A recent ransomware attack attributed to the RansomHub group was uncovered following an unusual CPU spike detected in a system. The attack involves ransomware that encrypts data and demands payment for decryption keys, posing a significant threat to affected organizations. Although no specific affected software versions or exploits in the wild have been reported, the high severity rating indicates a serious risk. European organizations, especially those with critical infrastructure or high-value data, could face operational disruption and financial losses. Mitigation requires proactive monitoring of system performance anomalies, robust endpoint protection, network segmentation, and incident response readiness. Countries with high adoption of vulnerable systems and strategic importance in sectors like finance, manufacturing, and healthcare are more likely to be targeted. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through typical ransomware infection vectors, and no need for user interaction beyond initial compromise, the threat severity is assessed as high. Defenders should prioritize detection of abnormal resource usage patterns and maintain updated backups to mitigate potential damage.
Fantasy Hub is a Russian-sold Android Remote Access Trojan (RAT) offered as Malware-as-a-Service (MaaS) that enables full device espionage. It targets Android devices, allowing attackers to remotely control and extract sensitive data. Although no known exploits in the wild are reported yet, the malware's capabilities pose a medium-level threat. The RAT can compromise confidentiality and privacy by accessing device sensors, communications, and stored data. European organizations with employees using Android devices are at risk, especially those in sectors with sensitive information. Mitigation requires enhanced mobile security hygiene, including restricting app installations, monitoring network traffic, and deploying mobile threat defense solutions. Countries with high Android adoption and strategic importance in cybersecurity, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of deployment via MaaS and the potential for significant data compromise without user interaction, the threat severity is assessed as high. Defenders should prioritize detection and containment strategies to mitigate potential espionage activities.
GlobalLogic has disclosed a data breach resulting from a security incident involving Oracle, leading to the theft of personal data affecting approximately 10,000 GlobalLogic employees. The breach stems from an Oracle-related compromise, though specific technical details about the vulnerability or attack vector have not been publicly disclosed. This incident highlights risks associated with third-party software supply chain security and the potential exposure of sensitive employee information. European organizations with ties to GlobalLogic or using Oracle products should be alert to similar risks. The breach could lead to identity theft, phishing attacks, and reputational damage. Mitigation requires enhanced monitoring of Oracle environments, employee awareness training, and verification of third-party security postures. Countries with significant Oracle and GlobalLogic presence, such as the UK, Germany, France, and the Netherlands, are likely to be most impacted. Given the scale and sensitivity of the data theft, the severity is assessed as high. Defenders should prioritize incident response, data protection, and supply chain risk management to mitigate further exposure.
SAP has addressed a high-severity security flaw involving hardcoded credentials in its SQL Anywhere Monitor product. This vulnerability could allow attackers to gain unauthorized access to monitoring systems, potentially leading to data exposure or system manipulation. Although no known exploits are currently reported in the wild, the presence of hardcoded credentials represents a significant risk, especially in enterprise environments where SQL Anywhere Monitor is deployed. European organizations using this SAP product should prioritize patching to prevent exploitation. The flaw impacts confidentiality and integrity, as attackers could bypass authentication controls. Mitigation involves applying SAP's security updates promptly and auditing affected systems for unauthorized access. Countries with substantial SAP enterprise deployments, such as Germany, the UK, and France, are most likely to be affected. Given the ease of exploitation and potential impact, the severity is assessed as high. Defenders should focus on rapid patch management and monitoring for suspicious activity related to SQL Anywhere Monitor.
Mozilla has implemented fresh fingerprinting protections to prevent hidden trackers from identifying Firefox users. The post New Firefox Protections Halve the Number of Trackable Users appeared first on SecurityWeek .
Enforcement of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) requirements started on November 10, 2025. The post CMMC Live: Pentagon Demands Verified Cybersecurity From Contractors appeared first on SecurityWeek .
Have I Been Pwned (HIBP) has added 1.96 billion accounts from the Synthient credential data breach to its database, significantly expanding the volume of exposed credentials available for threat actors. This large-scale credential exposure increases the risk of credential stuffing, account takeover, and phishing attacks targeting users whose data is included. Although no direct exploit or vulnerability is reported, the aggregation of such a vast dataset poses a substantial threat to organizations relying on password-based authentication. European organizations face heightened risks due to the potential for compromised credentials to be used against their employees and customers. Mitigation requires proactive credential hygiene, including enforcing multi-factor authentication, monitoring for credential reuse, and leveraging threat intelligence feeds like HIBP to identify affected accounts. Countries with high digital adoption and large enterprise sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most impacted. Given the scale and potential for widespread abuse without requiring user interaction or system vulnerabilities, the severity is assessed as high. Defenders should prioritize rapid detection and response to credential-based attacks stemming from this data exposure.
Quantum Route Redirect PhaaS is a high-severity phishing-as-a-service campaign targeting Microsoft 365 users globally. It leverages route redirection techniques to intercept and manipulate user traffic, aiming to harvest credentials or deliver malicious payloads. The threat exploits the widespread adoption of Microsoft 365, making it a significant risk for organizations relying on this platform. No known exploits in the wild have been confirmed yet, but the potential for credential theft and unauthorized access is substantial. European organizations using Microsoft 365 are at risk, especially those in countries with high Microsoft 365 market penetration and strategic importance. Mitigation requires advanced monitoring of network traffic, strict email filtering, and user awareness training focused on phishing and route manipulation tactics. Countries like Germany, the United Kingdom, France, and the Netherlands are likely to be most affected due to their extensive Microsoft 365 usage and critical infrastructure reliance. Given the ease of exploitation via phishing and the broad impact on confidentiality and integrity, the threat severity is assessed as high. Defenders should prioritize detection of anomalous routing behaviors and implement multi-factor authentication to reduce risk.
