A security issue has been identified in mPDF, a widely used open-source PHP library for generating PDFs from HTML, with approximately 70 million installs. Due to quirks in its logic and the use of regex, it is possible to craft inputs that trigger unintended web requests, even when inputs are sanitized. This behavior can potentially lead to remote code execution (RCE) scenarios. Although no known exploits are currently active in the wild and no patches have been released, the threat is considered medium severity. European organizations using mPDF in web applications that process user-generated HTML content are at risk, especially those lacking additional input validation or network restrictions. Mitigations include applying strict input validation beyond mPDF’s internal sanitization, isolating PDF generation processes, and monitoring outbound web requests from servers. Countries with significant PHP development ecosystems and large web hosting industries, such as Germany, France, and the UK, are more likely to be affected. Given the potential for RCE without user interaction and the widespread use of mPDF, the suggested severity is high. Defenders should prioritize reviewing mPDF usage and implement compensating controls until an official patch is available.
This report discusses the manual creation of . NET serialization gadgets, which are components that can be exploited in deserialization attacks to execute arbitrary code. While no specific vulnerabilities or exploits are currently known in the wild, the technique highlights potential risks in . NET applications that use insecure deserialization. The threat is of medium severity due to the complexity of exploitation and the need for specific conditions. European organizations using . NET frameworks in their applications should be aware of this emerging technique and review their deserialization practices. Mitigations include avoiding deserialization of untrusted data, implementing strict input validation, and employing secure coding practices. Countries with significant . NET development ecosystems and critical infrastructure relying on .
Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.
NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .
Behavioral detection allows defenders to recognize activity patterns like privilege escalation, credential theft, and lateral movement—often ahead of encryption or data exfiltration. The post How TTP-based Defenses Outperform Traditional IoC Hunting appeared first on SecurityWeek .
Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.
North Korean threat actors have launched an Android spyware campaign leveraging popular applications such as KakaoTalk and Google Find Hub to infiltrate devices. This campaign involves the deployment of spyware targeting Android users, exploiting the trust and widespread use of these applications to facilitate espionage activities. While no specific affected versions or exploits are detailed, the campaign's medium severity suggests moderate impact potential. European organizations using Android devices and communication platforms like KakaoTalk may face confidentiality risks. The attack requires targeted delivery, likely through social engineering or malicious payloads embedded in these apps or their ecosystems. Mitigation involves enhanced monitoring of Android app behavior, restricting app permissions, and user awareness training focused on suspicious links or app requests. Countries with significant Android and KakaoTalk usage, such as Germany, France, and the UK, are more likely to be affected. Given the espionage nature and potential data exfiltration, the threat is assessed as medium severity due to moderate impact and exploitation complexity. Defenders should prioritize detection of anomalous app activity and implement strict mobile device management policies.
Google is targeting the threat group known as Smishing Triad, which used over 194,000 malicious domains in a campaign. The post Google Sues Chinese Cybercriminals Behind ‘Lighthouse’ Phishing Kit appeared first on SecurityWeek .
Researchers submitted 107 bug reports during the bugSWAT hacking event at the ESCAL8 conference in New Mexico. The post Google Paid Out $458,000 at Live Hacking Event appeared first on SecurityWeek .
A global phishing campaign is exploiting the use of @facebookmail.com email invites to target Facebook Business users. Attackers send seemingly legitimate invitations appearing to come from Facebook's official domain to deceive recipients into divulging sensitive credentials or business information. This medium-severity threat leverages social engineering and brand trust to bypass user suspicion. No specific affected software versions or patches are identified, and no known exploits in the wild have been confirmed beyond the phishing campaign. The campaign's global nature and targeting of business users pose risks to confidentiality and potentially business operations. European organizations using Facebook Business services are at risk, especially those with significant social media marketing or customer engagement through Facebook. Mitigation requires heightened user awareness, email filtering tuned to detect spoofed or suspicious invites, and verification procedures for unexpected communications. Countries with high Facebook Business adoption and active digital marketing sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through phishing and the potential for credential compromise, the threat is assessed as medium severity.
Hackers have been observed abusing a feature within the Triofox antivirus solution to deploy remote access tools (RATs). This abuse enables attackers to bypass traditional security controls by leveraging trusted antivirus functionality to execute malicious payloads remotely. Although no known exploits are currently active in the wild, the technique represents a high-severity threat due to the potential for unauthorized remote access and control over affected systems. European organizations using Triofox antivirus are at risk of targeted attacks that could compromise confidentiality, integrity, and availability of critical assets. The threat requires immediate attention to monitor and restrict misuse of antivirus features. Mitigation involves strict application control policies, enhanced monitoring of antivirus behavior, and network segmentation to limit lateral movement. Countries with higher adoption of Triofox or strategic sectors relying on this antivirus are more likely to be impacted. Given the ease of exploitation through trusted software features and the high potential impact, this threat is assessed as high severity. Defenders should prioritize detection of anomalous antivirus activity and prepare incident response plans accordingly.
