The University of Sydney experienced a significant data breach that exposed sensitive information of students and staff. The breach was publicly reported on December 18, 2025, and has been classified as a high-severity incident. Although specific technical details about the breach vector or exploited vulnerabilities are not disclosed, the incident involves unauthorized access to personal data, raising concerns about confidentiality and privacy. No known exploits are currently active in the wild related to this breach. European organizations, especially educational institutions and research partners, may face indirect risks such as targeted phishing or social engineering attacks leveraging leaked data. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and preparing incident response plans. Countries with strong academic ties to Australia or with significant student exchanges may be more impacted. Given the breach's impact on confidentiality and the lack of detailed exploitation complexity, the severity is assessed as high. Defenders should prioritize data access controls, user awareness, and collaboration with affected parties to mitigate secondary risks.
A China-aligned threat group has been observed leveraging Windows Group Policy to deploy espionage malware. This technique allows the attacker to distribute malicious payloads across multiple systems within a network efficiently. The malware is designed for espionage, targeting sensitive information and potentially compromising confidentiality and integrity. The attack does not currently have known exploits in the wild but is considered high severity due to the sophistication and potential impact. European organizations using Windows Active Directory environments are at risk, especially those in sectors with strategic importance or geopolitical interest to China. Mitigation requires strict Group Policy management, enhanced monitoring of policy changes, and network segmentation. Countries with significant Windows enterprise deployments and geopolitical relevance, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity given the potential for widespread impact, ease of exploitation within compromised networks, and the critical nature of the targeted data. Defenders should prioritize detection of unauthorized Group Policy modifications and implement robust endpoint security controls.
A new variant of the BeaverTail malware has been linked to the Lazarus Group, a well-known North Korean state-sponsored threat actor. This malware is reportedly high severity and represents an evolution in the group’s toolset. While no known exploits are currently active in the wild, the association with Lazarus indicates a potentially sophisticated and targeted threat. The malware's technical specifics are limited, but its emergence signals ongoing cyber espionage and possibly financially motivated attacks. European organizations, especially those in critical infrastructure and finance, could be targeted due to their strategic value. Mitigation requires enhanced monitoring for indicators of compromise, network segmentation, and threat intelligence sharing. Countries with significant financial sectors and technology industries, such as Germany, France, and the UK, are likely to be most affected. Given the high impact potential and ease of exploitation typical of Lazarus campaigns, the suggested severity is high. Defenders should prioritize detection and response capabilities tailored to advanced persistent threats linked to nation-state actors.
The Lazarus Group, a well-known state-sponsored threat actor, has embedded a new variant of their BeaverTail malware into developer tools. This campaign involves supply chain compromise tactics targeting software development environments, potentially enabling stealthy espionage and data exfiltration. Although no known exploits in the wild have been reported yet, the medium severity rating reflects the risk posed by this malware variant's capabilities and the strategic targeting of developer tools. European organizations relying on affected developer tools could face risks to intellectual property, source code integrity, and operational continuity. Mitigation requires rigorous supply chain security, including verifying tool integrity, monitoring for anomalous behavior in development environments, and applying strict access controls. Countries with significant software development industries and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the malware's stealth and potential impact on confidentiality and integrity without requiring user interaction, the suggested severity is high. Defenders should prioritize detection and prevention measures focused on developer toolchains to mitigate this emerging threat.
The Iranian APT group known as 'Prince of Persia' has reemerged with new cyber tools and expanded global targeting. This campaign, reported recently, indicates an evolution in their tactics and capabilities, posing a medium-level threat. While specific affected software versions or exploits are not detailed, the group’s historical focus on espionage and disruption suggests risks to confidentiality and operational integrity. European organizations, especially those in critical infrastructure, government, and strategic industries, may be targeted due to geopolitical tensions. Mitigation requires enhanced threat intelligence sharing, network segmentation, and proactive monitoring for unusual activity linked to APT behaviors. Countries with significant Iranian geopolitical interest and advanced digital infrastructure, such as Germany, France, the UK, and Italy, are more likely to be affected. Given the medium severity, the threat demands vigilance but does not currently indicate widespread exploitation or critical vulnerabilities. Defenders should prioritize detection and response capabilities tailored to APT tactics and maintain updated incident response plans.
