Threats affecting Sweden

Participants earned rewards at the hacking competition for Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL vulnerabilities. The post $320,000 Paid Out at Zeroday.Cloud for Open Source Software Exploits appeared first on SecurityWeek .

News#linux#rceGermany+8

In the Microsoft Windows ecosystem, DLLs (Dynamic Load Libraries) are PE files like regular programs. One of the main differences is that they export functions that can be called by programs that load them. By example, to call RegOpenKeyExA(), the program must first load the ADVAPI32.dll. A PE files has a lot of headers (metadata) that contain useful information used by the loader to prepare the execution in memory. One of them is the EntryPoint, it contains the (relative virtual) address where the program will start to execute.

News#windowsGermany+9

In 2022, LastPass experienced a significant data breach impacting approximately 1.6 million users, leading to a regulatory fine by UK authorities. The breach exposed sensitive user data, raising concerns about confidentiality and user trust. Although no known exploits are currently active in the wild, the incident highlights vulnerabilities in password management services. European organizations relying on LastPass for credential management face potential risks of credential theft and subsequent unauthorized access. The breach underscores the importance of robust security controls around password vaults and multi-factor authentication. UK regulators' enforcement actions signal increased scrutiny on data protection compliance. Organizations should review their use of password managers, enforce strict access controls, and monitor for suspicious activities. The breach severity is assessed as high due to the sensitivity of compromised data and potential for widespread impact. Countries with high LastPass adoption and stringent data protection laws are most likely to be affected.

Breach#infosecnews#redditGermany+6

A high-severity vulnerability in Notepad++ allowed attackers to push malicious update files to users, potentially compromising their systems. The flaw enabled unauthorized code execution via the update mechanism, posing risks to confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the issue was serious enough to warrant an urgent fix by the Notepad++ development team. European organizations using Notepad++ for development or administrative tasks could be targeted if attackers leverage this flaw. Mitigation involves promptly applying the fixed update and verifying update sources. Countries with high software development activity and widespread Notepad++ usage, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity due to the potential for remote code execution without user interaction and broad impact scope. Defenders should prioritize patching and monitoring update channels for anomalies to prevent exploitation.

News#infosecnews#redditGermany+7

Malicious Visual Studio Code (VS Code) extensions have been discovered that conceal Trojan malware within fake PNG files. These extensions, once installed by developers, can execute hidden malicious payloads, potentially compromising the host system. The malware uses steganography-like techniques to evade detection by embedding code inside seemingly benign image files. Although no known exploits in the wild have been reported yet, the threat poses a medium severity risk due to the potential for unauthorized access and code execution. European organizations relying heavily on VS Code for software development are at risk, especially those in countries with large developer communities. Attackers could leverage this vector to infiltrate corporate networks, steal sensitive data, or disrupt operations. Mitigation requires strict extension vetting, use of trusted sources, and enhanced endpoint monitoring. Countries like Germany, France, the UK, and the Netherlands are more likely to be affected due to their significant software development sectors and high VS Code adoption. Given the stealthy nature of the Trojan and the ease of extension installation, this threat is assessed as medium severity. Defenders should prioritize awareness and proactive controls to prevent compromise.

Malware#infosecnews#redditGermany+5

This report highlights challenges encountered when using pay-per-use AI security agents in blue-team operations. Deep reasoning tasks cause non-linear token consumption spikes, making metered billing models costly and disruptive during incident response. The analysis suggests unlimited usage AI models are better suited for continuous defensive workflows. Although not a direct vulnerability or exploit, this issue impacts operational efficiency and cost management in cybersecurity teams relying on AI. There are no known exploits or affected software versions. The threat is medium severity due to its impact on availability and workflow continuity. European organizations using AI-driven security tools with pay-per-use billing may face operational and financial challenges. Countries with advanced cybersecurity operations and AI adoption, such as Germany, France, and the UK, are most likely affected. Practical mitigation includes adopting unlimited usage AI plans, optimizing AI query design to reduce token consumption, and integrating AI tools with cost monitoring. This is not a traditional security vulnerability but a significant operational threat to AI-enabled security workflows.

Breach#netsec#redditGermany+5

The hack of 120 000 IP cameras across South Korea led to the production and sale of sexually explicit footage. We break down how IP cameras work — and how to secure them.

