Threats affecting Spain

Thailand’s Cyber Crime Investigation Bureau said an FBI tip that the “world-class hacker” was traveling to Thailand led to his arrest in Phuket. The post Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island appeared first on SecurityWeek .

NewsGermanyFrance+5

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

Malware#ethereum#123 stealerGermany+6

Salesforce is investigating a data breach involving Gainsight, a customer success platform, which has resulted in the theft of customer data. The breach reportedly allowed unauthorized access potentially through a remote code execution (RCE) vulnerability, leading to exposure of sensitive information. Although no confirmed exploits are currently known in the wild, the incident is considered high severity due to the nature of the data involved and the trust placed in these platforms. European organizations using Salesforce and Gainsight services may face risks related to confidentiality breaches and regulatory compliance violations. Mitigation requires immediate review of third-party integrations, enhanced monitoring of access logs, and strict validation of vendor security postures. Countries with high adoption of Salesforce and cloud-based CRM solutions, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the breach involves data theft and potential RCE, the suggested severity is high. Defenders should prioritize incident response readiness, vendor communication, and data access audits to limit impact.

Breach#infosecnews#redditGermany+6

The Tsundere Botnet is a high-severity threat targeting Windows systems, expanding its reach by leveraging game-related lures and employing an innovative Ethereum blockchain-based command and control (C2) infrastructure. This botnet uses social engineering tactics centered around popular gaming to entice victims into executing malicious payloads, while its use of Ethereum for C2 communications complicates detection and takedown efforts. Although no known exploits are currently active in the wild, the botnet's architecture suggests a sophisticated and resilient threat capable of evading traditional security controls. European organizations, particularly those with significant gaming communities or Windows-based infrastructure, face risks including data theft, resource hijacking, and potential disruption of services. Mitigation requires targeted user awareness campaigns about gaming lure tactics, enhanced network monitoring for blockchain-based C2 traffic, and deployment of endpoint detection tools tuned to identify unusual behaviors associated with this botnet. Countries with large gaming markets and advanced IT sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the botnet's potential impact on confidentiality, integrity, and availability, combined with ease of exploitation through social engineering and no authentication barriers, the threat severity is assessed as high. Defenders should prioritize proactive detection and user education to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+7

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

Campaign#banking trojan#remote controlItaly+6

The Everest ransomware group claims to have breached Petrobras, a major Brazilian energy company, indicating a significant ransomware attack targeting critical infrastructure. Although details are limited and sourced primarily from Reddit and a news article, the incident highlights the ongoing threat ransomware poses to energy sector organizations globally. The attack could lead to data theft, operational disruption, and financial loss. European energy firms with similar profiles should be vigilant. Mitigation requires enhanced network segmentation, robust backup strategies, and proactive threat hunting. Countries with strong energy sectors and historical ransomware targeting, such as Germany, France, and the UK, are particularly at risk. Given the high potential impact on confidentiality, integrity, and availability, and the likely ease of exploitation by ransomware actors, this threat is assessed as high severity. Defenders must prioritize detection and response capabilities to mitigate potential ransomware intrusions.

Malware#infosecnews#redditGermany+7

A major TV streaming piracy service known as Photocall, which attracted approximately 26 million visits annually, has been shut down. This event represents a significant disruption to illicit content distribution channels but does not directly indicate a vulnerability or exploit affecting legitimate systems. The shutdown may reduce exposure to malware or legal risks associated with accessing pirated content. However, it does not constitute a direct cybersecurity threat to organizations. European organizations may see a marginal reduction in piracy-related risks but should remain vigilant against other piracy services. No technical exploit or vulnerability details are provided, and there is no evidence of active exploitation targeting enterprise environments. The event is primarily a law enforcement or intellectual property enforcement success rather than a direct cyber threat. Consequently, no specific mitigation beyond standard cybersecurity hygiene related to piracy avoidance is necessary. Countries with high piracy rates or large media industries might be more aware of this event, but no direct impact on critical infrastructure or enterprise systems is expected.

