Recent reports indicate a decline in ransomware profits as victims increasingly refuse to pay ransom demands. This trend suggests a shift in victim response strategies, potentially reducing the financial incentives for ransomware operators. Despite the drop in profits, ransomware remains a high-priority cybersecurity threat due to its disruptive nature and potential for data loss. European organizations, often targeted by ransomware, may experience changes in attack patterns or ransom negotiation dynamics. The threat does not involve a new vulnerability or exploit but reflects evolving attacker-victim interactions. Defenders should focus on strengthening incident response, backup strategies, and ransomware resilience. Countries with high ransomware incident rates and critical infrastructure reliance on digital systems are most at risk. The severity is assessed as high given ransomware's impact on confidentiality, integrity, and availability, even if exploitation ease varies. No direct technical exploit details are provided, but the ongoing ransomware threat landscape necessitates vigilance and proactive defense measures.
CVE-2025-12299 is a medium severity cross-site scripting (XSS) vulnerability found in version 1.0 of the code-projects Simple Food Ordering System. The flaw exists in the /addproduct.php file, where manipulation of the pname, category, or price parameters allows remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as a victim visiting a crafted URL. Although no known exploits are currently observed in the wild, the exploit code has been publicly released, increasing the risk of attacks. The vulnerability can lead to theft of user credentials, session hijacking, or defacement of web content. European organizations using this software, especially in the hospitality or food service sectors, may face targeted attacks. Mitigation involves sanitizing and validating all user inputs on the affected parameters and applying patches once available. Countries with higher adoption of small to medium hospitality businesses using this software, such as Germany, France, Italy, and Spain, are more likely to be impacted.
The Water Saci campaign is a sophisticated malware operation targeting Portuguese-language systems, leveraging WhatsApp Web hijacking and multi-vector persistence mechanisms. It uses script-based techniques such as VBS downloaders and PowerShell scripts to automate malware distribution and maintain resilience. The campaign employs an email-based command and control infrastructure using IMAP for command retrieval, supplemented by HTTP polling for continuous communication. It features advanced anti-analysis capabilities and real-time remote control, enabling infected machines to operate as a coordinated botnet. The malware shares similarities with the Coyote banking trojan, indicating ties to Brazilian cybercriminal groups. Although no known exploits are reported in the wild, the campaign's complexity and persistence mechanisms pose a medium-level threat. European organizations with Portuguese-speaking user bases or connections to Brazil should be particularly vigilant. Mitigation requires targeted detection of script-based loaders, monitoring of WhatsApp Web session anomalies, and securing email clients against unauthorized IMAP access. Countries with strong economic or cultural ties to Brazil, such as Portugal and Spain, are most likely to be affected.
The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers. The post Massive China-Linked Smishing Campaign Leveraged 194,000 Domains appeared first on SecurityWeek .
HyperRat is a newly identified Android malware marketed as a ready-made spying tool, enabling attackers to covertly monitor infected devices. Although it is currently not known to be exploited in the wild, its availability as an off-the-shelf spyware increases the risk of widespread misuse. The malware targets Android devices, potentially compromising user confidentiality by accessing sensitive data and communications. European organizations with employees using Android devices are at risk of espionage and data leakage. Mitigation requires proactive mobile security measures, including app vetting, endpoint protection, and user awareness to detect and prevent installation of such spyware. Countries with high Android adoption and significant digital infrastructure, such as Germany, France, Italy, Spain, and the UK, are most likely to be affected. Given the malware’s spying capabilities, ease of distribution, and potential impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious app behavior and enforce strict mobile device management policies to reduce exposure.
A Linux variant of the Qilin ransomware has been identified that targets Windows systems by leveraging remote management tools and the Bring Your Own Vulnerable Driver (BYOVD) technique. This malware represents a cross-platform threat, using Linux-based infection vectors to compromise Windows environments. The ransomware exploits legitimate remote management utilities to gain initial access or lateral movement, while BYOVD allows it to bypass security controls by loading vulnerable or malicious drivers. Although currently assessed as medium severity and with minimal public discussion, this threat highlights evolving ransomware tactics that combine multi-OS infection methods and advanced evasion techniques. European organizations using remote management tools without strict controls may be at risk, especially those in critical infrastructure or sectors with high-value data. No known exploits are reported in the wild yet, but the potential for impactful ransomware attacks exists. Mitigation requires strict control and monitoring of remote management tools, driver integrity verification, and network segmentation. Countries with significant industrial and enterprise IT infrastructure, such as Germany, France, and the UK, are likely more exposed due to their extensive use of such technologies.
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .
Wordfence has blocked approximately 8.7 million attacks exploiting vulnerabilities in the outdated GutenKit and Hunk Companion WordPress plugins. These flaws, although old, continue to be targeted by attackers attempting to compromise WordPress sites. The attacks are widespread but do not currently have known active exploits in the wild beyond these blocked attempts. The vulnerabilities allow attackers to potentially execute unauthorized actions on affected sites, risking data confidentiality and site integrity. European organizations using these plugins remain at risk if they have not removed or patched these components. Mitigation involves removing these outdated plugins, applying any available patches, and employing robust web application firewalls like Wordfence. Countries with high WordPress usage and significant e-commerce or media sectors are more likely to be targeted. Given the scale of attacks and potential impact, the threat severity is assessed as high. Defenders should prioritize identifying and remediating these vulnerable plugins to prevent compromise.
Coveware has attributed the drop to large enterprises increasingly refusing to pay up and smaller amounts paid by mid-market firms. The post Ransomware Payments Dropped in Q3 2025: Analysis appeared first on SecurityWeek .
The Lazarus group is conducting a sophisticated malware campaign called DreamJobs, deploying modular loaders known as DreamLoaders to deliver various payloads. These loaders include a trojanized TightVNC client, DLL sideloaders such as TSVIPSrv.dll, and other components designed to stealthily extract administrator credentials. The malware authenticates to Microsoft tenants, retrieves SharePoint URLs, and loads encrypted payloads, leveraging legitimate system binaries and encrypted communications to evade detection. The campaign targets organizations’ administrative accounts to gain persistent access and exfiltrate sensitive data. The modular and flexible architecture of DreamLoaders allows the attackers to adapt payloads dynamically. No known exploits are publicly reported yet, but the campaign’s complexity and stealth techniques pose a significant threat. European organizations using Microsoft cloud services and remote administration tools like TightVNC are at risk. Mitigation requires advanced detection of sideloading and anomalous authentication behaviors. The threat is assessed as medium severity due to the need for initial access and the targeted nature of the attack.
The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks. The post Chrome Zero-Day Exploitation Linked to Hacking Team Spyware appeared first on SecurityWeek .
I was intrigued when Johannes talked about malware that uses BASE64 over DNS to communicate. Take a DNS request like this: label1.label2.tld. Labels in a request like this can only be composed with letters (not case-sensitive), digits and a hyphen character (-). While BASE64 is encoded with letters (uppercase and lowercase), digits and special characters + and /. And also a special padding character: =.
A Local File Inclusion (LFI) vulnerability exists in Traccar versions 5.8 through 6.8.1 on Windows systems due to Jetty's addPath method. This vulnerability allows unauthenticated attackers to read arbitrary files on the server by exploiting the way Jetty handles path additions. Although no known exploits are currently in the wild, the flaw can lead to sensitive information disclosure, potentially aiding further attacks. The vulnerability is specific to Windows environments and does not require authentication or user interaction, increasing its risk. European organizations using affected Traccar versions on Windows should prioritize mitigation. The threat is assessed as medium severity due to its impact on confidentiality and ease of exploitation. Countries with significant Traccar deployments and critical infrastructure monitoring are at higher risk.
CoPHish is a novel phishing technique that leverages Microsoft Copilot Studio chatbots to craft highly convincing OAuth-based credential theft campaigns. Attackers abuse the chatbot’s capabilities to generate realistic phishing content that tricks users into granting OAuth permissions, thereby compromising their accounts. This technique does not require exploiting software vulnerabilities but relies on social engineering and the abuse of legitimate OAuth flows. The threat is categorized as medium severity due to its potential impact on user credentials and organizational security, though it requires user interaction and targeted phishing attempts. European organizations using Microsoft 365 and related cloud services are at risk, especially those with extensive OAuth integrations. Mitigation involves user education on OAuth consent phishing, strict monitoring of OAuth app permissions, and enhanced email filtering. Countries with high Microsoft cloud adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through social engineering and the broad scope of affected users, the suggested severity is medium.
The Safepay ransomware group has claimed responsibility for a cyberattack targeting Xortec, a professional video surveillance provider. This incident involves unauthorized access and potential encryption or theft of sensitive surveillance data. Although detailed technical specifics and exploited vulnerabilities are not disclosed, the attack highlights risks to critical infrastructure providers. European organizations relying on Xortec's surveillance solutions could face operational disruptions and data confidentiality breaches. The ransomware nature of the attack suggests possible demands for ransom payments and risks of data exposure. Mitigation requires enhanced monitoring of network activity, strict access controls, and incident response readiness. Countries with significant deployments of Xortec products or critical infrastructure sectors are at higher risk. Given the medium severity rating and limited exploitation details, the threat is assessed as medium severity. Defenders should prioritize detection and containment strategies to minimize impact.
EDR-Redir is a technique that abuses Windows kernel components—specifically a Bind Filter driver (bindflt.sys) and the Windows Cloud Filter API (cldflt.sys)—to redirect or corrupt the working folder of Endpoint Detection and Response (EDR) software. By doing so, attackers can disrupt or disable the EDR's process services, effectively bypassing detection and response capabilities. This method does not require known exploits or published patches yet and has minimal public discussion, indicating it may be a novel or emerging technique. The attack targets the integrity and availability of EDR systems, potentially allowing attackers to operate undetected. While no active exploits are reported in the wild, the medium severity rating reflects the significant impact on security monitoring if successfully implemented. European organizations relying on Windows-based EDR solutions are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires advanced monitoring of kernel filter drivers, integrity checks on EDR folders, and restricting unauthorized driver installations. Countries with high adoption of Windows enterprise environments and advanced threat landscapes, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
A recent high-severity security news report reveals the discovery of a coordinated campaign involving multiple malicious browser extensions. The investigation began with one malicious extension and uncovered a broader network of extensions designed to evade detection while potentially compromising user data and browser security. Although no known exploits are currently active in the wild, the threat highlights the risks posed by malicious extensions that can operate stealthily within browsers. European organizations relying heavily on browser-based workflows and extensions could face confidentiality and integrity risks if targeted. The threat requires vigilance in extension management and enhanced monitoring to detect suspicious behaviors. Mitigation involves strict extension vetting, use of enterprise policies to control extension installation, and continuous user education. Countries with high adoption of affected browsers and significant digital infrastructure, such as Germany, France, and the UK, are more likely to be impacted. Given the stealthy nature and potential for data compromise without user interaction, the suggested severity is high. Defenders should prioritize detection and prevention strategies to mitigate this evolving threat landscape.
Researchers have discovered that a prompt can be disguised as an url, and accepted by Atlas as an url in the omnibox. The post OpenAI Atlas Omnibox Is Vulnerable to Jailbreaks appeared first on SecurityWeek .
