Cloudflare experienced a global network outage impacting its services worldwide. The outage disrupted Cloudflare's network infrastructure, affecting many dependent websites and services. Although no specific vulnerability or exploit was reported, the incident highlights the risks associated with reliance on major cloud and CDN providers. The outage caused availability issues but did not indicate a breach or compromise of confidentiality or integrity. European organizations relying on Cloudflare for DNS, CDN, or security services may have faced service disruptions. No known exploits or malicious activity were linked to this event. Mitigation focuses on improving resilience through multi-provider strategies and robust incident response plans. Countries with high Cloudflare adoption and critical internet infrastructure are most likely affected. The severity is assessed as high due to the broad impact on availability and the critical nature of Cloudflare's services. Defenders should prioritize continuity planning and monitoring for similar future incidents.
The Tycoon 2FA Phishing Platform represents a sophisticated phishing framework designed to bypass legacy multi-factor authentication (MFA) methods by intercepting and relaying two-factor authentication tokens in real time. This threat undermines the security assurances of traditional MFA implementations, particularly those relying on SMS or time-based one-time passwords (TOTP). European organizations using legacy MFA solutions are at risk of credential compromise and unauthorized access, potentially leading to data breaches and operational disruptions. The platform exploits user interaction through phishing, requiring victims to enter credentials and 2FA codes on fraudulent sites. Mitigation requires adopting modern MFA methods resistant to phishing, such as hardware security keys (FIDO2/WebAuthn), continuous monitoring for phishing campaigns, and user training focused on recognizing sophisticated phishing attempts. Countries with high adoption of legacy MFA and significant digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the high impact on confidentiality and integrity, ease of exploitation via phishing, and broad scope of affected systems, the threat severity is assessed as high. Defenders must prioritize upgrading MFA solutions and enhancing phishing detection capabilities to mitigate this evolving threat.
Major online services such as ChatGPT, X, and Shopify were disrupted in a global Cloudflare outage on Nov.18th, as well as transit and city services. The post Cloudflare Outage Not Caused by Cyberattack appeared first on SecurityWeek .
The LSASS Dump via Windows Error Reporting is a recently discussed security concern involving the potential dumping of the Local Security Authority Subsystem Service (LSASS) process memory through Windows Error Reporting mechanisms. This technique could allow attackers to extract sensitive credentials stored in LSASS, such as plaintext passwords, hashes, or Kerberos tickets, facilitating lateral movement and privilege escalation within compromised networks. Although no known exploits are currently active in the wild, the medium severity rating reflects the risk posed by this method if weaponized. European organizations using Windows environments are at risk, especially those with high-value targets and critical infrastructure. Mitigation requires advanced monitoring of Windows Error Reporting activities, restricting access to LSASS memory, and employing credential protection technologies. Countries with significant Windows enterprise deployments and strategic importance in cybersecurity, such as Germany, France, and the UK, are more likely to be affected. Given the potential impact on confidentiality and the moderate ease of exploitation, the suggested severity is medium. Defenders should prioritize detection of anomalous error reporting behavior and enforce strict access controls on LSASS memory to reduce risk.
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Britain’s domestic intelligence agency warned that Chinese nationals were ”using LinkedIn profiles to conduct outreach at scale” on behalf of the Chinese Ministry of State Security. The post MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn appeared first on SecurityWeek .
Microsoft Azure recently mitigated an extremely large-scale Distributed Denial of Service (DDoS) attack reaching 15.72 Tbps, orchestrated by the Aisuru botnet. This attack represents one of the largest volumetric DDoS campaigns observed to date, leveraging a vast network of compromised devices to overwhelm Azure's infrastructure. Although no specific vulnerabilities were exploited, the attack demonstrates the increasing scale and sophistication of botnet-powered DDoS threats. European organizations relying on cloud services like Azure could face indirect impacts such as service degradation or collateral damage during such attacks. Mitigation requires advanced DDoS protection, traffic filtering, and collaboration with cloud providers. Countries with high Azure adoption and critical digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the attack's scale, ease of execution via botnets, and potential for widespread disruption, the threat severity is assessed as high. Defenders should focus on enhancing network resilience, deploying multi-layered DDoS defenses, and maintaining incident response readiness.
UNC1549, an Iranian-linked threat group, has been targeting aerospace, aviation, and defense industries since mid-2024. They employ sophisticated initial access techniques, including exploiting third-party relationships and targeted phishing. The group uses custom malware like TWOSTROKE, LIGHTRAIL, and DEEPROOT for persistence, and tools like DCSYNCER.SLICK and CRASHPAD for privilege escalation. UNC1549 demonstrates advanced lateral movement, reconnaissance, and defense evasion tactics. They extensively use SSH reverse tunnels and Azure infrastructure for command and control. The group's primary objective appears to be espionage, focusing on data collection and leveraging compromised organizations to target others in the same sector.
