Threats affecting Spain

The media company admitted that cybercriminals attempted to extort a payment after stealing personal information. The post Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack appeared first on SecurityWeek .

BreachGermanyFrance+4

Yurei ransomware, identified in September 2025, targets corporate networks primarily in transportation, IT, marketing, and food sectors. Developed in Go, it uses strong encryption algorithms ChaCha20-Poly1305 for file encryption and secp256k1-ECIES for key protection. The ransomware excludes certain files and directories to maintain system operability. Each file is encrypted with a unique key and nonce, ensuring only the attacker can decrypt the data. The ransom note threatens data leaks and regulatory notifications if demands are unmet within five days. While currently observed in Sri Lanka and Nigeria, the ransomware’s sophisticated encryption and typical corporate targeting pose a medium-level threat globally. No known exploits in the wild or CVEs exist yet. European organizations should be vigilant due to potential expansion and regulatory impact. Mitigation requires proactive network segmentation, strict access controls, and advanced detection of lateral movement and privilege escalation.

Malware#darkweb#chacha20-poly1305Germany+6

Akira was seen exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files this year. The post Akira Ransomware Group Made $244 Million in Ransom Proceeds appeared first on SecurityWeek .

Threat ActorGermanyFrance+6

Kraken ransomware is a high-severity malware threat that dynamically benchmarks infected systems to select the most effective encryption method for data extortion. It adapts its encryption strategy based on system performance metrics, optimizing the speed and impact of file encryption to maximize damage and ransom pressure. Although no known exploits are currently active in the wild, the ransomware's adaptive approach increases its potential threat level. European organizations, especially those with critical infrastructure or high-value data, face significant risks from this ransomware due to potential operational disruption and data loss. Mitigation requires proactive endpoint detection, network segmentation, and tailored incident response plans that consider Kraken's benchmarking behavior. Countries with large enterprise sectors and advanced IT infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the ransomware's ability to optimize encryption without user interaction and its high impact on confidentiality and availability, the suggested severity is high. Defenders should prioritize monitoring for unusual benchmarking activities and ensure robust backup and recovery strategies are in place.

Malware#infosecnews#redditGermany+5

A recently patched vulnerability in Fortinet FortiWeb web application firewall products has been actively exploited to create unauthorized administrative accounts. This flaw allows attackers to escalate privileges by injecting admin-level credentials, potentially leading to full control over the affected devices. Although the vulnerability has been patched, exploitation attempts have been observed in the wild, highlighting the urgency for organizations to apply updates. The attack does not require user interaction but may require network access to the FortiWeb management interface. European organizations using FortiWeb appliances are at risk of unauthorized access, data compromise, and disruption of web application security controls. Immediate patching and monitoring for suspicious admin account creation are critical to mitigate this threat. Countries with significant Fortinet market presence and critical infrastructure relying on FortiWeb are particularly vulnerable. Given the ease of exploitation and high impact on confidentiality and integrity, this vulnerability is assessed as high severity. Defenders should prioritize deploying patches, auditing admin accounts, and restricting management interface access to trusted networks.

News#infosecnews#redditGermany+9

The 'Lighthouse' phishing kit, attributed to Chinese cybercriminals, was disrupted following a lawsuit and subsequent shutdown of their cloud server. This phishing kit was used to facilitate credential theft and other phishing attacks. Although the immediate threat has been mitigated by the takedown, phishing remains a persistent risk, especially for organizations with limited email security controls. The disruption reduces active exploitation but does not eliminate the risk of similar phishing kits emerging. European organizations should remain vigilant against phishing campaigns leveraging similar tactics. The threat is assessed as low severity due to the takedown and lack of known active exploits. However, phishing attacks continue to pose risks to confidentiality and user trust. Organizations should implement targeted anti-phishing measures and user awareness training. Countries with high cloud adoption and significant digital services, such as Germany, the UK, France, and the Netherlands, may be more likely targets. Ongoing monitoring and rapid incident response remain critical to mitigate phishing threats.

PhishingGermanyFrance+4

Following Hurricane Melissa's devastation in Jamaica in October 2025, cybercriminals launched a series of online scams exploiting the disaster. These scams included phishing campaigns, fake charity websites, and fraudulent financial-relief portals impersonating legitimate aid organizations. Attackers used social engineering tactics to prey on victims' compassion and urgency, often deploying scams within hours of the hurricane. A prominent example involved a cryptocurrency donation site with fabricated transaction data and static images to appear authentic. Numerous fraudulent domains soliciting cryptocurrency donations were identified. While primarily targeting individuals, these scams undermine trust in digital charity platforms and complicate legitimate relief efforts. European organizations involved in disaster relief, financial services, or public awareness campaigns should be vigilant. The threat is medium severity due to social engineering reliance and no direct system exploitation. Mitigation requires enhanced awareness, domain monitoring, and collaboration between cybersecurity entities and relief organizations.

Campaign#phishing#cryptocurrencyGermany+7

Lumma Stealer malware has resurged since October 2025, now incorporating adaptive browser fingerprinting to enhance its command-and-control (C&C) operations. It collects detailed system, network, hardware, and browser information via JavaScript payloads and stealthy HTTP communications, enabling it to assess victim environments and evade detection. The malware continues to use process injection and maintains its core C&C communication structure while adding these new evasion and targeting capabilities. This hybrid approach improves operational continuity, targeting precision, and detection avoidance. Although no known exploits are currently reported in the wild, the malware’s stealth and data exfiltration capabilities pose a medium-level threat. European organizations should be aware of this evolving infostealer, especially those with high-value data and browser-based workflows. Mitigation requires advanced endpoint detection, network monitoring for stealthy HTTP traffic, and browser security hardening. Countries with significant digital economies and high adoption of targeted software are at greater risk.

Malware#evasion techniques#browser fingerprintingGermany+6

Russian threat actors have created approximately 4,300 fake travel websites designed to impersonate legitimate hotel booking platforms. These fraudulent sites aim to steal payment card data from unsuspecting hotel guests by capturing their payment information during the booking process. The campaign leverages phishing tactics and domain spoofing to deceive users into trusting these fake portals. There is no indication that these sites exploit software vulnerabilities; rather, they rely on social engineering and fraudulent web infrastructure. The threat poses a high risk to travelers and hospitality businesses, particularly in Europe where travel and tourism are significant economic sectors. Organizations should be vigilant about monitoring for fraudulent domains and educating customers about verifying legitimate booking sites. Mitigation involves enhanced domain monitoring, customer awareness campaigns, and deployment of anti-phishing technologies. Countries with large tourism industries and high volumes of international travelers, such as Spain, Italy, France, Germany, and the UK, are most likely to be targeted. Given the ease of exploitation and potential for significant financial theft, the severity of this threat is assessed as high.

Phishing#infosecnews#redditSpain+9

On February 24, 2022, a cyberattack exploited a VPN vulnerability in Viasat's KA-SAT satellite network, deploying AcidRain wiper malware. This attack disrupted satellite communications for thousands of users in Ukraine and disabled 5,800 wind turbines in Germany. The malware shares similarities with the VPNFilter malware family and targeted management systems to cause widespread operational disruption. Although impactful, the attack was less severe than other infrastructure attacks on Ukraine during the same period. The incident underscores the vulnerabilities in satellite network security and the critical need for robust defenses against sophisticated cyber threats targeting critical infrastructure. No known exploits are currently active in the wild, and the attack required access through a VPN vulnerability. European organizations relying on satellite communications and renewable energy infrastructure are particularly at risk. Mitigation requires patching VPN vulnerabilities, enhancing network segmentation, and monitoring for indicators of compromise related to AcidRain. Germany is notably affected due to the impact on its wind turbines, and other European countries with similar infrastructure and satellite dependencies should remain vigilant.

Malware#ukraine#wiperGermany+5

Scammers are exploiting WhatsApp's screen sharing feature to trick users into revealing one-time passwords (OTPs) and stealing funds. Attackers initiate screen sharing sessions under false pretenses, gaining real-time visibility into sensitive information such as OTPs used for two-factor authentication. This social engineering tactic bypasses technical controls by manipulating user trust and interaction. The threat primarily targets individuals but can have broader implications for organizations relying on WhatsApp for communication or authentication. No direct software vulnerability is exploited; rather, the attack leverages user behavior and the screen sharing capability. The ease of exploitation is moderate, requiring user interaction and deception. European organizations with employees or clients using WhatsApp are at risk, especially in countries with high WhatsApp penetration. Mitigation involves user education, strict policies on screen sharing, and alternative secure authentication methods. The threat is assessed as medium severity due to its impact on confidentiality and potential financial loss, despite requiring user cooperation.

