Threats affecting Spain

The Sneaky2FA phishing-as-a-service (PhaaS) kit has integrated the Browser-in-the-Browser (BitB) attack technique, enhancing its ability to bypass two-factor authentication protections by mimicking legitimate browser pop-ups. This attack creates convincing fake login dialogs within a browser window, deceiving users into entering credentials and 2FA codes. The campaign is considered high severity due to its potential to compromise multi-factor authentication, a critical security layer. European organizations relying on 2FA for sensitive systems are at increased risk, especially those in finance, government, and critical infrastructure sectors. Mitigations include user training to recognize BitB attacks, deploying advanced anti-phishing tools that detect UI spoofing, and adopting hardware-based or phishing-resistant authentication methods. Countries with high adoption of 2FA and significant financial or governmental digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. The threat does not require software vulnerabilities but exploits user trust and UI deception, making it relatively easy to execute. Defenders must prioritize awareness and technical controls to mitigate this evolving phishing technique.

Campaign#infosecnews#redditGermany+7

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper to hijack legitimate updates. EdgeStepper redirects DNS queries to a malicious node, rerouting traffic from legitimate infrastructure to attacker-controlled servers. The group has also exploited web server vulnerabilities and performed a supply-chain attack. PlushDaemon's adversary-in-the-middle technique involves compromising network devices, deploying EdgeStepper, and using it to redirect DNS queries for software updates to malicious nodes. This allows them to serve malicious updates containing the LittleDaemon downloader, which then deploys the SlowStepper implant.

Malware#slowstepper#aptGermany+6

The UK government has exposed a bulletproof hosting operator that is linked to major ransomware groups including BlackBasta, Evil Corp, and LockBit. Bulletproof hosting providers offer cybercriminals resilient infrastructure to host malicious operations with minimal risk of takedown. This exposure highlights the ongoing support infrastructure enabling ransomware campaigns that target organizations globally. While no direct exploit or vulnerability is reported, the takedown or exposure of such hosting services can disrupt ransomware operations. European organizations remain at risk due to the widespread targeting by these ransomware groups. The threat is medium severity given the indirect nature of the exposure and absence of direct exploitation details. Defenders should monitor for ransomware activity linked to these groups and collaborate with law enforcement to mitigate infrastructure abuse. Countries with high ransomware targeting history and significant digital infrastructure are most likely affected.

Malware#infosecnews#redditGermany+7

A Python-based worm propagates through WhatsApp, spreading the Eternidade stealer malware primarily targeting Brazilian devices. This malware harvests sensitive information from infected systems, leveraging social engineering via WhatsApp to self-replicate and infect new victims. Although currently focused on Brazil, the worm's propagation method and malware payload pose risks to any WhatsApp users, including European organizations with employees or contacts linked to Brazil. The worm does not require complex exploits but relies on user interaction to propagate. There is no known CVSS score, but the threat is assessed as high severity due to its potential impact on confidentiality and ease of spread. Defenders should focus on user awareness, endpoint detection, and network monitoring to mitigate infection risks. Countries with strong economic or cultural ties to Brazil and high WhatsApp usage are more likely to be affected in Europe.

Malware#infosecnews#redditPortugal+6

A hacker is reportedly selling healthcare data allegedly stolen from Samsung Medison via a third-party breach. The breach involves sensitive healthcare information, raising significant confidentiality concerns. The data theft originates not from Samsung Medison directly but through a compromised third-party vendor, complicating attribution and response. No specific affected software versions or exploits are identified, and there is minimal public discussion or technical detail available. The breach is considered high severity due to the sensitivity of healthcare data and potential privacy violations. European healthcare organizations could face indirect risks if they use Samsung Medison products or share data with affected third parties. Mitigation requires enhanced third-party risk management, monitoring for data leaks, and incident response readiness. Countries with strong healthcare sectors and significant Samsung Medison market presence, such as Germany, France, and the UK, are most likely to be impacted. Given the nature of the breach, the severity is assessed as high due to the impact on confidentiality and potential regulatory consequences. Defenders should prioritize verifying third-party security, monitoring dark web marketplaces, and preparing for potential regulatory inquiries.

Breach#infosecnews#redditGermany+6

When people discuss the security implications of Unicode, International Domain Names (IDNs) are often highlighted as a risk. However, while visible and often talked about, IDNs are probably not what you should really worry about when it comes to Unicode. There are several issues that impact application security beyond confusing domain names.

NewsGermanyFrance+10

When the sales hit, you might bag some serious bargains; however, you also have to watch out for unscrupulous vendors that just jack up prices. We’re bringing AI into the mix and suggesting working prompts designed to unlock genuine value.