CVE-2025-63512 is a medium-severity SQL Injection vulnerability found in the kishan0725 Hospital Management System v4, specifically in the admin-panel1.php file within the deleting doctor functionality. The vulnerability arises because the application does not properly sanitize or parameterize the 'demail' parameter before using it in a dynamic SQL query. This flaw allows unauthenticated remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access or modification. Although no known exploits are currently reported in the wild, exploitation could compromise the confidentiality and integrity of sensitive healthcare data. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. European healthcare organizations using this system are at risk, especially those with limited security controls around legacy or niche hospital management software. Mitigation involves applying secure coding practices such as prepared statements and input validation, and monitoring for suspicious database activity. Countries with significant healthcare infrastructure and adoption of such systems, including Germany, France, Italy, Spain, and the UK, are most likely to be affected. Given the potential impact on sensitive patient data and ease of exploitation, timely remediation is critical.
Princeton University has disclosed a data breach impacting its donors and alumni, exposing sensitive personal information. The breach was recently reported and is considered high priority due to the nature of the data involved. Although no specific technical details or exploited vulnerabilities have been publicly shared, the incident highlights risks to confidentiality and privacy. There is no evidence of known exploits in the wild related to this breach. European organizations connected to educational institutions or donor management systems should be aware of similar risks. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and improving incident response. Countries with strong academic ties to Princeton or significant donor communities may be more concerned. The severity is assessed as high given the potential impact on personal data confidentiality and the trust implications. Defenders should prioritize reviewing access controls, encryption practices, and communication protocols with stakeholders. This breach underscores the ongoing threat to institutions holding sensitive personal data.
A threat actor gained initial access to a network via RDP using compromised credentials, likely obtained through an infostealer, data breach, or initial access broker. They quickly moved laterally to a domain controller, created multiple impersonation accounts with high privileges, and installed AnyDesk for persistence. Over nine days, the actor conducted extensive network reconnaissance using SoftPerfect NetScan and NetExec, mapped virtualization infrastructure, and browsed file shares. They exfiltrated sensitive data from multiple shares using temp.sh. On the final day, the actor connected to backup servers, deleted backup jobs, and deployed Lynx ransomware across multiple servers. The intrusion lasted 178 hours and leveraged compromised domain admin credentials throughout.
Jaguar Land Rover experienced a significant cyberattack in September that caused major operational disruptions and financial losses estimated at £196 million. The attack's specifics remain undisclosed, but the impact highlights vulnerabilities in critical automotive manufacturing and supply chain systems. This incident underscores the increasing targeting of large industrial and automotive firms by cyber adversaries. European organizations, especially those in automotive and manufacturing sectors, face heightened risks from similar attacks that can disrupt production and cause substantial economic damage. Mitigation requires tailored cybersecurity strategies focusing on supply chain security, network segmentation, and incident response readiness. Countries with strong automotive industries, such as Germany, the UK, France, and Italy, are particularly at risk due to their strategic importance and market penetration of affected companies. Given the financial impact and operational disruption, the threat severity is assessed as high. Defenders should prioritize proactive threat hunting, enhanced monitoring, and collaboration with industry partners to mitigate such threats effectively.
The Everest ransomware group claims to have stolen data belonging to millions of Under Armour customers along with 345GB of internal company records. This incident involves a significant data breach combined with ransomware activity, where sensitive customer and corporate data have been exfiltrated. Although no CVSS score is provided, the threat is assessed as medium severity due to the impact on confidentiality and potential reputational damage. There is no indication of known exploits in the wild or specific affected software versions. European organizations, particularly those in countries with strong retail and sportswear markets, could be indirectly impacted through supply chain or customer data exposure. Mitigation should focus on enhancing data protection, monitoring for ransomware indicators, and ensuring robust incident response plans. Countries like Germany, the UK, France, Italy, and Spain are most likely to be affected due to their market size and economic ties with global retail brands. The threat does not require user interaction for data theft but likely involves some level of initial access, making it moderately difficult to exploit. Defenders should prioritize data encryption, network segmentation, and continuous monitoring to reduce risk.
Names, addresses, email addresses, and phone numbers were compromised after an employee fell for a social engineering attack. The post DoorDash Says Personal Information Stolen in Data Breach appeared first on SecurityWeek .
Logitech was listed on the Cl0p ransomware leak website in early November, but its disclosure does not mention Oracle. The post Logitech Confirms Data Breach Following Designation as Oracle Hack Victim appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 17th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cl0p’s Oracle E-Business Suite (CVE-2025-61882) zero-day campaign continues to expand. There are new confirmed breaches at The Washington Post, Logitech, Allianz UK, and GlobalLogic, as well as a newly listed but unconfirmed […] The post 17th November – Threat Intelligence Report appeared first on Check Point Research .
The adoption of the Rust programming language in Android development has driven memory safety bugs below 20% for the first time, marking a significant improvement in Android security. This reduction in memory-related vulnerabilities is attributed to Rust's inherent memory safety features, which prevent common issues like buffer overflows and use-after-free errors. While this news highlights positive progress rather than a direct threat, it reflects evolving security practices that impact vulnerability landscapes. European organizations relying on Android devices may benefit from improved platform security, reducing risks from memory corruption exploits. However, this is not a new vulnerability or active threat but rather an informative update on security trends. No known exploits are currently in the wild related to this topic. The severity is assessed as low since this is a security improvement rather than a threat. Defenders should continue to monitor Android updates and encourage adoption of safer coding practices. Countries with significant Android user bases and development ecosystems, such as Germany, France, and the UK, are most relevant to this trend. Overall, this is positive news indicating a reduction in memory safety vulnerabilities due to Rust adoption in Android codebases.
