Names, Social Security numbers, ID numbers, and health information were stolen from a compromised email account. The post 146,000 Impacted by Delta Dental of Virginia Data Breach appeared first on SecurityWeek .
More than 1.6 Tb of data allegedly stolen from Cox was made public by the hackers. The post Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. […] The post 24th November – Threat Intelligence Report appeared first on Check Point Research .
CVE-2025-63434 is a high-severity vulnerability in the update mechanism of the Xtooltech Xtool AnyScan Android application (version 4.40.40 and prior). The app downloads and extracts update packages containing executable code without verifying their cryptographic integrity or authenticity. This flaw allows an attacker who can manipulate the update metadata to serve malicious packages that the app will accept and execute, resulting in arbitrary code execution. The vulnerability requires low privileges but no user interaction, making exploitation feasible in network-exposed environments. Although no known exploits are currently reported, the impact on confidentiality, integrity, and availability is severe. European organizations using this application, especially in automotive diagnostics or related fields, are at risk. Mitigation involves implementing cryptographic signature verification for update packages and restricting update metadata sources. Countries with significant automotive industries and high Android device usage, such as Germany, France, Italy, Spain, and the UK, are most likely to be affected.
A security analysis was conducted on over 3 million exposed databases using the Netlas platform, highlighting the widespread issue of unsecured database instances accessible on the internet. While no specific vulnerabilities or exploits were detailed, the exposure of such databases poses significant risks including data breaches and unauthorized access. The threat is categorized as medium severity due to the potential impact on confidentiality and integrity, despite the lack of active exploitation reports. European organizations using common database technologies and cloud services are at risk if their databases are misconfigured or left exposed. Mitigation requires proactive discovery of exposed assets, strict access controls, network segmentation, and continuous monitoring. Countries with high cloud adoption and digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the scale and nature of the exposure, the threat severity is assessed as medium. Defenders should prioritize identifying and securing exposed databases to prevent data leakage and unauthorized access.
Qilin ransomware is a recently identified ransomware threat investigated and reported by a trusted cybersecurity news source. Although technical details and indicators are limited, the ransomware is considered high severity due to its potential to encrypt data and disrupt operations. No known exploits in the wild have been confirmed yet, and minimal discussion exists in the InfoSec community. European organizations could face significant operational and financial impacts if targeted, especially those in critical infrastructure and industries with high ransomware exposure. Mitigation requires proactive network segmentation, robust backup strategies, and enhanced monitoring for ransomware behaviors. Countries with high digital infrastructure and ransomware incident history, such as Germany, France, the UK, Italy, and the Netherlands, are more likely to be affected. Given the lack of detailed exploitation data but the inherent destructive nature of ransomware, the threat severity is assessed as high. Defenders should prioritize early detection and incident response readiness to mitigate potential Qilin ransomware attacks.
Cox Enterprises has disclosed a data breach involving their Oracle E-Business Suite environment. The breach potentially exposed sensitive business and customer data managed within the Oracle ERP system. Although specific technical details and exploited vulnerabilities have not been publicly disclosed, the incident is classified as high severity due to the critical nature of the affected systems and the potential impact on confidentiality and business operations. No known exploits are currently reported in the wild, and the discussion around this breach remains limited. European organizations using Oracle E-Business Suite should be vigilant, as similar attacks could target their systems. Mitigation should focus on immediate forensic investigation, access control reviews, and enhanced monitoring of Oracle ERP environments. Countries with significant Oracle E-Business Suite deployments and critical infrastructure sectors relying on Oracle ERP are at higher risk. Given the sensitivity of ERP data and potential for operational disruption, the suggested severity of this breach is high.
Matrix Push C2 is a novel phishing attack technique that leverages browser notifications to conduct fileless, cross-platform attacks. It uses the browser's native notification system to deliver phishing content, bypassing traditional detection methods that rely on file-based indicators. This method enables attackers to target multiple operating systems without deploying malicious files, increasing stealth and persistence. The attack is categorized as high severity due to its potential to compromise user credentials and deliver malicious payloads via social engineering. European organizations are at risk, especially those with high browser usage and remote workforces. Mitigation requires disabling or restricting browser notifications, enhancing user awareness, and implementing advanced detection for anomalous notification behavior. Countries with significant digital infrastructure and high browser adoption, such as Germany, France, and the UK, are most likely to be affected. The attack does not require prior authentication but exploits user interaction, making social engineering a critical factor. Overall, defenders should prioritize monitoring browser notification usage and educating users on phishing risks associated with this vector.
APT-C-26 (Lazarus) has conducted a sophisticated attack campaign deploying customized monitoring software disguised as remote IT tools. The malware includes a registration program, daemon process, and DLL, leveraging Windows Shell extensions for persistence and creating a covert remote desktop environment. It employs advanced evasion techniques such as disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data and uploads it to a remote server, enabling persistent surveillance and remote control. This campaign targets various industries globally and is attributed to the North Korean Lazarus group. The attack does not require known exploits but uses stealthy persistence and privilege escalation tactics. European organizations face risks of espionage, data leakage, and operational disruption. Mitigation requires targeted detection of the specific malware components, strict control of remote IT access, and enhanced endpoint monitoring. Countries with high adoption of Windows enterprise environments and strategic industries are most at risk, including Germany, France, the UK, and the Netherlands.