AnalysisGermanyFrance+8

AI-enhanced phishing campaigns are enabling cybercriminals to craft highly convincing and scalable attacks that mimic sophisticated marketing efforts, increasing the risk of account takeover, data theft, and identity fraud. These AI-driven phishing attacks leverage automation and advanced language models to personalize messages, evade detection, and exploit human trust. European organizations face increased exposure due to the widespread use of email and digital communication platforms targeted by these campaigns. The threat does not require exploiting software vulnerabilities but relies on social engineering, making it broadly applicable across sectors. Mitigation requires a combination of advanced email filtering, user training focused on AI-generated phishing tactics, and deployment of multi-factor authentication. Countries with high digital adoption and significant financial, governmental, and industrial sectors are most at risk. Given the medium severity rating and the nature of the threat, organizations must proactively adapt defenses to counter AI-powered social engineering. This threat highlights the evolving landscape of phishing attacks amplified by AI capabilities, necessitating enhanced vigilance and tailored security strategies.

PhishingGermanyFrance+5

Microsoft said the DDoS attack was aimed at an endpoint in Australia and reached 15.72 Tbps and 3.64 Bpps. The post Largest Azure DDoS Attack Powered by Aisuru Botnet appeared first on SecurityWeek .

Botnet#dosGermany+5

EdgeStepper is a sophisticated malware implant that manipulates DNS queries to hijack software update mechanisms, enabling the deployment of malicious payloads. By rerouting DNS requests, it intercepts and redirects legitimate update traffic to attacker-controlled servers, facilitating stealthy malware distribution. This technique undermines software supply chain integrity and can lead to widespread compromise of affected systems. The threat is classified as high severity due to its potential to impact confidentiality, integrity, and availability without requiring user interaction or authentication. European organizations relying on vulnerable software update infrastructures are at risk, especially those in critical sectors. Mitigation requires enhanced DNS monitoring, validation of update sources, and network segmentation to detect and block anomalous DNS behavior. Countries with significant technology sectors and critical infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the complexity and stealth of the attack vector, this threat demands urgent attention and tailored defensive measures.

Malware#infosecnews#redditGermany+6

The PlushDaemon threat group has been reported to hijack software updates as part of supply-chain attacks, compromising the integrity of software distribution mechanisms. This attack vector allows adversaries to inject malicious code into legitimate software updates, potentially affecting a wide range of organizations relying on the targeted software. While specific affected software versions and exploits in the wild have not been detailed, the high severity rating indicates significant risk. European organizations could face data breaches, operational disruptions, and reputational damage if targeted. Mitigation requires rigorous supply-chain security practices, including verifying update authenticity and monitoring for anomalous update behavior. Countries with strong software development sectors and critical infrastructure relying on third-party software are at higher risk. Given the attack complexity and potential widespread impact, the threat is assessed as high severity. Defenders should prioritize supply-chain security controls and incident readiness to mitigate this evolving threat.

News#infosecnews#redditGermany+7

The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.

Campaign#infosecnews#redditGermany+9

WEBJACK is a malware campaign targeting Microsoft IIS servers by deploying BadIIS malware modules to conduct SEO poisoning and fraud. The attackers hijack high-profile websites, including government and educational institutions, redirecting users to gambling sites. The campaign selectively serves malicious content to search engine crawlers while redirecting or blocking normal visitors, leveraging legitimate IIS modules for stealth. Originating from a Chinese-speaking threat actor, it primarily affects Southeast Asia and Latin America, with a focus on Vietnamese-language targets. Although no known exploits are publicly reported, the campaign uses advanced tools such as Cobalt Strike and XLANY Loader. The threat demonstrates evolving IIS hijacking techniques and abuse of legitimate security tools for monetization. European organizations could be at risk if targeted due to the use of IIS servers and the potential for reputational damage and fraud. Mitigation requires specific IIS module monitoring, integrity checks, and enhanced web server security. Countries with significant IIS usage and strategic government or educational targets, such as Germany, France, and the UK, are more likely to be affected. The threat severity is assessed as medium given the targeted nature, impact on availability and integrity, and moderate ease of exploitation without user interaction.

Malware#badiis#latin americaFrance+6

A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories, unpacks components, and generates new APK files before silently installing the malware. BTMob grants extensive device access, enabling credential theft and surveillance. UASecurity Miner focuses on persistence and remote control. The attack chain involves social engineering, APK generation, third-party packer services, and multiple command and control endpoints, reflecting a growing trend in modular Android threats.