News#infosecnews#redditGermany+7

A newly discovered flaw in SonicWall SonicOS can be exploited by attackers to crash SonicWall firewalls, causing denial of service. While no known exploits are currently in the wild, the vulnerability is rated as high severity due to its potential impact on firewall availability. The flaw affects SonicWall's SonicOS firmware, widely used in enterprise and service provider environments. Exploitation requires sending specially crafted network traffic to the firewall, which can cause it to become unresponsive or reboot. This disrupts network security enforcement and can lead to temporary loss of connectivity and protection. European organizations relying on SonicWall firewalls should prioritize monitoring and prepare for patch deployment once available. Countries with high SonicWall market penetration and critical infrastructure reliance on these devices are at greater risk. Mitigation includes network segmentation, limiting exposure of management interfaces, and implementing robust monitoring to detect abnormal traffic patterns. Given the ease of exploitation and impact on availability, the suggested severity is high. Defenders must act proactively to reduce potential downtime and service disruption risks.

News#infosecnews#redditGermany+6

The Android malware is in development and appears to be mainly aimed at users in Europe. The post New Sturnus Banking Trojan Targets WhatsApp, Telegram, Signal Messages appeared first on SecurityWeek .

Malware#androidGermany+7

The October 2025 Infostealer Trend Report highlights the ongoing and evolving threat posed by Infostealer malware families such as Rhadamanthys, ACRStealer, and LummaC2. Attackers have shifted distribution tactics, increasingly leveraging legitimate websites to evade detection and search engine restrictions, a technique known as SEO poisoning. A notable development is the mass distribution of a new Loader malware employing DLL sideloading to execute malicious payloads stealthily. The report also details changes in LummaC2 distribution patterns and the use of sophisticated disguise and phishing techniques to target companies. These Infostealers aim to exfiltrate sensitive information, posing risks to confidentiality and potentially enabling further attacks. The threat does not require known exploits or zero-day vulnerabilities but relies on social engineering and advanced evasion methods. European organizations are at risk due to the widespread use of affected malware and the targeting of companies via phishing. Mitigation requires proactive detection of DLL sideloading, monitoring for SEO poisoning campaigns, and enhanced phishing defenses.

Campaign#seo poisoning#rhadamanthysGermany+5

In October 2025, phishing emails predominantly delivered Trojan malware via attachments, accounting for 47% of cases. These attachments included scripts, documents, and compressed files, notably RAR archives containing JavaScript files. The phishing campaigns also involved distribution of Remcos RAT malware and used document attachments to download additional payloads. Korean phishing emails were specifically analyzed, revealing targeted case names, subjects, and attachment filenames. The report highlights evolving tactics such as increased use of compressed JS files and exploitation of OLE objects within documents. The threat leverages multiple MITRE ATT&CK techniques including persistence, command execution, and credential access. This medium-severity campaign poses significant risks through social engineering and malware delivery via email attachments, requiring focused defensive measures. No known exploits in the wild are reported, but the widespread use of common file formats and compression methods increases the attack surface. European organizations should be vigilant against these evolving phishing tactics and malware payloads.

Campaign#email attachments#rar compressionGermany+9

The Eternidade Stealer is a newly identified malware spreading via WhatsApp messages, targeting users to steal sensitive banking and cryptocurrency data. It propagates through social engineering by sending malicious links or files over WhatsApp, tricking users into executing the stealer. Once active, it harvests credentials and financial information from infected devices. Although no known exploits are reported in the wild yet, the malware poses a medium severity threat due to its potential impact on confidentiality and financial assets. European organizations with employees or customers using WhatsApp are at risk, especially those in banking and crypto sectors. Mitigation requires user awareness, endpoint protection, and network monitoring for suspicious WhatsApp traffic. Countries with high WhatsApp usage and significant financial sectors, such as the UK, Germany, France, Italy, and Spain, are more likely to be affected. The threat is assessed as medium severity given the need for user interaction and the targeted nature of the attack. Defenders should prioritize phishing education, multi-factor authentication, and rapid incident response capabilities to reduce risk.

Malware#infosecnews#redditGermany+6

A Chinese threat actor is exploiting known vulnerabilities in discontinued Asus devices in an Operational Relay Box (ORB) facilitation campaign. The post Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’ appeared first on SecurityWeek .

BreachGermanyFrance+6

Media Land, Hypercore, and their leadership and employees are allegedly connected to various cybercriminal activities. The post US and Allies Sanction Russian Bulletproof Hosting Service Providers appeared first on SecurityWeek .

NewsGermanyFrance+4

A security flaw in Comet Browser allows a hidden API to execute commands on users' devices without their knowledge. This vulnerability could enable attackers to run arbitrary commands remotely, potentially compromising device confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the flaw poses a medium-level risk due to its ability to bypass user interaction and authentication. European organizations using Comet Browser or related software may be at risk, especially if the browser has significant market penetration in their sectors. Mitigation requires immediate vendor patching once available, disabling or restricting the hidden API, and monitoring for unusual command execution behavior. Countries with higher usage of Comet Browser and strategic digital infrastructure are more likely to be targeted. Given the medium severity, organizations should prioritize detection and containment measures while awaiting official fixes.

News#infosecnews#redditGermany+6

Eternidade Stealer is a banking Trojan distributed via WhatsApp hijacking and social engineering. It uses a Python-based WhatsApp worm to propagate malicious attachments and an MSI installer that deploys a Delphi-based banking Trojan. The campaign aims to steal banking credentials and conduct fraud. Exploitation does not require prior authentication but relies on user interaction to open malicious attachments. The malware targets Windows systems through MSI installers. The medium severity rating reflects moderate impact and exploitation complexity. European organizations with significant WhatsApp usage and Windows environments are at risk, especially financial institutions. Mitigations include user awareness training, restricting MSI execution, and monitoring WhatsApp traffic for suspicious activity. Countries with high WhatsApp penetration and financial sector importance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. The threat poses a medium risk due to its reliance on social engineering and targeted banking fraud objectives.

Malware#infosecnews#redditGermany+6

TamperedChef is a malware campaign spreading globally through fake software installers. The malware masquerades as legitimate software to trick users into installation, enabling attackers to compromise systems. Although no specific affected software versions are identified, the campaign is ongoing and considered high severity. There are no known exploits in the wild beyond the fake installers. The malware poses significant risks to confidentiality, integrity, and availability by potentially allowing unauthorized access and control over infected systems. European organizations are at risk, especially those with high software usage and less stringent software verification processes. Mitigation requires strict software installation policies, user education on verifying software sources, and enhanced endpoint detection capabilities. Countries with large IT sectors and high software adoption, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of exploitation through social engineering and the broad impact scope, the threat severity is assessed as high. Defenders should prioritize detection of suspicious installers and enforce application whitelisting to reduce infection risk.

Malware#infosecnews#redditGermany+5

Iran-linked hackers conducted reconnaissance by mapping ship Automatic Identification System (AIS) data days before an attempted missile strike, indicating coordinated cyber-physical threat activity. This mapping effort likely aimed to identify maritime targets and optimize attack timing and precision. The threat highlights the use of cyber intelligence gathering to support kinetic military operations, increasing risks to maritime assets. European organizations involved in shipping, port operations, and maritime security could face elevated risks due to potential targeting or collateral damage. The threat requires enhanced monitoring of AIS data integrity and maritime situational awareness. Mitigation should include anomaly detection on AIS feeds, collaboration with maritime authorities, and hardened cyber defenses for critical maritime infrastructure. Countries with significant maritime trade and naval presence, such as the UK, Netherlands, Germany, and Italy, are particularly at risk. Given the high impact on availability and integrity of maritime operations and the ease of exploitation through publicly accessible AIS data, this threat is assessed as high severity. Defenders must prioritize integrating cyber and physical security intelligence to anticipate and respond to such hybrid threats.

News#infosecnews#redditNetherlands+7

TamperedChef is a sophisticated global malvertising and SEO-driven campaign that delivers malicious payloads via seemingly legitimate, digitally signed installers. It leverages social engineering, malvertising, and abused code-signing certificates obtained through U. S. -registered shell companies to evade detection and increase user trust. The campaign primarily targets healthcare, construction, and manufacturing sectors, establishing persistence and deploying obfuscated JavaScript for remote access and control. Attackers may use this access for credential theft, ransomware preparation, or espionage. Although currently concentrated in the Americas, European organizations in similar sectors are at risk due to the campaign's stealth and persistence techniques. Mitigation requires enhanced scrutiny of signed applications, network monitoring for unusual JavaScript execution, and strict controls on software installation sources. Countries with significant healthcare and manufacturing industries, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity rating and the complexity of exploitation, the threat is assessed as high severity for European contexts due to potential impact and stealth.

Campaign#malvertising#javascriptGermany+7

ThreatFox IOCs for 2025-11-20

Indicator#type:osint#tlp:whiteGermany+6