A medium-severity phishing campaign targeting HubSpot customers has been detected by Evalian SOC and reported on Reddit's NetSec community. The campaign aims to deceive users into divulging sensitive information by impersonating HubSpot communications. Although no specific technical details or indicators of compromise have been publicly disclosed, the campaign's recent emergence and targeting of a widely used CRM platform pose risks to confidentiality and operational integrity. European organizations using HubSpot are at risk of credential theft, unauthorized access, and potential downstream attacks. Mitigation requires targeted user awareness, email filtering tuned for HubSpot-related phishing, and verification of communications purportedly from HubSpot. Countries with high HubSpot adoption and significant SME and enterprise use, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the ease of phishing exploitation and the broad user base, the threat severity is assessed as high. Defenders should prioritize detection and response capabilities focused on phishing attempts leveraging HubSpot branding.
Cybercriminals are spreading the Stealka infostealer disguised as game cheats, mods, and pirated software. It targets sensitive information, cryptocurrency, and account credentials
Multiple threat clusters, including state-aligned and financially-motivated actors, are utilizing phishing tools to trick users into granting access to Microsoft 365 accounts via OAuth device code authorization. This technique leads to account takeovers, data exfiltration, and further compromises. Threat actors are leveraging the OAuth 2.0 device authorization grant flow to gain unauthorized access by approving various applications. Campaigns often begin with an initial message containing a URL, which initiates an attack sequence using Microsoft's legitimate device authorization process. Tools like SquarePhish2 and Graphish are being used to facilitate these attacks. Both cybercriminal groups and state-aligned actors have adopted this technique, with Russia-aligned threat actors being particularly active.
Threat actors stole names, Social Security numbers, and financial and health information, and deployed ransomware on RBHA’s systems. The post 113,000 Impacted by Data Breach at Virginia Mental Health Authority appeared first on SecurityWeek .
France’s counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry The post France Probes ‘Foreign Interference’ After Remote Control Malware Found on Passenger Ferry appeared first on SecurityWeek .
This threat concerns vulnerabilities in Object-Relational Mapping (ORM) frameworks that cause data leakage beyond intended query joins. The issue arises when ORM queries inadvertently expose more data than requested, potentially leaking sensitive information. Although no specific affected versions or exploits in the wild are reported, the medium severity rating indicates a notable risk. European organizations using ORM-based data access layers in their applications could face confidentiality breaches if attackers exploit these leaks. Mitigation requires careful query design, strict access controls, and thorough code reviews to prevent unintended data exposure. Countries with significant software development sectors and high ORM adoption, such as Germany, the UK, and France, are more likely to be impacted. Given the nature of the vulnerability—data leakage without authentication or active exploitation—the suggested severity is medium. Defenders should prioritize understanding ORM query behaviors and implement monitoring to detect anomalous data access patterns.
The XCTDH Crypto Heist Part 4 is a medium-severity cyber threat linked to North Korean actors targeting software supply chains and development tools. It involves compromising software dependencies and development environments to facilitate unauthorized access or manipulation, leveraging application layer protocols for communication or data exfiltration. Although no specific affected product versions or patches are identified, the threat highlights risks associated with supply chain attacks. European organizations relying on affected software development tools or dependencies could face risks of intellectual property theft, operational disruption, or unauthorized access. Mitigation requires enhanced supply chain security practices, including rigorous code and dependency auditing, network segmentation, and monitoring for anomalous application layer traffic. Countries with significant software development sectors and historical exposure to North Korean cyber activities, such as the UK, Germany, and France, are more likely to be impacted. Given the medium severity, the threat poses a moderate risk that demands proactive defense but does not indicate immediate critical exploitation. Defenders should prioritize supply chain security and monitor for related attack patterns to reduce exposure.
Recent research by ActiveFence evaluated seven major large language models (LLMs) for vulnerabilities related to hate speech, disinformation, fraud, and child safety. The study found that 44% of LLM outputs were risky, with 68% of unsafe outputs related to hate speech, indicating significant weaknesses in content moderation and abuse prevention. Fraud-related outputs were comparatively better managed, but hate speech and child safety remain critical gaps. No tested model was fully safe, highlighting systemic risks in current LLM deployments. This threat is not a traditional software vulnerability but an exploitation of AI model behavior that can propagate harmful content. European organizations using or deploying LLMs should be aware of these risks, especially in sectors sensitive to hate speech and child protection. Mitigation requires tailored content filtering, continuous red-teaming, and collaboration with specialized threat intelligence providers. Countries with high AI adoption and strict regulatory environments around hate speech and child safety are most likely to be affected. Given the broad impact on confidentiality, integrity of information, and potential societal harm, and the ease of exploitation via user prompts, this threat is assessed as high severity.