SAP addressed a maximum severity vulnerability in its SQL Anywhere Monitor product. The flaw, described as having maximum severity, could potentially allow attackers to compromise affected systems. Although specific technical details and affected versions were not disclosed, the vulnerability is significant enough to warrant urgent attention. No known exploits are currently reported in the wild. The medium severity rating provided may underestimate the risk given the 'maximum severity' description in the title. European organizations using SAP SQL Anywhere Monitor should prioritize patching once updates are available. The threat primarily impacts database monitoring environments, which are critical for operational continuity. Countries with a strong SAP user base and critical infrastructure relying on SAP products are at higher risk. Mitigation involves applying SAP patches promptly, restricting access to monitoring tools, and enhancing network segmentation. Given the potential impact on confidentiality, integrity, and availability, and the lack of detailed exploitation requirements, the suggested severity is high.
Synology recently addressed multiple zero-day vulnerabilities in its BeeStation product that were publicly demonstrated at the Pwn2Own Ireland security competition. These zero-days represent critical security flaws that could allow attackers to compromise affected systems. Although no known exploits are currently active in the wild, the public disclosure increases the urgency for organizations to apply patches promptly. The vulnerabilities could impact confidentiality, integrity, and availability of data managed by BeeStation, a platform often used for storage and collaboration. European organizations using Synology BeeStation should prioritize remediation to mitigate potential exploitation risks. The threat is rated high severity due to the nature of zero-day exploits and the potential for significant operational disruption. Countries with high adoption of Synology products and strategic data infrastructure are at greater risk. Immediate mitigation involves applying vendor patches once available, restricting network access to BeeStation services, and monitoring for suspicious activity. This threat highlights the importance of proactive vulnerability management and rapid response to zero-day disclosures.
The Rhadamanthys infostealer, a malware designed to steal sensitive information from infected systems, has been disrupted due to cybercriminals losing access to their command and control servers. This disruption likely hampers the malware's ability to exfiltrate stolen data and receive updates or commands. Although no active exploits are currently reported in the wild, the infostealer previously posed a high-severity threat due to its capability to compromise confidentiality and integrity of victim systems. European organizations, especially those in countries with significant use of affected platforms or targeted sectors, could have been at risk. The loss of server access may be temporary or permanent; thus, vigilance and monitoring remain essential. Mitigation should focus on endpoint detection, network monitoring for suspicious traffic, and rapid incident response to any signs of infection. Countries with advanced digital economies and high cybercrime targeting, such as Germany, France, and the UK, are more likely to have been affected. Given the malware's impact potential and ease of exploitation without user interaction, the suggested severity is high. Defenders should prioritize threat intelligence updates and strengthen defenses against infostealer malware families.
This intelligence report examines the connection between two Brazilian banking trojans, Maverick and Coyote. The malware spreads through WhatsApp, using a multi-stage attack that begins with a malicious LNK file. Both trojans share similarities in their infection methods, targeting Brazilian users and banks. The attack chain involves obfuscated PowerShell commands, downloading additional payloads from command and control servers. The malware employs anti-analysis techniques and targets specific browsers. Persistence is achieved through a batch file in the startup folder. The report provides technical details, including code samples and infection chain analysis, as well as indicators of compromise for the identified malware campaign.
The Cl0p ransomware group has reportedly listed the UK's National Health Service (NHS) as a victim shortly after a breach involving the Washington Post. Cl0p is a known ransomware threat actor that targets large organizations to extort ransom payments by encrypting data and threatening to leak stolen information. While specific technical details and exploit vectors are not provided, the incident highlights ongoing targeting of critical infrastructure and media entities. The ransomware attack on NHS could severely disrupt healthcare services, risking patient safety and data confidentiality. European organizations, especially in healthcare, should be vigilant due to the high-profile nature of this attack. Mitigation requires proactive network segmentation, enhanced monitoring for ransomware indicators, and robust incident response planning. Countries with large NHS-like healthcare systems and high digital healthcare adoption are most at risk. Given the absence of detailed exploit information but the high impact potential and no authentication requirement implied, the threat severity is assessed as high. Defenders must prioritize detection and containment strategies to prevent similar breaches and ransomware encryptions.
A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.