APT37, a known advanced persistent threat group, has been observed abusing Google Find Hub functionality to conduct data-wiping attacks on Android devices. This attack leverages the integration between Google Find Hub and Android to remotely trigger destructive actions, leading to potential data loss and device disruption. While no specific affected versions or exploits in the wild have been confirmed, the threat is considered high severity due to the destructive nature and potential for targeted attacks. European organizations using Android devices with Google Find Hub integration are at risk, especially those in sectors targeted by APT37. Mitigation requires strict control over device permissions, monitoring for unusual Find Hub activity, and applying security best practices for Android device management. Countries with high Android adoption and strategic interest to APT37, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the potential impact on data integrity and availability, ease of exploitation via trusted device features, and no need for user interaction. Defenders should prioritize detection of anomalous Find Hub commands and enforce robust endpoint security policies.
A critical vulnerability in Triofox has been exploited to execute malicious payloads by manipulating antivirus (AV) configurations. This flaw allows attackers to leverage AV settings to run arbitrary code, potentially leading to full system compromise. Although no known exploits in the wild have been reported yet, the severity is critical due to the nature of the attack vector and the potential impact. European organizations using Triofox, especially those integrating it with AV solutions, are at risk. The exploit requires no user interaction and can affect confidentiality, integrity, and availability of systems. Immediate mitigation steps include reviewing AV configurations, applying any available patches, and monitoring for suspicious activity. Countries with significant Triofox adoption and critical infrastructure relying on AV-integrated file sharing solutions are most vulnerable. Given the ease of exploitation and critical impact, this threat demands urgent attention from defenders in Europe.
A critical vulnerability in Gladinet's Triofox file-sharing platform, CVE-2025-12480, allowed unauthenticated access to configuration pages, enabling arbitrary payload execution. Threat actor UNC6485 exploited this flaw as early as August 24, 2025, bypassing authentication and chaining it with anti-virus feature abuse for code execution. The vulnerability affected Triofox version 16.4.10317.56372 and was patched in version 16.7.10368.56560. Attackers created admin accounts, deployed remote access tools, conducted reconnaissance, and attempted privilege escalation. They used Zoho UEMS, Zoho Assist, and Anydesk for remote access, and set up encrypted tunnels for C2 communication. The exploit chain involved HTTP host header manipulation and abuse of the built-in anti-virus feature to execute malicious scripts.
The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.
The LANDFALL spyware campaign targets Samsung Galaxy phones by delivering malicious images via WhatsApp. These images exploit vulnerabilities in the device's image processing to install spyware without user interaction. The spyware can exfiltrate sensitive data, monitor communications, and compromise device integrity. Although no known exploits are currently in the wild, the attack vector via a popular messaging app and widely used devices poses a significant risk. European organizations using Samsung Galaxy phones, especially those with high-value data, could be targeted. Mitigation requires patching vulnerable devices, restricting image processing from untrusted sources, and enhancing mobile threat detection. Countries with high Samsung market share and strategic geopolitical relevance are more likely to be affected. Given the medium severity and complexity of exploitation, vigilance and proactive defense are essential for European defenders.
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
Today, I noticed scans using the username "FTP_3cx" showing up in our logs.3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty for this particular string. The 3CX software does not appear to run an FTP server, but it offers a feature to back up configurations to an FTP server [2]. The example user used in the documentation is "3cxftpuser", not "FTP_3cx". Additionally, the documentation notes that the FTP server can run on a different system from the 3CX software. For a backup, it would not make much sense to have it all run on the same system.
For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and potentially exposing sensitive communications between congressional offices and CBO […] The post 10th November – Threat Intelligence Report appeared first on Check Point Research .
OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications. The post Two New Web Application Risk Categories Added to OWASP Top 10 appeared first on SecurityWeek .
A large-scale phishing campaign named ClickFix is targeting hotel systems by delivering PureRAT malware. The attack uses phishing emails to trick hotel employees into executing malicious payloads, compromising system confidentiality and integrity. PureRAT is a remote access trojan capable of data exfiltration, credential theft, and persistent access. European hotel organizations face risks of operational disruption, data breaches, and reputational damage. The threat is high severity due to the malware's capabilities and the scale of the phishing campaign. Mitigation requires targeted employee training, enhanced email filtering, network segmentation, and endpoint detection tuned for RAT behaviors. Countries with significant tourism industries and large hospitality sectors, such as Spain, Italy, France, Germany, and the UK, are most likely affected. Given the ease of phishing exploitation and the critical nature of hospitality systems, this threat demands immediate attention from European cybersecurity teams.
The Louvre Museum reportedly used the password "Louvre" for its security camera network, representing a weak credential choice. This poor password practice exposes the camera network to unauthorized access, potentially allowing attackers to view or manipulate surveillance footage. While no known exploits are currently active in the wild, the use of such an easily guessable password poses a medium-level security risk. European organizations, especially cultural institutions with public-facing assets, could face similar risks if weak password policies are employed. Attackers gaining access to surveillance systems can compromise physical security and privacy. Mitigation requires enforcing strong password policies, implementing multi-factor authentication, and regularly auditing access controls. Countries with prominent cultural institutions and high tourism, such as France, Germany, Italy, and the UK, are more likely to be affected. Given the ease of exploitation and potential impact on confidentiality and integrity, this threat is assessed as medium severity. Defenders should prioritize credential hygiene and network segmentation to reduce risk.
The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland. The post Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site appeared first on SecurityWeek .