A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.
A malware campaign discovered on the NuGet package repository targets the cryptocurrency ecosystem by distributing 14 malicious packages impersonating legitimate crypto-related tools. These packages employ techniques such as homoglyphs, version bumping, and inflated download counts to appear trustworthy and evade detection. The malware aims to steal crypto funds by redirecting transactions and exfiltrating secrets, including OAuth tokens for Google Ads accounts. The campaign highlights the risks of software supply chain attacks, especially for projects relying on compromised dependencies. No known exploits in the wild have been reported yet, but the threat poses a significant risk to developers and organizations integrating these packages. The attack affects . NET developers using NuGet packages related to cryptocurrency and OAuth services. The severity is assessed as medium due to the potential confidentiality and financial impact, combined with moderate exploitation complexity. European organizations involved in blockchain development, fintech, and digital advertising are particularly at risk. Mitigation requires strict dependency vetting, use of package integrity verification, and monitoring of OAuth token usage.
The Kimwolf botnet has compromised approximately 1.8 million Android TV devices globally, leveraging them to conduct large-scale distributed denial-of-service (DDoS) attacks. This botnet exploits vulnerabilities in Android TV platforms to gain control without requiring user interaction or authentication. The hijacked devices are then orchestrated to flood targeted networks with traffic, disrupting services and causing outages. European organizations relying on Android TV infrastructure or connected smart devices may face increased risk of service disruption and collateral damage from these attacks. The botnet's scale and use of consumer IoT devices make mitigation challenging, requiring coordinated efforts between device manufacturers, network operators, and end users. Countries with high adoption rates of Android TV and significant digital infrastructure are particularly vulnerable. Immediate mitigation involves network-level traffic filtering, device firmware updates, and enhanced monitoring for unusual traffic patterns. Given the ease of exploitation and broad impact, this threat is assessed as high severity for affected entities in Europe.
A Chinese-nexus advanced persistent threat actor, UAT-9686, is actively targeting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The campaign, ongoing since late November 2025, exploits non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor called AquaShell. Additional tools observed include AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing. The attackers can execute encoded commands in the system shell and create reverse connections to attacker-controlled servers. This sophisticated attack aligns with tactics used by other Chinese APT groups, raising concerns about potential widespread impact on email security infrastructure.
A recently reported security threat involves hackers potentially taking control of car dashboards by exploiting vulnerabilities in the vehicle's modem. This attack vector targets the modem component that connects the car to external networks, allowing remote access to critical vehicle systems such as the dashboard interface. Although no specific affected versions or exploits in the wild have been confirmed, the threat is rated as high severity due to the potential impact on vehicle safety and driver information integrity. European organizations involved in automotive manufacturing, fleet management, and connected car services could face significant risks. Mitigation requires a combination of secure modem firmware updates, network segmentation within vehicle systems, and rigorous security testing of telematics components. Countries with strong automotive industries and high adoption of connected vehicles, such as Germany, France, and Italy, are most likely to be affected. Given the ease of remote exploitation and the critical nature of vehicle control systems, this threat is assessed as high severity. Defenders should prioritize monitoring telematics security, applying vendor patches promptly, and implementing intrusion detection for vehicle networks.
Fourteen malicious NuGet packages have been identified that steal cryptocurrency wallet information and advertising data from developers who incorporate them into their projects. These packages, distributed via the NuGet repository, pose a risk by embedding malicious code that exfiltrates sensitive data during software build or runtime. Although no known exploits in the wild have been reported yet, the presence of such packages in a widely used package manager highlights a significant supply chain risk. European organizations using . NET technologies and NuGet packages in their development pipelines are at risk of data theft and potential financial loss. Mitigation requires proactive package vetting, use of trusted sources, and enhanced monitoring of development dependencies. Countries with strong software development sectors and high adoption of Microsoft technologies, such as Germany, the UK, and France, are particularly vulnerable. Given the medium severity, the threat impacts confidentiality primarily, with moderate ease of exploitation due to the public availability of these packages. Defenders should prioritize dependency audits and implement automated scanning tools to detect malicious packages early.
I have already talked about various React2Shell exploit attempts we have observed in the last weeks. But new varieties of the exploit are popping up, and the most recent one is using this particular version of the exploit:
