Criminals are using AI to clone professional websites at an industrial scale. A new report shows how one AI-powered network grew to 150+ domains by hiding behind Cloudflare and rotating IP ranges. The post Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign appeared first on SecurityWeek .
SystemBC is a malware strain that has recently infected over 10,000 devices despite previous law enforcement efforts to dismantle its infrastructure. It is primarily known for deploying ransomware and other malicious payloads, as well as using compromised machines to proxy traffic, which can facilitate further attacks or anonymize threat actor activities. The malware's persistence and ability to evade takedown attempts highlight its resilience and ongoing threat. Although no specific affected software versions or exploits are detailed, the infection scale and functionality suggest a significant risk to organizations. The threat is rated medium severity due to its impact on confidentiality and availability, moderate ease of exploitation, and broad infection scope. European organizations, especially those with extensive networked environments, could face operational disruptions and data breaches. Mitigation requires focused network monitoring, blocking known proxy traffic patterns, and rapid incident response to infected hosts. Countries with high technology adoption and critical infrastructure are more likely targets. Defenders should prioritize detection of SystemBC-related traffic and strengthen endpoint protections to prevent initial infection and lateral movement.
The Cyberspy Group is an advanced persistent threat (APT) actor that has conducted cyber espionage operations targeting governments and critical infrastructure across 37 countries. Although Palo Alto Networks has not officially attributed this group, evidence suggests a likely connection to China. The campaign involves sophisticated intrusion techniques aimed at compromising sensitive governmental and infrastructure systems, potentially leading to significant confidentiality and operational impacts. No specific affected software versions or vulnerabilities have been disclosed, and no known exploits are currently reported in the wild. The threat is assessed as critical due to the broad scope, high-value targets, and potential for severe disruption. European organizations, especially those involved in government and critical infrastructure sectors, face heightened risk. Mitigation requires enhanced network monitoring, threat intelligence sharing, and rigorous access controls tailored to detect and prevent APT intrusions. Countries with significant government and critical infrastructure digital footprints, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected given their strategic importance and historical targeting patterns. The threat's complexity and stealthy nature necessitate proactive defense measures beyond standard patching and antivirus solutions.
For a few days, many phishing emails that landed into my mailbox contain strange URLs. They are classic emails asking you to open a document, verify your pending emails, …
A malicious email attachment containing a . bat script is delivering a multi-stage malware payload designed to steal data via a Chrome injector. The initial script is a fork of publicly available GitHub code but includes obfuscated Base64-encoded payloads executed through PowerShell. The payload fetches additional components from a compromised website, including a . NET program that establishes persistence via scheduled tasks and communicates with a Telegram-based command and control (C2) server. This malware, identified as XWorm V7.x, uses sophisticated obfuscation and evasion techniques to avoid detection. It targets Windows systems and aims to steal sensitive information silently. The attack does not require user interaction beyond opening the malicious attachment and does not currently have known widespread exploitation but poses a medium risk. European organizations using Windows and Chrome browsers are potential targets, especially those with less mature email security controls.
The KRVTZ-NET IDS alerts from February 5, 2026, report reconnaissance activities targeting Fortigate VPN devices and web applications vulnerable to JavaScript prototype pollution. The reconnaissance includes scanning and probing from multiple IP addresses, with repeated attempts to exploit CVE-2023-27997, which allows unauthenticated attackers to bypass authentication on Fortigate VPNs. No active exploitation or lateral movement has been observed. The overall severity of this reconnaissance phase is low, but it indicates ongoing threat actor interest. Organizations, particularly in Europe, using Fortigate VPNs or vulnerable web applications should prioritize patching and hardening to mitigate future risks.
In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), bypasses Windows Driver Signature Enforcement. The attack was halted before ransomware deployment, but it highlights the growing trend of weaponizing signed, legitimate drivers to disable endpoint security. The intrusion involved aggressive network reconnaissance, deployment of a sophisticated EDR killer with an encoded kernel driver payload, and attempts to establish persistence. The case underscores the importance of multi-factor authentication, VPN log monitoring, and implementing Microsoft's recommended driver block rules.
Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.
A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, directing users to malicious content. The TDS incorporates a clever DNS trick to evade detection by security groups. The system, operational since mid-2022, appears to be run by a financially motivated actor in affiliate marketing. It has the potential to interfere with devices on the network, alter DNS records, and conduct adversary-in-the-middle operations. The threat actor's ability to control DNS resolution poses significant risks beyond delivering unwanted advertising.
Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week. The post Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks appeared first on SecurityWeek .
CVE-2026-20981 is a medium severity vulnerability in Samsung Mobile devices caused by improper input validation in the FacAtFunction component prior to the SMR February 2026 Release 1. This flaw allows a privileged physical attacker to execute arbitrary commands with system-level privileges. Exploitation requires physical access and privileged status, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could be at risk, especially in countries with high Samsung market penetration and critical infrastructure relying on these devices. Mitigation involves restricting physical access, monitoring for unusual system commands, and promptly applying Samsung's security updates once released. Countries like Germany, the UK, France, Italy, and Spain are most likely affected due to their large Samsung user bases and strategic importance. The vulnerability's medium severity reflects the balance between high impact and the requirement for physical privileged access.
CVE-2026-1632 is a critical vulnerability in RISS SRL's MOMA Seismic Station (version 2.4.2520 and earlier) where the web management interface lacks authentication. This allows unauthenticated attackers to access the device's configuration, extract sensitive data, or remotely reset the device. The vulnerability has a CVSS score of 9.1, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality and integrity. Although no known exploits are currently reported in the wild, the exposure of critical infrastructure devices like seismic stations poses significant risks. European organizations operating these devices could face operational disruptions and data compromise. Mitigations include network segmentation, restricting access to the management interface, deploying compensating controls such as VPNs or firewalls, and monitoring for unauthorized access. Countries with active seismic monitoring infrastructure and critical geological research facilities, such as Italy, Germany, France, and Spain, are most likely to be affected.
Last week, a new AI agent framework was introduced to automate "live". It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in its design.
The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, El Salvador, Australia, and the Philippines. The infection methods evolved over time, using NSIS installers, Metasploit downloaders, and Cobalt Strike Beacons. The attackers employed clever techniques to evade detection, including the abuse of legitimate software and the use of multiple C2 servers. The article provides a comprehensive timeline of the attack, describes the different execution chains, and offers guidance on detecting traces of the attack.
CVE-2026-23997 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting FacturaScripts versions 2025.71 and earlier. The flaw exists in the Observations field within the History view, where user input is rendered without proper HTML entity encoding, allowing attackers to inject and execute arbitrary JavaScript in the browsers of administrators viewing the history. Exploitation requires at least limited privileges to input data and some user interaction to trigger the payload. The vulnerability impacts confidentiality, integrity, and availability by enabling session hijacking, credential theft, or administrative account compromise. No known exploits are currently reported in the wild. European organizations using FacturaScripts for ERP and accounting functions are at risk, especially those with administrators accessing the affected History view. Mitigation requires applying patches once available, implementing strict input validation and output encoding, and restricting access to the History view to trusted users. Countries with significant SME adoption of FacturaScripts, such as Spain, Germany, France, Italy, and the UK, are most likely affected due to market penetration and the strategic importance of ERP systems. Given the CVSS 3.
A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox login page. The attackers exploit trusted platforms and harmless file formats to bypass security measures. The campaign uses social engineering tactics to harvest credentials, which are then exfiltrated to attacker-controlled infrastructure via Telegram. This method proves effective by leveraging legitimate business processes, trusted file types, and reputable cloud services to appear authentic and bypass automated security checks.
Hackers rely on evolved vishing and login harvesting to compromise SSO credentials for unauthorized MFA enrollment. The post ShinyHunters-Branded Extortion Activity Expands, Escalates appeared first on SecurityWeek .