Malware#android#apk packerGermany+7

In October 2025, a major U. S.real estate firm was targeted by a sophisticated cyberattack leveraging the emerging Tuoni command-and-control (C2) framework. The attack chain began with social engineering via Microsoft Teams impersonation, delivering a malicious PowerShell script that used steganography to hide payloads within images and employed in-memory execution to evade detection. The Tuoni C2 framework served as the core implant, enabling stealthy remote control. The attack showed signs of AI-assisted code generation, indicating advanced threat actor capabilities. Morphisec's Automated Moving Target Defense (AMTD) technology successfully prevented the attack before execution, demonstrating effectiveness against unknown threats without relying on signatures or heuristics. Although the attack was neutralized, the techniques used highlight evolving adversary tactics that could threaten organizations globally. No known exploits are currently in the wild, and no CVE or specific threat actor attribution is available. The medium severity rating reflects the attack's complexity and potential impact if successful.

Malware#tuoni c2#real estateGermany+5

'The Gentlemen' ransomware group, active since July 2025, operates a Ransomware-as-a-Service (RaaS) platform that employs advanced dual-extortion tactics by encrypting data and exfiltrating sensitive information to coerce ransom payments. Their ransomware targets Windows, Linux, and ESXi platforms, encrypting both local and network-shared drives using strong cryptographic algorithms XChaCha20 and Curve25519. Recent updates include automatic self-restart, run-on-boot persistence, configurable encryption speeds, and attack methods, enhancing their operational resilience and adaptability. The group has publicly disclosed 47 victims within two months, indicating rapid propagation and impact. The malware leverages multiple MITRE ATT&CK techniques such as persistence (T1547.001), data encryption (T1486), and network share discovery (T1135). No known exploits or CVEs are associated yet, but the threat is significant due to its multi-platform support and dual-extortion approach. European organizations with mixed OS environments and ESXi virtualization are at particular risk. Mitigation requires tailored detection of persistence mechanisms, network segmentation, and robust incident response plans. Countries with high adoption of VMware ESXi and diverse enterprise IT infrastructures, such as Germany, France, and the UK, are likely most affected.

Malware#linux#raasGermany+6

The Akira ransomware attack exploited a fake CAPTCHA to maintain a 42-day compromise within a victim's environment. This social engineering tactic led to prolonged unauthorized access, enabling the attackers to deploy ransomware and potentially exfiltrate data. The attack highlights the use of deceptive user interaction elements to bypass defenses and gain persistence. Although no known exploits or patches are currently associated, the threat demonstrates a medium severity due to its extended dwell time and ransomware impact. European organizations, especially those with high reliance on user-facing web services, are at risk of similar social engineering-based ransomware attacks. Mitigation requires enhanced user awareness, robust endpoint detection, and network segmentation to limit lateral movement. Countries with significant digital infrastructure and critical industries, such as Germany, France, and the UK, are more likely to be targeted. Given the attack's complexity and impact, the suggested severity is medium. Defenders should focus on detecting social engineering attempts, monitoring unusual user activity, and implementing multi-layered security controls to reduce exposure.

Malware#infosecnews#redditGermany+5

This threat analysis highlights how certain legitimate Python packages can be repurposed by attackers to build surveillance and spyware tools. These packages enable capabilities such as keylogging, screen capture, webcam access, and browser data extraction. The write-up emphasizes the ease with which these libraries can be misused to create full-scope monitoring malware without requiring vulnerabilities in the packages themselves. While no direct exploits or vulnerabilities are reported, the potential for abuse exists due to the functionality these packages provide. The threat is categorized as medium severity given the potential impact on confidentiality and privacy, combined with the ease of misuse by attackers. European organizations using Python in development or automation environments could be targeted for espionage or data theft. Mitigations focus on developer awareness, supply chain security, and monitoring for suspicious use of these packages. Countries with strong software development sectors and critical infrastructure relying on Python are most likely to be affected. This analysis is based on a recent audit-style report shared on Reddit’s NetSec community and does not describe an active exploit campaign.

Malware#netsec#redditGermany+7

The Tuoni Command and Control (C2) infrastructure was involved in a high-priority attempted cyber intrusion targeting the real-estate sector in 2025. While detailed technical indicators and affected software versions are not disclosed, the threat is characterized as a botnet operation with a high severity rating. The attack appears to be focused on leveraging Tuoni C2 to orchestrate malicious activities within real-estate organizations, potentially aiming at data exfiltration, disruption, or espionage. No known exploits in the wild have been reported yet, and the discussion around this threat remains minimal. European real-estate firms, especially in countries with significant property markets and digital infrastructure, could be at risk. Mitigation requires enhanced network monitoring for botnet-related traffic, strict segmentation of critical systems, and proactive threat hunting for Tuoni C2 indicators. Countries like the UK, Germany, France, and the Netherlands are likely to be most affected due to their large real-estate markets and historical targeting patterns. Given the high potential impact on confidentiality and availability, ease of botnet deployment, and lack of authentication barriers, the threat severity is assessed as high.

Botnet#infosecnews#redditGermany+5

A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.

Campaign#anti-abuse#fake accountsGermany+7