Threats affecting Spain

A nation-state threat actor conducted a year-long cyber intrusion targeting Ribbon Communications, a major US telecom equipment provider. The attack involved persistent unauthorized access, likely aiming to compromise sensitive telecom infrastructure and intellectual property. Although specific technical details and exploited vulnerabilities are not disclosed, the breach underscores risks to telecom supply chains globally. European organizations relying on Ribbon Communications' products could face indirect impacts through compromised equipment or disrupted services. Mitigation requires enhanced monitoring of supply chain security, rigorous network segmentation, and proactive threat hunting focused on telecom infrastructure. Countries with significant telecom sectors and Ribbon Communications' market presence, such as Germany, France, and the UK, are most at risk. Given the prolonged nature of the attack and potential for espionage or disruption, the threat severity is assessed as high. Defenders should prioritize supply chain risk assessments and implement strict access controls to mitigate similar threats.

News#infosecnews#redditGermany+6

Warlock ransomware is a newly analyzed malware strain deployed through chained vulnerabilities in ToolShell SharePoint environments. The attack leverages multiple SharePoint weaknesses to gain unauthorized access and execute ransomware payloads, encrypting victim data. Although no known exploits are currently observed in the wild, the complexity of the attack chain and the critical nature of SharePoint in enterprise collaboration make this a medium-severity threat. European organizations using ToolShell SharePoint integrations are at risk, especially those with insufficient patching or monitoring of SharePoint components. Mitigation requires a focused approach on securing SharePoint configurations, applying strict access controls, and monitoring for unusual activity related to ToolShell modules. Countries with high adoption of Microsoft SharePoint and related collaboration tools, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. Given the ransomware nature, the impact includes potential data loss, operational disruption, and financial costs. Defenders should prioritize vulnerability assessments of SharePoint environments and implement layered defenses to prevent exploitation of chained vulnerabilities.

Malware#netsec#redditGermany+5

The hackers stole names, addresses, dates of birth, Social Security numbers, and health and insurance information. The post 10 Million Impacted by Conduent Data Breach appeared first on SecurityWeek .

BreachGermanyFrance+6

A major US telecom backbone provider, Ribbon Communications, was reportedly compromised by nation-state actors. Ribbon Communications supplies critical communications technology to the US government and major telecom operators. Although specific technical details of the breach are not disclosed, the attack likely targets sensitive infrastructure supporting telecom networks. The incident highlights risks to telecom supply chains and potential impacts on network confidentiality, integrity, and availability. No known exploits or patches have been reported yet. European organizations relying on interconnected telecom infrastructure or using Ribbon products may face indirect risks. Mitigation requires enhanced monitoring, supply chain risk assessments, and collaboration with vendors. Countries with significant telecom infrastructure linked to US networks or strategic geopolitical interest in US-China/Russia relations are more likely to be affected. Given the medium severity and lack of detailed exploit information, the threat is assessed as high due to the critical nature of telecom backbone systems and potential for disruption or espionage.

CampaignGermanyFrance+6

Hacktivists have been reported by the Canadian Centre for Cyber Security to increasingly target internet-exposed Industrial Control Systems (ICS), with confirmed tampering incidents at a water facility and an oil and gas firm in Canada. These attacks highlight the growing risk to critical infrastructure sectors from threat actors exploiting exposed ICS environments. While no known exploits are currently in the wild, the medium severity rating reflects the potential for disruption to essential services. European organizations operating similar ICS environments, especially in water and energy sectors, face comparable risks. The threat underscores the need for enhanced ICS network segmentation, strict access controls, and continuous monitoring to detect unauthorized activity. Countries with significant oil, gas, and water infrastructure and high ICS adoption are more likely to be targeted. Given the ease of exploitation of internet-exposed ICS and the critical nature of these systems, the suggested severity is high. Defenders should prioritize reducing ICS exposure to the internet and implementing robust incident response plans tailored to ICS environments.

NewsGermanyFrance+6

The PolarEdge threat actor operates a sophisticated botnet infrastructure leveraging a newly discovered RPX_Client component and over 140 VPS nodes as RPX Servers. This infrastructure uses a multi-hop relay design involving more than 25,000 compromised IoT devices to conceal attack origins and enable proxy services and remote command execution. The botnet exploits CVE-2023-20118 to compromise IoT devices, facilitating anonymized and encrypted communications via SOCKS5 and Trojan protocols. Despite no known active exploits in the wild, the infrastructure poses a medium severity risk due to its potential for stealthy persistence, evasion, and large-scale disruptive attacks such as DDoS. The use of suspicious certificates and reverse-connect proxies complicates detection and mitigation efforts. The threat primarily impacts IoT ecosystems globally, with a focus on European organizations.