News#infosecnews#redditGermany+7

Operation Endgame successfully dismantled three major malware threats: the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. Authorities seized 1025 servers linked to these operations and arrested one individual involved. These malware families were used for stealing sensitive information and controlling botnets for malicious activities. Although no active exploits are currently reported, the takedown disrupts ongoing cybercriminal campaigns. European organizations could have been targets due to the global reach of these malware strains. The medium severity reflects the moderate impact and complexity of these threats. Defenders should focus on monitoring for remnants of these malware, improving endpoint detection, and collaborating with law enforcement. Countries with high internet infrastructure and financial sectors are more likely to have been affected. The operation highlights the importance of international cooperation in combating cybercrime. Vigilance is still required as threat actors may attempt to rebuild or pivot to new malware.

Malware#infosecnews#redditGermany+6

Law enforcement recently dismantled a cybercriminal operation involving Rhadamanthys, VenomRAT, and Elysium malware, resulting in over 1,000 servers being taken down. An individual linked to VenomRAT's operation was arrested in Greece, highlighting the transnational nature of this threat. VenomRAT is a remote access trojan (RAT) known for enabling attackers to execute remote code, steal data, and maintain persistent access. The takedown disrupts ongoing malicious activities but also underscores the prior widespread compromise of servers. European organizations, especially those with exposed servers or weak endpoint defenses, remain at risk from similar RAT-based campaigns. Mitigation requires targeted detection of RAT behaviors, network segmentation, and incident response readiness. Countries with significant law enforcement cooperation and high internet infrastructure usage, such as Greece, Germany, France, and the UK, are most likely affected or targeted. Given the medium severity rating and lack of known exploits in the wild, the threat is serious but currently contained. Defenders should remain vigilant for RAT indicators and maintain robust security hygiene to prevent future infections.

Malware#rceGreece+6

Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .

AnalysisGermanyFrance+9

The UK National Health Service (NHS) is investigating claims of a hack involving Oracle E-Business Suite (EBS), with hackers naming over 40 alleged victims. The incident is under scrutiny by the NHS and the UK National Cyber Security Centre. While specific technical details and affected versions are not disclosed, the attack reportedly targets Oracle EBS, a widely used enterprise resource planning platform. No known exploits are currently confirmed in the wild, and the severity is assessed as medium. This situation highlights potential risks to sensitive healthcare and administrative data managed through Oracle EBS systems. European organizations using Oracle EBS, especially in healthcare and critical infrastructure sectors, should be vigilant. Immediate mitigation steps include enhanced monitoring, access control reviews, and collaboration with cybersecurity authorities. The UK and other European countries with significant Oracle EBS deployments are most likely to be impacted. Given the lack of detailed exploit information, the suggested severity is medium due to potential data confidentiality and integrity risks without confirmed active exploitation.

NewsGermanyFrance+5

Synnovis, a pathology services provider, suffered a ransomware attack that disrupted operations at several London hospitals and resulted in the theft of patient information. The attack caused significant operational interruptions in healthcare delivery, impacting critical diagnostic services. Although no specific vulnerability or exploit details have been disclosed, the incident highlights the risk ransomware poses to healthcare infrastructure. There is no evidence of known exploits in the wild or available patches, and the attack appears targeted at healthcare service providers. The breach of patient data raises concerns about confidentiality and regulatory compliance under GDPR. European healthcare organizations should prioritize securing their IT environments to prevent similar disruptions. Mitigation should focus on network segmentation, robust backup strategies, incident response readiness, and enhanced monitoring for ransomware indicators. Given the critical nature of healthcare services and the sensitivity of patient data, the suggested severity of this threat is high. The United Kingdom is the most directly affected country, with potential risks extending to other European nations with similar healthcare service providers and infrastructure. Defenders must be vigilant about ransomware threats targeting healthcare and ensure comprehensive cybersecurity hygiene to mitigate impact.

MalwareGermanyFrance+6

A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.

News#infosecnews#redditGermany+9

SysLeaks for Attackers is a newly launched data leak search service aimed at penetration testers and red teamers, providing access to leaked usernames, email addresses, plaintext passwords, and platform information tied to domain names. The service requires users to register with company emails from offensive security firms and excludes leaks from the last 14 days to give affected companies a grace period. Although it is in beta with usage limits, it aggregates leaked credentials that could be exploited for credential stuffing, phishing, or lateral movement. While no direct exploits or vulnerabilities are reported, the availability of such a service increases the risk of targeted attacks using real leaked credentials. European organizations could be impacted if their domains appear in the database, especially in countries with high adoption of targeted sectors or where offensive security firms operate extensively. Mitigation should focus on enhanced credential hygiene, monitoring for leaked credentials, and restricting access to sensitive systems. Given the nature of the service and its potential to facilitate attacks, the suggested severity is medium.

Breach#netsec#redditGermany+6

When I&#x27m teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[2]. Let&#x27s have a look at the infection path.

NewsGermanyFrance+6