Threats affecting Spain

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.

Campaign#evilginx#aitmUnited Kingdom+6

DragonForce ransomware is a high-severity malware threat linked to the Scattered Spider threat group, known for targeted ransomware attacks. It employs advanced tactics to gain remote code execution (RCE) capabilities, enabling attackers to infiltrate and encrypt critical systems. Although no known exploits are currently active in the wild, the malware's connection to a sophisticated threat actor increases its risk profile. European organizations, especially those in critical infrastructure and high-value sectors, face significant risks due to potential data loss, operational disruption, and financial extortion. Mitigation requires proactive threat hunting, network segmentation, and enhanced monitoring for indicators of compromise related to Scattered Spider activity. Countries with strong digital economies and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are particularly at risk. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through RCE, and the broad scope of potential targets, the threat severity is assessed as high. Defenders should prioritize detection of lateral movement and privilege escalation attempts associated with this ransomware family.

Malware#infosecnews#redditGermany+7

The University of Phoenix disclosed a data breach resulting from a hack of Oracle systems. The breach stems from a compromise of Oracle infrastructure, which impacted the university's data security. While specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident highlights risks associated with third-party cloud or software providers. The breach is classified as high severity due to the potential exposure of sensitive personal and academic information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. European organizations relying on Oracle cloud services or similar third-party providers should be alert to similar risks. Mitigation requires enhanced monitoring of third-party integrations, rigorous access controls, and incident response preparedness. Countries with significant Oracle customer bases and higher education institutions are more likely to be affected. Given the potential impact on confidentiality and the indirect attack vector, the suggested severity is high.

Breach#infosecnews#redditGermany+6

The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.

Campaign#infosecnews#redditGermany+7

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data. The post Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims appeared first on SecurityWeek .

NewsGermanyFrance+5

The University of Pennsylvania and the University of Phoenix confirm that they are victims of the recent Oracle EBS hacking campaign. The post Penn and Phoenix Universities Disclose Data Breach After Oracle Hack appeared first on SecurityWeek .

BreachGermanyFrance+5

The ShadyPanda campaign is a long-running espionage operation that targeted approximately 4.3 million users of Chrome and Edge browsers over a seven-year period. It involved persistent spying activities, likely through malicious extensions or other browser-based mechanisms, to collect sensitive user data. Although no specific affected versions or technical exploit details are provided, the campaign's longevity and scale indicate a sophisticated threat actor with sustained access. The medium severity rating reflects the significant privacy and confidentiality risks, though exploitation complexity and exact attack vectors remain unclear. European organizations using Chrome and Edge browsers are at risk, particularly those in countries with high adoption of these browsers and strategic geopolitical relevance. Mitigation requires enhanced browser security hygiene, monitoring for suspicious extensions, and user awareness. Countries such as Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their large user bases and critical infrastructure. Given the lack of detailed exploit information, the suggested severity is medium, balancing the impact on confidentiality against the unknown ease of exploitation and scope. Defenders should prioritize detection of unusual browser activity and ensure timely updates and audits of browser extensions.

Campaign#infosecnews#redditGermany+7

South Korean authorities have arrested suspects involved in hacking IP cameras to steal and sell intimate videos. The threat involves unauthorized access to vulnerable IP cameras, compromising user privacy and potentially exposing sensitive personal footage. This breach highlights risks associated with insecure IoT devices, particularly IP cameras lacking proper security controls. European organizations and individuals using similar devices may face privacy violations and reputational damage if targeted. The threat is high severity due to the privacy impact and ease of exploitation of poorly secured devices. Mitigation requires securing IP cameras with strong authentication, regular firmware updates, network segmentation, and monitoring for unusual access patterns. Countries with high IoT adoption and significant consumer use of IP cameras, such as Germany, France, and the UK, are most likely to be affected. Given the direct privacy impact, ease of exploitation, and broad scope of vulnerable devices, the suggested severity is high.

Breach#infosecnews#redditGermany+6

Let’s Encrypt, a widely used certificate authority, plans to reduce the validity period of its SSL/TLS certificates from 90 days to 45 days. This change aims to improve security by limiting the window of exposure if a certificate is compromised. While this is not a vulnerability or exploit, it impacts certificate management processes and automation for organizations relying on Let’s Encrypt certificates. European organizations using Let’s Encrypt will need to adjust their renewal workflows to accommodate the shorter validity period. Failure to do so could lead to service disruptions due to expired certificates. The change does not introduce new attack vectors but increases operational demands on IT teams. Countries with high adoption of Let’s Encrypt certificates and strong digital infrastructure are more likely to be affected. This update underscores the importance of robust automation and monitoring in certificate lifecycle management. Overall, this is a security policy change rather than a direct threat or vulnerability.

News#infosecnews#redditGermany+9

A sophisticated social engineering campaign exploits Microsoft Teams' 'Chat with Anyone' feature to impersonate IT support and trick users into initiating Quick Assist sessions. This multi-stage attack involves phishing, malware deployment (notably an infostealer named 'updater.exe'), and reconnaissance to steal credentials and potentially exfiltrate data. The threat actors leverage legitimate collaboration tools to bypass traditional security controls. Organizations are advised to disable the vulnerable Teams feature, enforce multi-factor authentication, and adopt Zero Trust principles to mitigate risks. No CVSS score is assigned, but the attack poses a medium severity risk due to its credential theft focus and social engineering complexity.

Campaign#reconnaissance#infostealerGermany+6

A ValleyRAT campaign is targeting job seekers through email, disguising itself as a Foxit PDF reader and using DLL side-loading for initial system access. The campaign exploits job seekers' eagerness by using recruitment-related lures in archive files. The attack employs sophisticated techniques, including obfuscation through nested directories and execution via DLL sideloading. Once activated, ValleyRAT can lead to system control, activity monitoring, and data theft. The campaign's success is evident from a spike in ValleyRAT detections. It demonstrates the integration of social engineering, legitimate software abuse, and advanced malware techniques to exploit vulnerabilities in both systems and human psychology.

Malware#data theft#dll side-loadingGermany+5

Matanbuchus 3.0 is a sophisticated C++ malware downloader offered as Malware-as-a-Service since 2020, designed to deliver additional malicious payloads including ransomware and remote access trojans like Rhadamanthys and NetSupport RAT. It employs advanced obfuscation techniques such as junk code insertion, encrypted strings, and API hashing to evade detection. The malware features anti-analysis mechanisms including an expiration date and persistence via scheduled tasks. It communicates with its command and control servers using encrypted Protocol Buffers over HTTP(S), supporting a wide range of commands for payload execution, data collection, and system manipulation. While no known exploits are currently reported in the wild, its modular design and use in ransomware campaigns make it a medium-severity threat. European organizations are at risk due to the malware’s capability to facilitate ransomware attacks and backdoor access, potentially leading to data breaches and operational disruption. Mitigation requires targeted detection of its persistence mechanisms, network traffic analysis for encrypted C2 communications, and blocking associated domains and URLs. Countries with high technology adoption and ransomware targeting history, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected.

Malware#netsupport rat#backdoorGermany+6

Felix Markets is a fraudulent forex broker platform engaging in reputation laundering by presenting false regulatory credentials and leveraging sports sponsorship to appear legitimate. It impersonates other companies, repackages authentic legal documents, and falsely claims regulatory ties to Australia, the UK, and Comoros. The platform sponsors the Spanish football team Levante U. D.for the 2025-26 season to enhance its perceived legitimacy. Hosting and metadata suggest possible Turkish involvement, while the scam exploits the identity of a legitimate Australian company. This campaign exemplifies sophisticated regulatory fraud and reputation laundering tactics in investment scams, posing risks to investors and financial institutions. European organizations should exercise heightened due diligence, especially in sectors vulnerable to such deceptive legitimacy claims. The threat is assessed as medium severity due to its potential financial impact and moderate ease of exploitation without direct technical system compromise. Spain is notably affected given the sponsorship link and geographic focus.

Campaign#impersonation#fake financial authoritySpain+2

IPCola is a proxy service leveraging millions of IP addresses sourced from IoT, desktop, and mobile devices. It is linked to Gaganode, a decentralized bandwidth monetization platform with botnet-like features and an SDK capable of remote code execution. The service is distributed via various applications, including Chinese TV boxes and free software, creating a complex proxy network involving InstaIP and NuoChen Technology. This infrastructure enables attackers to harness a large pool of unique IPs for proxying traffic, potentially masking malicious activities. Although no known exploits are currently active, the remote code execution capability poses significant risks. The threat is medium severity due to the potential for widespread abuse and the difficulty in detecting such proxy networks. European organizations could be impacted by abuse of these IPs for anonymizing attacks or evading detection. Mitigation requires enhanced network monitoring, blocking suspicious IP ranges, and scrutinizing applications that may embed the Gaganode SDK. Countries with high IoT adoption and significant use of Chinese-origin devices, such as Germany, France, and the UK, are more likely to be affected.