KEVMalware#proxy#infrastructureGermany+6

Tangerine Turkey is a cryptomining campaign that propagates via VBScript worms spread through USB drives, leveraging legitimate system binaries for execution and persistence. The malware employs advanced defense evasion techniques such as registry modification and masquerading malicious files as legitimate system components. It establishes persistence through malicious services and scheduled tasks while attempting to disable Windows Defender. Although its primary objective is unauthorized cryptocurrency mining, its capabilities for persistence and lateral movement pose broader security risks. The campaign uses living-off-the-land binaries and creates mock directories to conceal its activities. No known CVEs or exploits are currently associated with this threat. The medium severity rating reflects the financial motivation and potential for system compromise without immediate destructive impact. European organizations using Windows systems with USB access are at risk, especially those with lax endpoint security controls and high-value targets. Mitigation requires targeted controls beyond generic advice, including USB device management, monitoring for living-off-the-land abuse, and registry integrity checks.

Campaign#vbscript#living-off-the-landGermany+6

In October 2025, a wave of sophisticated cyber attacks targeted corporate environments, leveraging phishing campaigns exploiting trusted platforms like Google Careers and ClickUp, abusing Figma for credential theft, and deploying the LockBit 5.0 ransomware variant against ESXi and Linux systems. Attackers used legitimate cloud services and multi-stage redirection to evade detection, while a new phishing kit named TyKit emerged. These campaigns threaten corporate credentials, infrastructure integrity, and data confidentiality across multiple sectors. The attacks do not require known exploits in the wild but rely heavily on social engineering and abuse of trusted platforms. Security operations centers (SOCs) must enhance detection capabilities, harden access controls, and employ advanced threat intelligence to mitigate these evolving threats. The overall severity is medium, reflecting the complexity and multi-vector nature of the attacks but without widespread exploitation of zero-day vulnerabilities. European organizations, especially those using affected platforms and cloud services, face significant risks from credential theft and ransomware infection.

Campaign#clickup#lockbit 5.0Germany+7

Let’s compare TikTok, Twitch, YouTube, Reddit, Pinterest, Facebook, Instagram, and other social media based on the amount of data they collect and their privacy settings.

AnalysisGermanyFrance+8

MITRE has unveiled the latest version of ATT&CK, with the most significant changes in the defensive part of the framework. The post MITRE Unveils ATT&CK v18 With Updates to Detections, Mobile, ICS appeared first on SecurityWeek .

News#mobileGermany+5

Airstalk is a newly discovered Windows-based malware family used by a suspected nation-state actor, CL-STA-1009, in supply chain attacks targeting business process outsourcing companies. It exists in PowerShell and . NET variants, with the latter exhibiting advanced features such as multi-threaded command-and-control (C2) protocols, versioning, and signed binaries. The malware abuses the AirWatch API for mobile device management to covertly communicate with its C2 infrastructure. It exfiltrates sensitive browser data including cookies, history, and bookmarks, enabling extensive data theft. Its evasion techniques and adaptive behavior make it particularly dangerous in third-party vendor environments. No known public exploits exist yet, but the threat poses a medium severity risk with potential for significant impact on confidentiality and operational security. European organizations relying on outsourcing and mobile device management solutions are at elevated risk, especially in countries with strong BPO sectors. Mitigation requires enhanced supply chain security, monitoring of AirWatch API usage, and behavioral detection of anomalous PowerShell and . NET activities.

Malware#nation-state#airstalkGermany+7

The Trigona threat actor continues to target MS-SQL servers through brute-force and dictionary attacks, exploiting weak credentials. They use CLR Shell for additional payloads and employ various tools like BCP, Curl, Bitsadmin, and PowerShell to install malware. The attackers utilize remote control tools such as AnyDesk, RDP, and possibly Teramind. New scanner malware written in Rust targets RDP and MS-SQL services. The threat actor also uses tools like SpeedTest and a custom StressTester. Various privilege escalation and file manipulation tools are employed. To protect against these attacks, administrators should use complex passwords, regularly update security software, and implement firewalls to control access to database servers.

Malware#remote-control#ransomwareGermany+6

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.

Malware#ghostgrab#cryptocurrency miningGermany+7

Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.

Threat Actor#trinper#cobalt strikeGermany+8

Japan’s Dentsu has disclosed a Merkle data breach impacting clients, suppliers, and employees. The post Ad and PR Giant Dentsu Says Hackers Stole Merkle Data appeared first on SecurityWeek .

BreachGermanyFrance+5

CISA has issued a warning about two newly discovered vulnerabilities in Dassault systems that are currently being actively exploited. These vulnerabilities pose a high risk due to their active exploitation status and potential impact on affected systems. Although specific technical details and affected versions are not provided, the alert highlights the urgency for organizations using Dassault products to prioritize mitigation efforts. European organizations relying on Dassault software, especially in aerospace, defense, and manufacturing sectors, could face significant operational and data security risks. The lack of publicly available patches increases the threat level, necessitating immediate risk assessment and temporary protective measures. Countries with strong aerospace and defense industries, such as France and Germany, are particularly at risk. Given the active exploitation and high severity, the threat is assessed as high severity. Defenders should monitor official advisories, apply any available mitigations, restrict network access to vulnerable systems, and enhance monitoring for suspicious activity related to Dassault software. This proactive approach is critical to minimizing potential damage from these vulnerabilities.

News#infosecnews#redditFrance+6

Qilin ransomware is a novel threat that leverages the Windows Subsystem for Linux (WSL) to execute Linux-based encryption tools on Windows systems, enabling it to bypass traditional Windows security controls. This technique allows the ransomware to run Linux encryptors natively within Windows environments, complicating detection and mitigation efforts. Although no known exploits are currently active in the wild, the high severity rating reflects the potential for significant impact. European organizations using Windows systems with WSL enabled are at risk, especially those with critical data and infrastructure. The ransomware’s abuse of WSL represents a shift in attack methodologies, requiring defenders to monitor both Windows and Linux subsystems. Mitigation should include disabling WSL where not needed, enhanced monitoring of WSL processes, and applying strict application control policies. Countries with high Windows adoption and significant industrial or governmental digital infrastructure, such as Germany, France, and the UK, are more likely to be targeted. Given the ransomware’s ability to compromise confidentiality, integrity, and availability without requiring user interaction, the suggested severity is high. Defenders must update their detection capabilities to include cross-platform behaviors and consider WSL as a potential attack vector.

Malware#infosecnews#redditGermany+6

Advertising giant Dentsu has reported a data breach at its subsidiary Merkle, marking a significant cybersecurity incident. The breach was disclosed via a trusted external news source and has been assessed as high severity. Although technical details and indicators of compromise are minimal, the incident involves unauthorized access to potentially sensitive data within a major advertising and marketing firm. There is no current evidence of known exploits in the wild, and the discussion level on public forums remains limited. European organizations connected to Dentsu or its subsidiaries could face risks related to data confidentiality and regulatory compliance. The breach underscores the importance of robust security controls in large marketing and advertising ecosystems. Immediate mitigation steps should focus on incident response, forensic analysis, and strengthening access controls. Countries with significant advertising markets and Dentsu presence, such as the UK, Germany, and France, are likely to be most affected. Given the potential impact on data confidentiality and the high-profile nature of the victim, the suggested severity is high.

Breach#infosecnews#redditGermany+5

The Aisuru botnet, previously known for conducting distributed denial-of-service (DDoS) attacks, has shifted its operational focus towards leveraging residential proxies. This evolution allows attackers to route malicious traffic through compromised residential IP addresses, enhancing stealth and evasion capabilities. The botnet's new use of residential proxies poses significant risks to network security, privacy, and the integrity of online services. European organizations could face increased challenges in detecting and mitigating attacks originating from legitimate residential IP ranges. The threat is assessed as high severity due to the botnet's potential to facilitate various malicious activities beyond DDoS, including credential stuffing, web scraping, and anonymized command and control communications. Mitigation requires enhanced network monitoring, anomaly detection focused on proxy traffic, and collaboration with ISPs to identify and remediate infected devices. Countries with high broadband penetration and significant residential internet usage, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. The threat's shift to residential proxies complicates traditional defense mechanisms, necessitating adaptive and proactive security strategies.

Botnet#infosecnews#redditGermany+6

Herodotus is an Android malware strain that uses sophisticated techniques to mimic human typing behavior, thereby evading traditional detection mechanisms that rely on identifying automated inputs. This stealthy approach allows the malware to operate covertly on infected devices, potentially enabling unauthorized data access or control. Although currently there are no known exploits in the wild, the malware's evasion tactics pose a medium-level threat. European organizations using Android devices, especially in sectors with high mobile usage, could face risks related to data confidentiality and device integrity. Mitigation requires deploying advanced behavioral detection tools, restricting app permissions, and educating users on the risks of installing untrusted applications. Countries with high Android market penetration and significant mobile workforce, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the malware’s stealth and potential impact, the suggested severity is medium. Defenders should prioritize monitoring for anomalous input patterns and enforce strict mobile security policies to reduce exposure.

Malware#infosecnews#redditGermany+6