BreachGermanyFrance+9

DroidLock is a newly identified Android malware that locks users out of their devices while covertly spying on them using the front camera. It represents a dual-threat by combining ransomware-like device lockdown with privacy invasion through unauthorized camera access. Although no known exploits are currently active in the wild, the malware's capabilities pose significant risks to user confidentiality and device availability. The malware's infection vector and affected Android versions remain unspecified, complicating detection and mitigation efforts. European organizations with Android-dependent mobile workforces could face operational disruptions and privacy breaches if targeted. Mitigation requires enhanced mobile security hygiene, including restricting app permissions, deploying mobile threat defense solutions, and educating users about suspicious apps. Countries with high Android adoption and significant mobile workforce reliance, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the malware’s ability to lock devices and spy without user consent, and the lack of authentication or user interaction barriers, the threat severity is assessed as high. Defenders should prioritize monitoring for unusual device lock behavior and unauthorized camera usage to detect potential infections early.

Malware#infosecnews#redditGermany+7

NANOREMOTE is a newly identified malware targeting Windows systems that leverages the Google Drive API to maintain covert command and control (C2) communications. By abusing a legitimate cloud storage service, the malware evades traditional network detection mechanisms, making it difficult for defenders to identify malicious activity. This technique allows attackers to issue commands and exfiltrate data stealthily, bypassing many security controls. The malware's use of Google Drive API indicates a sophisticated approach to persistence and stealth. Although no known exploits are currently active in the wild, the high severity rating reflects the potential risk posed by this malware if deployed widely. European organizations, especially those with significant Windows infrastructure and reliance on cloud services, could face confidentiality and integrity risks. Mitigation requires enhanced monitoring of cloud API usage, strict application whitelisting, and network traffic analysis focused on unusual cloud service interactions. Countries with high adoption of Google Workspace and critical infrastructure sectors are more likely to be targeted. Given the stealthy nature and potential impact, the suggested severity is high. Defenders should prioritize detection capabilities for anomalous Google Drive API usage and implement strict endpoint security controls.

Malware#infosecnews#redditGermany+6

Eleven companies took part in the evaluations and several have boasted 100% detection and coverage rates. The post MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations appeared first on SecurityWeek .

NewsGermanyFrance+6

In April 2025, hackers stole personal information belonging to patrons and employees and their family members. The post Pierce County Library Data Breach Impacts 340,000 appeared first on SecurityWeek .

Breach#rceGermany+6

Security firms have seen cryptocurrency miners, Linux backdoors, botnet malware, and various post-exploitation implants in React2Shell attacks. The post Wide Range of Malware Delivered in React2Shell Attacks appeared first on SecurityWeek .

Malware#linuxGermany+6

GOLD SALEM is a financially motivated cybercrime group deploying Warlock ransomware through sophisticated tradecraft, including exploiting SharePoint vulnerabilities for initial access. Over six months and 11 incidents, they targeted IT, industrial, and technology sectors using ransomware variants such as Warlock, LockBit, and Babuk. Their operations involve advanced techniques like zero-day exploitation and repurposing legitimate tools (Velociraptor, VMTools AV killer, Cloudflared) to evade detection and maintain persistence. Executables are often named after victim organizations, indicating targeted attacks. While evidence suggests possible Chinese origins, the group primarily pursues financial gain. The threat poses a medium severity risk but demonstrates capabilities that could escalate impact if defenses are weak. European organizations in critical infrastructure and technology sectors should be vigilant against these tactics.

Malware#lockbit#cybercrimeGermany+9

A malicious campaign has compromised 19 Visual Studio Code extensions by embedding malware within dependency folders, specifically by modifying the legitimate npm package 'path-is-absolute'. Active since February 2025, the attackers disguise malicious binaries as PNG images within archives to evade detection. When VS Code starts, a JavaScript dropper decodes and executes two malicious binaries using living-off-the-land binaries, enabling stealthy execution. This attack leverages trusted components from the VS Code Marketplace, complicating detection and mitigation. Although no known exploits in the wild have been reported, the campaign demonstrates advanced evasion techniques and targets a widely used development environment. The malware involves a Rust-based trojan and employs multiple tactics such as code obfuscation, masquerading files, and abuse of legitimate binaries. European organizations using VS Code with affected extensions are at risk of compromise, data theft, or further lateral movement. Mitigation requires careful vetting of extensions, monitoring for suspicious activity, and restricting execution of untrusted binaries. Countries with strong software development sectors and high VS Code adoption are most likely to be impacted. Given the stealth, potential for privilege escalation, and broad impact, the threat severity is assessed as high.

Malware#rust trojan#vs codeGermany+9

CastleLoader malware has evolved to incorporate a Python-based loader to evade traditional security defenses. This technique leverages Python scripts to execute malicious payloads, complicating detection by conventional antivirus and endpoint protection solutions. While no known exploits are currently active in the wild, the adaptation indicates a shift towards more sophisticated evasion tactics. European organizations using environments where Python is prevalent or where endpoint security relies heavily on signature-based detection may face increased risk. The malware's medium severity reflects moderate impact potential and exploitation complexity. Defenders should focus on enhancing detection capabilities for script-based loaders, monitoring unusual Python execution, and applying behavioral analytics. Countries with high technology adoption and significant financial or industrial sectors are more likely targets. Proactive threat hunting and endpoint hardening are critical to mitigating this emerging threat vector.

Malware#infosecnews#redditGermany+7

Several months ago, I got a Nucbox K8 Plus minicomputer to use as a Proxmox 9 server. At the time of this acquisition, I didn&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;t realize this minicomputer had an artificial intelligence (AI) engine [1] build in the CPU that could be used to run AI applications locally. A coworker recommended that I try Google Gemma 3 as a local AI open model to work with my use cases.

News#localGermany+6

DroidLock is a newly identified Android malware that locks infected devices and demands a ransom to restore access. It operates by taking control of the device's lock screen, effectively denying user access until payment is made. Although no specific affected Android versions are listed, the malware targets mobile users broadly. There are currently no known exploits in the wild beyond initial reports, and technical details remain limited. The malware represents a high-severity threat due to its potential to disrupt device availability and extort users. European organizations with employees using Android devices for business risk operational disruption and data access issues. Mitigation requires proactive mobile device management, user education on avoiding suspicious apps, and rapid incident response capabilities. Countries with high Android adoption and significant mobile workforce presence, such as Germany, France, the UK, Italy, and Spain, are most likely to be impacted. Given the ransomware nature, ease of exploitation via social engineering or malicious apps, and significant impact on availability and confidentiality, the threat severity is assessed as high. Defenders should prioritize detection of suspicious lock screen behavior and ensure robust backup and recovery procedures for mobile endpoints.

Malware#infosecnews#redditGermany+7

Over 10,000 Docker Hub container images have been discovered to contain embedded credentials and authentication keys, posing a significant security risk. These leaked secrets can enable attackers to gain unauthorized access to cloud services, internal systems, or other sensitive resources. The exposure stems from developers inadvertently including sensitive information within container images pushed to public repositories. European organizations using Docker containers from public registries are at risk of compromise if they deploy or use these vulnerable images. The threat is particularly relevant to industries with heavy container adoption and cloud reliance. Mitigation requires scanning container images for secrets before deployment, enforcing strict secret management policies, and using private registries with access controls. Countries with large cloud and container ecosystems, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation and potential for significant confidentiality and integrity breaches, this threat is assessed as high severity. Defenders must prioritize secret scanning and credential rotation to reduce exposure.

News#infosecnews#redditGermany+5

This threat involves three advanced browser hijacking techniques targeting Firefox and Chrome browsers. The first technique modifies browser preference files directly to alter settings such as default search engines and homepage configurations. The second, known as BRAT (Browser Remote Access Tool), remotely simulates key presses to manipulate browser behavior, including opening unwanted tabs and changing search engines. The third exploits a Chromium command line switch to load malicious extensions while disabling browser updates to maintain persistence. These methods enable attackers to control browser behavior stealthily, potentially leading to user tracking, ad fraud, or further malware deployment. Although no known exploits are currently active in the wild, the techniques demonstrate evolving sophistication in browser hijacking. The threat is rated medium severity due to its potential impact on user privacy and browser integrity, combined with moderate exploitation complexity. European organizations relying heavily on Chrome and Firefox browsers should be vigilant, as these browsers are widely used across the continent. Detection and mitigation require enhanced monitoring of browser configuration files, command line parameters, and unusual input simulation activities. Proactive measures are essential to prevent persistent hijacking and maintain browser security integrity.

Malware#registry manipulation#adwareGermany+9

A sophisticated adversary-in-the-middle phishing campaign targets Microsoft 365 and Okta users by exploiting single sign-on (SSO) flows. Attackers use lookalike domains and malicious JavaScript injections to steal credentials and session tokens, bypassing multi-factor authentication. Initial access is gained through phishing emails themed around compensation and benefits, sent via compromised mailboxes and Amazon SES. The phishing infrastructure is hosted on Cloudflare, enhancing resilience and evasion. This campaign specifically targets organizations relying on Okta as an identity provider for Microsoft 365, enabling session hijacking and credential theft. The threat poses a medium severity risk due to its complexity and potential impact on confidentiality and integrity. European organizations using these platforms are at risk, especially in countries with high adoption of Microsoft 365 and Okta. Mitigation requires targeted user training, domain monitoring, and enhanced detection of anomalous authentication flows. No CVSS score is available; however, the threat is assessed as high severity given the bypass of MFA and session hijacking capabilities.

Campaign#phishing#adversary-in-the-middleGermany+6