Malware#bandwidth monetization#chinese tv boxesGermany+5

A hybrid phishing threat combining Salty2FA and Tycoon2FA phishing kits has emerged, leveraging code and infrastructure from both frameworks. This hybridization appears driven by Salty2FA infrastructure failures, causing fallback to Tycoon2FA hosting and payload delivery. The overlap complicates attribution and weakens detection rules tailored to either kit alone. The threat is linked to the Storm-1747 adversary group, known for Tycoon2FA operations. Indicators include multiple suspicious domains used for hosting phishing pages. Defenders should update detection logic to address cross-kit overlaps and prepare for more resilient phishing campaigns that can adapt to infrastructure disruptions. The threat is rated medium severity and does not require exploits in the wild or CVSS scoring. European organizations should be vigilant due to the widespread use of 2FA and phishing susceptibility. Mitigation requires tailored detection updates, domain monitoring, and user awareness enhancements.

Malware#tycoon2fa#phishingGermany+6

The Everest ransomware group claims to have breached ASUS, stealing approximately 1TB of data including camera source code. This incident involves data theft and ransomware activities, potentially exposing sensitive intellectual property and customer information. The breach reportedly includes remote code execution (RCE) capabilities exploited by the attackers. Although no CVSS score is assigned, the threat is assessed as high severity due to the scale of data theft, potential impact on confidentiality and integrity, and the ransomware nature of the attack. European organizations using ASUS products or related camera technologies could face indirect risks from this breach, including supply chain vulnerabilities and exposure to ransomware campaigns. Mitigation requires enhanced monitoring of ASUS-related infrastructure, strict access controls, and incident response readiness. Countries with significant ASUS market penetration and technology sectors, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize detection of ransomware indicators, secure firmware and software updates, and prepare for potential secondary attacks leveraging stolen data.

Malware#infosecnews#redditGermany+5

A phishing campaign uses fake Calendly invites spoofing top brands to trick recipients into hijacking their ad manager accounts. Attackers impersonate trusted companies to lure victims into clicking malicious links or providing credentials. This threat targets users managing digital advertising platforms, potentially leading to unauthorized access and misuse of ad accounts. The campaign leverages social engineering and brand impersonation to increase success rates. No known exploits are currently active in the wild, but the high severity rating reflects the potential damage. European organizations with significant digital marketing operations are at risk, especially those using platforms integrated with Calendly or similar scheduling tools. Attackers could manipulate ad spend, steal sensitive marketing data, or damage brand reputation. Mitigation requires user awareness, verification of invite authenticity, and strict access controls on ad manager accounts. Countries with large digital economies and marketing sectors, such as the UK, Germany, and France, are particularly vulnerable. The threat is assessed as high severity due to the ease of exploitation, potential confidentiality and integrity impacts, and the broad scope of affected users.

Phishing#infosecnews#redditGermany+6

The Lazarus APT group has been observed employing a novel remote-worker scheme, captured live on camera by researchers. This campaign highlights the evolving tactics of Lazarus, focusing on exploiting remote work environments to infiltrate targets. While no specific software vulnerabilities or exploits are detailed, the campaign represents a high-severity threat due to the advanced persistent nature of Lazarus and their history of impactful cyber espionage and sabotage. European organizations, especially those with remote workforce infrastructures, are at risk of targeted intrusion attempts leveraging social engineering and remote access exploitation. Mitigation requires tailored defenses around remote access security, employee training, and enhanced monitoring for suspicious remote activity. Countries with significant technology, finance, and critical infrastructure sectors, such as Germany, France, and the UK, are particularly vulnerable given their strategic importance and market penetration of remote work technologies. The threat is assessed as high severity due to the potential for significant confidentiality and integrity breaches, ease of exploitation through social engineering, and the broad scope of affected remote work environments without requiring user interaction beyond initial compromise. Defenders should prioritize detection of anomalous remote access patterns and reinforce endpoint security in remote setups.

Campaign#infosecnews#redditGermany+6

We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.

AnalysisGermanyFrance+9

The University of Pennsylvania has confirmed a new data breach resulting from a prior hack of Oracle E-Business Suite (EBS) systems. This breach involves unauthorized access and data theft linked to vulnerabilities exploited in Oracle's software environment. While specific technical details and exploited vulnerabilities have not been disclosed, the incident highlights risks associated with third-party software compromises impacting academic institutions. European organizations using Oracle EBS or similar enterprise resource planning (ERP) systems should be alert to potential exposure. The breach underscores the importance of timely patching, monitoring, and incident response to prevent data theft. No known exploits are currently reported in the wild, but the breach's high severity rating indicates significant impact potential. Mitigation requires focused security controls around Oracle environments, including enhanced access management and network segmentation. Countries with high Oracle EBS adoption and critical academic or research institutions are most at risk. Given the breach's scope and ease of exploitation through third-party software, the suggested severity is high. Defenders must prioritize detection and containment to mitigate data loss and reputational damage.

Breach#infosecnews#redditGermany+7