028 function, where the ppp_username parameter is improperly sanitized, allowing remote attackers to inject arbitrary commands. Exploitation does not require user interaction or authentication, making it remotely exploitable over the network. Although no known exploits are currently observed in the wild, a public exploit has been released, increasing the risk of attacks. The vulnerability impacts confidentiality, integrity, and availability by enabling command execution on the device. European organizations using this router model, especially in countries with high D-Link market penetration and critical infrastructure reliance on such devices, are at risk. Mitigation involves applying firmware updates once available, restricting WAN access to management interfaces, and monitoring network traffic for suspicious activity. Countries like Germany, France, Italy, Spain, and the UK are likely most affected due to market share and infrastructure considerations.
A side-channel tracking technique leveraging WhatsApp and Signal allows an attacker to infer a target phone's device activity state (screen on/off, offline) by sending silent probe reactions to invalid message IDs and measuring delivery receipt round-trip times. This method does not generate visible notifications or messages on the victim's device, making it stealthy. Over time, attackers can profile user behavior such as when they are home, sleeping, or mobile. The attack requires the ability to send messages to the target number, which can be mitigated by restricting unknown contacts in privacy settings. Although no direct data breach occurs, this privacy-invasive tracking poses significant risks. The threat is relevant to European users given WhatsApp and Signal's widespread adoption. No known exploits in the wild exist yet, but the proof-of-concept is publicly available.
A security news report highlights the patching of firmware vulnerabilities in pulse oximeters, medical devices used to monitor blood oxygen levels. While no specific vulnerabilities or exploits are detailed, the discussion emphasizes the importance of firmware updates to address potential security risks. There are no known exploits in the wild, and the threat currently has minimal public discussion. The medium severity rating suggests moderate risk, likely due to the critical nature of medical devices and potential impacts on device integrity and patient safety. European healthcare providers using affected pulse oximeters should prioritize firmware updates once available. The threat is more relevant to countries with advanced healthcare infrastructure and significant use of such medical devices. Given the lack of detailed technical data and exploit evidence, the overall risk is assessed as medium. Defenders should monitor for official patches and verify device firmware integrity to mitigate potential risks.
LockBit 5.0 ransomware group's infrastructure has been exposed through a leak of servers, IP addresses, and domains. This exposure could allow defenders and law enforcement to disrupt their operations or track their activities. While no known exploits are currently in the wild leveraging this leak, the information disclosure presents a significant intelligence opportunity. European organizations, often targeted by LockBit, may benefit from enhanced detection and prevention capabilities. The leak increases the risk of retaliatory or opportunistic attacks by other threat actors attempting to exploit the exposed infrastructure. Immediate mitigation involves monitoring for related indicators and collaborating with cybersecurity communities to leverage the leaked data. Countries with high ransomware victimization rates and significant LockBit activity, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity due to the potential operational impact on ransomware campaigns and the broad scope of affected entities. Defenders should prioritize intelligence sharing and proactive network defense measures to mitigate risks stemming from this exposure.
