Threats affecting Spain

Starting October 2026, the browser will ask users if they want to access public websites that do not use secure connections. The post Chrome to Turn HTTPS on by Default for Public Sites appeared first on SecurityWeek .

News#webGermany+6

Intel and AMD have published advisories after academics disclosed details of the new TEE.fail attack method. The post New Attack Targets DDR5 Memory to Steal Keys From Intel and AMD TEEs appeared first on SecurityWeek .

NewsGermanyFrance+6

This threat involves attackers using memory-only filesystems (tmpfs) on Linux systems, such as /dev/shm, to hide malicious tools or stage data exfiltration. Traditional forensic imaging tools cannot capture these volatile filesystems because they lack block device backing. The analyst describes a method to collect both metadata and file contents from these tmpfs mounts by first extracting inode metadata using stat commands and then archiving file contents with tar, preserving forensic integrity. This technique has been tested successfully on numerous Linux and Unix-like systems. The threat highlights the challenge of detecting and collecting evidence from in-memory filesystems that attackers exploit to evade detection. The severity is medium due to the difficulty in forensic collection and potential for attackers to hide artifacts in tmpfs, but exploitation requires system access. European organizations running Linux servers with tmpfs mounts are at risk of stealthy attacks leveraging this technique.

News#linuxGermany+8

A recent report alleges a cyberattack targeting Tata Motors, India's largest automaker. The information originates from a Reddit NetSec post linking to an external site with minimal technical details and no confirmed exploits. The severity is assessed as medium, but no specific vulnerabilities or attack vectors are disclosed. There is no evidence of widespread exploitation or detailed indicators of compromise. European organizations may face indirect risks if supply chains or partnerships with Tata Motors are affected. Mitigation should focus on supply chain risk management and enhanced monitoring of related systems. Countries with strong automotive industries and economic ties to India, such as Germany and the UK, could be more impacted. Due to limited technical data, the threat is assessed as medium severity, considering potential operational disruption and reputational damage. Defenders should prioritize verifying the authenticity of the claim and enhancing incident response readiness.

News#netsec#redditGermany+4

ThreatFox IOCs for 2025-10-29

Indicator#type:osint#tlp:whiteGermany+5

The Everest ransomware group has reportedly leaked sensitive records from AT&T, a major telecommunications carrier, and is demanding a $1 million ransom for passenger data related to Dublin Airport. This incident highlights the growing trend of ransomware actors targeting critical infrastructure and high-profile organizations to extract large ransoms. The leak of carrier records and airport passenger data poses significant risks to confidentiality and privacy. European organizations, especially those connected to aviation and telecommunications sectors, could face increased exposure to data breaches and operational disruptions. Mitigation requires targeted incident response, enhanced monitoring of sensitive data flows, and collaboration with law enforcement. Ireland is particularly at risk due to the direct targeting of Dublin Airport, while other European countries with major airports and telecom providers may also be affected. Given the medium severity rating and lack of known exploits in the wild, the threat is serious but not yet widespread. Defenders should prioritize securing access controls and data exfiltration detection to prevent similar attacks.

Malware#infosecnews#redditIreland+6

This report discusses how Security Operations Center (SOC) teams implement real-time defenses against credential replay attacks, a type of attack where stolen authentication credentials are reused to gain unauthorized access. Credential replay attacks threaten confidentiality and integrity by allowing attackers to impersonate legitimate users without needing to crack passwords. The article highlights operational strategies and tools SOC teams use to detect and mitigate these attacks promptly. While no specific vulnerabilities or exploits are detailed, the focus is on defensive measures and incident response workflows. European organizations face risks due to the widespread use of credential-based authentication systems and the increasing sophistication of attackers. Mitigation involves deploying multi-factor authentication, continuous monitoring for anomalous login patterns, and leveraging threat intelligence to identify replay attempts. Countries with high digital adoption and critical infrastructure reliance on credential authentication are more likely to be targeted. Given the medium severity and absence of active exploits, the threat remains significant but manageable with proactive defense. SOC teams must prioritize real-time detection capabilities and adaptive response to reduce the attack surface and potential damage from credential replay attacks.

News#netsec#redditGermany+7

The BiDi Swap phishing technique exploits the bidirectional text rendering feature in Unicode to craft URLs that visually appear legitimate but actually direct users to malicious sites. By inserting special Unicode control characters, attackers can reverse portions of the URL text, making fake domains look real to users and evade detection. This trick is particularly dangerous in phishing attacks where users rely on visual inspection of URLs to verify authenticity. European organizations are at risk due to widespread use of browsers and email clients that support bidirectional text rendering. The threat can lead to credential theft, malware infection, and data breaches. Mitigation requires user awareness, URL parsing improvements in security tools, and disabling or flagging suspicious bidirectional characters in URLs. Countries with high internet usage, significant financial sectors, and advanced digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant impact on confidentiality and integrity without user authentication, this threat is assessed as high severity. Defenders should prioritize detection of BiDi characters in URLs and educate users about this phishing technique.

Phishing#infosecnews#redditGermany+6

A DLL hijacking vulnerability has been identified involving narrator.exe, a Windows accessibility helper. This issue allows an attacker to load a malicious DLL by exploiting the way Windows resolves DLL dependencies for narrator.exe. Although no known exploits are currently active in the wild, the vulnerability could be leveraged to execute arbitrary code with the privileges of the affected process. The threat is rated medium severity due to the potential for privilege escalation and code execution without requiring user interaction, but it lacks widespread exploitation and detailed technical disclosure. European organizations using Windows systems with narrator.exe enabled could be impacted, especially those with high reliance on accessibility features or legacy configurations. Mitigation involves monitoring DLL loading paths, applying strict DLL search order policies, and employing application whitelisting. Countries with significant Windows enterprise usage and critical infrastructure are more likely to be targeted.

Tool#netsec#redditGermany+9

RedTiger is a medium-severity malware that targets users by stealing sensitive data including Discord authentication tokens and capturing webcam images. It is a data-stealing malware that compromises user privacy and security by exfiltrating credentials and potentially sensitive multimedia content. Although no known exploits in the wild have been reported yet, the malware’s capabilities pose significant risks if deployed. The malware’s focus on Discord tokens suggests targeting of users active on this platform, which is widely used across Europe. Webcam image theft indicates a high privacy invasion risk. Mitigation requires advanced endpoint protection, user education on phishing and suspicious downloads, and monitoring for unusual Discord token usage. European countries with high Discord adoption and strong gaming or tech sectors are more likely to be affected. Given the ease of exploitation and impact on confidentiality and privacy, the threat severity is assessed as high. Defenders should prioritize detection of this malware’s indicators and implement strict access controls on webcam and application tokens.

Malware#infosecnews#redditGermany+7

A new class of Mirai-based DDoS botnets have been launching massive attacks, but their inability to spoof traffic enables device remediation. The post TurboMirai-Class ‘Aisuru’ Botnet Blamed for 20+ Tbps DDoS Attacks appeared first on SecurityWeek .

Botnet#dosGermany+5

Recent reports indicate that ransomware payments have hit a record low, with only 23% of victims paying ransoms in Q3 2025. This trend suggests a shift in ransomware attack dynamics and victim response strategies. Although ransomware remains a significant malware threat, the declining payment rate may reflect improved defensive measures, increased law enforcement actions, or changes in attacker tactics. European organizations, often targeted by ransomware, could experience reduced financial losses from ransom payments but must remain vigilant against evolving ransomware techniques. The threat landscape is dynamic, and attackers may adapt to these changes by altering extortion methods or targeting less prepared victims. Defenders should focus on enhancing detection, incident response, and backup strategies to mitigate ransomware impact. Countries with high ransomware incident rates and critical infrastructure are more likely to be affected. Overall, while the payment rate decline is positive, ransomware remains a persistent threat requiring ongoing attention.

Malware#infosecnews#redditGermany+9

The email addresses were pulled from various sources and 16.4 million of them were not present in previous data breaches. The post Cybercriminals Trade 183 Million Stolen Credentials on Telegram, Dark Forums appeared first on SecurityWeek .

News#rceGermany+6

While reviewing malicious messages that were delivered to our handler inbox over the past few days, I noticed that the “subject” of one phishing e-mail looked quite strange when displayed in the Outlook message list…

PhishingGermanyFrance+8

A mass attack campaign is targeting WordPress websites using vulnerabilities or malicious functionalities in the GutenKit and Hunk Companion plugins. These plugins, if installed and active, could be exploited to compromise site integrity, potentially allowing attackers to execute unauthorized actions. Although no specific affected versions or known exploits in the wild have been identified yet, the campaign's scale and focus on popular WordPress plugins raise concerns. European organizations running WordPress sites with these plugins are at risk, especially those in countries with high WordPress adoption. Mitigation requires immediate auditing of installed plugins, removal or update of GutenKit and Hunk Companion plugins, and enhanced monitoring for suspicious activity. Given the medium severity and lack of detailed technical exploit data, the threat should be taken seriously but is not currently critical. Countries with large WordPress user bases and significant web infrastructure, such as Germany, the UK, France, Italy, and Spain, are most likely to be affected. Defenders should prioritize plugin hygiene and proactive threat detection to prevent compromise.

Campaign#infosecnews#redditGermany+7

Memento Labs is reportedly resurfacing as a cyber threat actor linked to the legacy of Hacking Team, a notorious surveillance software vendor known for supplying governments with offensive cyber tools. While concrete technical details and active exploits are currently minimal, the campaign's reemergence signals potential renewed activity in targeted cyber espionage or surveillance operations. There is no evidence of widespread exploitation or public exploits at this time, and the threat appears to be in early stages of observation. European organizations, especially those in government, defense, and critical infrastructure sectors, should be vigilant given Hacking Team's historical targeting patterns. Mitigation should focus on enhanced monitoring for advanced persistent threat (APT) behaviors, network segmentation, and strict access controls. Countries with significant government and defense industries, such as Germany, France, Italy, and the UK, are likely to be primary targets. Given the medium severity and lack of active exploitation, the threat should be considered medium risk but monitored closely for escalation. Defenders should prioritize threat intelligence sharing and proactive detection capabilities to identify any emerging indicators of compromise related to Memento Labs.

Campaign#infosecnews#redditGermany+7

Claims of a massive Gmail data breach have circulated recently, but Google has officially disputed these allegations, confirming that no such breach has occurred. The false claims originated from discussions on Reddit and were amplified by external news sources, causing concern in the cybersecurity community. There is no evidence of exploitation or data leakage related to Gmail accounts. Google’s denial aims to reassure users and organizations relying on Gmail services about the integrity and security of their data. Despite the high severity tag assigned to the news, the incident is a misinformation event rather than an actual security breach. Organizations should remain vigilant against phishing or social engineering attempts that might exploit such rumors. No patches or technical mitigations are necessary since no vulnerability or breach exists. European organizations should continue following best practices for email security and monitor official communications from Google for any updates. The countries with the largest Gmail user bases and significant reliance on Google Workspace services are more likely to be concerned by such rumors, including Germany, France, the UK, and the Netherlands. Overall, this event highlights the importance of verifying breach claims through trusted sources before reacting.

Breach#infosecnews#redditGermany+5

BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.

Malware#zoomclutch#rootroyFrance+10

Users of the social media platform X who utilize security keys for two-factor authentication are being warned to re-enroll their keys before November 10 to prevent account lockouts. This advisory indicates a backend or system change affecting the authentication process that requires users to update their registered security keys. Failure to comply will result in users being unable to access their accounts, potentially causing significant disruption. While no active exploits are reported, the high severity rating reflects the critical nature of account access and potential operational impact. The issue primarily affects individual users and organizations relying on X for communication and marketing. European organizations with significant social media presence or dependency on X for authentication should prioritize re-enrollment to maintain uninterrupted access. The advisory does not indicate a vulnerability or exploit but a procedural requirement to avoid service disruption. Mitigation involves timely user communication, automated reminders, and clear instructions for re-enrollment. Countries with high social media usage and digital marketing reliance, such as the UK, Germany, France, and the Netherlands, are most likely to be impacted. Given the impact on availability and user access without requiring exploitation or interaction beyond re-enrollment, the suggested severity is high.

News#infosecnews#redditGermany+6

QNAP has issued a warning about a critical security flaw in its Windows backup software related to ASP. NET. This vulnerability could allow attackers to exploit the backup software, potentially leading to unauthorized access or control over backup operations. Although no known exploits are currently reported in the wild, the flaw is considered critical due to its potential impact on confidentiality, integrity, and availability of backup data. The vulnerability affects QNAP's Windows backup software, which is used to protect data on QNAP NAS devices. European organizations relying on QNAP backup solutions may face significant risks, especially those with large-scale deployments or critical data protection needs. Immediate mitigation steps include monitoring for official patches, restricting access to backup software interfaces, and enhancing network segmentation. Countries with high adoption of QNAP NAS devices and strong reliance on backup solutions, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the critical severity and potential for exploitation without known mitigations yet, organizations should prioritize risk assessment and incident readiness. This threat underscores the importance of timely patch management and vigilant monitoring of backup infrastructure security.

News#infosecnews#redditGermany+6