The Sturnus Android malware abuses accessibility features to read chats from popular messaging apps including WhatsApp, Telegram, and Signal. It leverages accessibility permissions to bypass normal app sandboxing and extract sensitive message content without user consent. While no known exploits in the wild have been reported yet, this malware poses a significant privacy risk by targeting encrypted messaging platforms. The malware's medium severity reflects its potential to compromise confidentiality but requires accessibility permission, which may limit widespread exploitation. European organizations using Android devices with these messaging apps are at risk, especially those with employees who may unknowingly grant accessibility access. Mitigation involves restricting accessibility permissions, monitoring app permissions closely, and educating users about granting such privileges. Countries with high Android adoption and significant use of encrypted messaging apps, such as Germany, France, and the UK, are most likely to be affected. Given the malware’s ability to access sensitive communications and the ease of exploitation once permissions are granted, the suggested severity is high. Defenders should prioritize detection of suspicious accessibility service usage and enforce strict mobile device management policies.
Other noteworthy stories that might have slipped under the radar: surge in Palo Alto Networks scanning, WEL Companies data breach impacts 120,000 people, AI second-order prompt injection attack. The post In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring appeared first on SecurityWeek .
The ShinyHunters threat actor has reportedly breached Gainsight applications hosted on Salesforce, claiming to have accessed data from top 1000 firms globally. This breach involves unauthorized access to sensitive corporate data, potentially including customer and business information managed within Gainsight's customer success platform integrated with Salesforce. Although technical details are limited and no confirmed exploits are currently observed in the wild, the breach is rated high severity due to the scale and sensitivity of the data involved. European organizations using Gainsight and Salesforce for customer relationship and success management are at risk of data exposure and subsequent targeted attacks. Mitigation requires immediate review of access controls, monitoring for unusual activity within Gainsight and Salesforce environments, and enhanced incident response readiness. Countries with significant Salesforce and Gainsight market penetration, such as the UK, Germany, France, and the Netherlands, are likely most affected. The threat is assessed as high severity given the potential impact on confidentiality and integrity, ease of exploitation through compromised SaaS platforms, and the broad scope of affected enterprises. Defenders should prioritize verifying the breach impact, securing credentials, and applying any forthcoming patches or security advisories from Gainsight and Salesforce.
The ToddyCat APT group has developed advanced tools and techniques to covertly access corporate email data by targeting both on-premises Outlook OST files and Microsoft 365 cloud environments. Their toolkit includes PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and methods to steal OAuth tokens from Microsoft 365 processes. They leverage SMB for remote file access, dump process memory, and search for access tokens to bypass security monitoring. These tactics enable stealthy data theft of sensitive email content and credentials. Detection guidance is available for each technique to help defenders identify and mitigate these intrusions. The threat is assessed as medium severity due to the complexity and targeted nature of the attacks, with no known exploits in the wild yet. European organizations using Microsoft 365 and Outlook are at risk, especially those with valuable email communications and cloud integrations.
From time to time, it can be instructive to look at generic phishing messages that are delivered to one's inbox or that are caught by basic spam filters. Although one usually doesn't find much of interest, sometimes these little excursions into what should be a run-of-the-mill collection of basic, commonly used phishing techniques can lead one to find something new and unusual. This was the case with one of the messages delivered to our handler inbox yesterday…
Since November 19, 2025, a suspicious PDF editor named 'ConvertMate' has been identified as a malicious vector infiltrating environments. Although it appears as a legitimate PDF converter, it performs unauthorized external connections, host queries, and creates artifacts indicative of compromise. It executes a PowerShell script that installs a scheduled task to repeat its malicious behavior every 24 hours. This activity closely resembles the earlier 'PDFEditor' campaign, with both files signed by the same entity, suggesting a coordinated threat actor. Immediate isolation and removal of 'ConvertMate' and related artifacts are critical. End-user training to recognize suspicious files and ads is also recommended. The threat does not require user interaction beyond initial download and installation, and no known exploits are publicly reported yet. The medium severity reflects its persistence and stealth but limited current exploitation scope.
The emergence of agentic AI-driven cyber campaigns marks a significant evolution in the cyber threat landscape, enabling autonomous execution of routine malicious activities via APIs. This AI orchestration lowers barriers for less skilled threat actors by automating complex tasks, increasing the scale and speed of attacks. While AI enhances attacker capabilities, it still requires skilled human oversight. European organizations face increased risks as AI-driven campaigns can target diverse systems and exploit vulnerabilities more efficiently. Defensive teams can counteract by developing their own AI agentic systems for vulnerability detection and deploying honeypots to trap malicious AI. The threat is medium severity but represents a paradigm shift requiring adaptive defense strategies. No known exploits are currently in the wild, but the potential for rapid evolution and automation of attacks is high. Organizations must proactively integrate AI-aware defenses and monitor for AI-driven attack indicators. This threat is likely to impact countries with high digital infrastructure and AI adoption, especially those with critical industries and government targets.
