Threats affecting Sweden

Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.

Malware#pythonGermany+8

SOAPwn is a security research finding that demonstrates exploitation techniques targeting . NET Framework applications using HTTP client proxies and WSDL (Web Services Description Language). The research reveals how attackers can leverage misconfigurations or vulnerabilities in HTTP proxy handling and WSDL processing to compromise . NET applications. Although no known exploits are currently observed in the wild, the threat highlights a medium-severity risk due to potential unauthorized access or code execution. European organizations using . NET Framework applications that consume SOAP services via HTTP proxies should be aware of this threat. Mitigations include careful configuration of HTTP clients, validation of WSDL inputs, and restricting proxy usage. Countries with significant . NET enterprise deployments and critical infrastructure relying on SOAP-based services are more likely to be impacted.

Tool#netsec#redditGermany+7

A new campaign involving the ClickFix malware is spreading a macOS infostealer by abusing the ChatGPT chat-sharing feature to post malicious user guides on the official ChatGPT website. This technique leverages social engineering by embedding harmful content within seemingly legitimate shared chats, potentially tricking users into downloading and executing the infostealer. Although no known exploits in the wild have been reported yet, the threat is considered high severity due to the sensitive data targeted and the innovative attack vector. European organizations using macOS devices are at risk, especially those with employees who frequently use ChatGPT and may be exposed to these malicious shared chats. The attack impacts confidentiality by stealing sensitive information and could lead to broader compromise if credentials or tokens are exfiltrated. Mitigation requires monitoring and restricting the use of chat-sharing features, educating users about the risks of downloading files from untrusted shared chats, and deploying endpoint detection solutions tailored for macOS. Countries with high macOS adoption and significant tech sector presence, such as Germany, the UK, France, and the Nordics, are more likely to be affected. Given the ease of exploitation via social engineering and the potential for significant data theft, the suggested severity is high.

News#netsec#redditGermany+7

North Korean threat actors have been observed deploying EtherRAT malware through exploits targeting the React2Shell vulnerability. EtherRAT is a remote access trojan capable of data exfiltration and system control. The React2Shell vulnerability allows attackers to execute arbitrary code on affected systems, facilitating malware deployment without user interaction. Although no confirmed exploits in the wild have been reported yet, the combination of a known exploit vector and a sophisticated RAT indicates a credible medium-level threat. European organizations using vulnerable software stacks could face risks to confidentiality and integrity if targeted. Mitigation requires proactive patching of React2Shell vulnerabilities and enhanced network monitoring for unusual RAT activity. Countries with high adoption of affected technologies and strategic importance in geopolitical contexts are more likely to be targeted. Given the ease of exploitation and potential impact, the threat severity is assessed as medium. Defenders should prioritize vulnerability management and incident detection to reduce exposure.

Malware#infosecnews#redditGermany+7

Three newly discovered encryption weaknesses affect PCIe 5.0 and later systems, potentially causing faulty data handling during data transmission over PCIe links. These vulnerabilities could lead to data corruption, leakage, or unauthorized data manipulation within high-speed interconnects critical for modern computing platforms. Although no known exploits are currently in the wild, the high-speed and widespread adoption of PCIe 5.0+ in servers, workstations, and data centers make this a significant concern. European organizations relying on advanced computing infrastructure may face risks to data integrity and confidentiality. Mitigation requires close collaboration with hardware vendors for firmware and hardware updates, as well as monitoring for vendor advisories. Countries with strong technology sectors and data center presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the potential impact on confidentiality, integrity, and availability, combined with the complexity of exploitation and lack of authentication requirements, this threat is assessed as high severity. Defenders should prioritize patching and validating PCIe implementations and consider additional encryption or integrity verification layers where possible.

News#infosecnews#redditGermany+5

The FBI has issued a warning about scams involving fake videos used to deceive victims, typically as part of phishing campaigns. These scams leverage manipulated or fabricated video content to trick users into divulging sensitive information or performing actions that compromise security. While no specific software vulnerabilities are exploited, the threat relies on social engineering and the increasing sophistication of video forgery techniques. The threat is classified as medium severity due to its potential to impact confidentiality and integrity through deception, though it does not directly affect system availability. European organizations are at risk, especially those with high exposure to phishing attacks and those in sectors targeted by fraudsters. Mitigation requires enhanced user awareness training focused on recognizing fake video content, deployment of advanced email and web filtering solutions, and verification protocols for video-based communications. Countries with large digital economies and high internet penetration, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant data compromise, the suggested severity is medium. Defenders should prioritize user education and implement multi-factor verification for sensitive transactions involving video communications.

Phishing#infosecnews#redditGermany+6

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

MalwareGermanyFrance+8

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added newly discovered vulnerabilities affecting Microsoft Windows and WinRAR to its Known Exploited Vulnerabilities catalog. These flaws have been identified as actively exploited or highly likely to be exploited, prompting increased attention from security professionals. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates a significant risk to systems running these widely used software products. The vulnerabilities are currently rated as medium severity, with no confirmed exploits in the wild reported yet. European organizations using Microsoft Windows and WinRAR should be vigilant, as these products are ubiquitous across enterprises and consumers. The threat could impact confidentiality, integrity, and availability if exploited, especially in environments where these applications are critical. Mitigation requires timely patching once updates are available, enhanced monitoring for suspicious activity, and restricting WinRAR usage or applying configuration hardening. Countries with high adoption of Microsoft Windows and WinRAR, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

News#infosecnews#redditGermany+7

A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy AMOS, a multi-stage malware that harvests credentials, escalates privileges, and establishes persistence. The attack bypasses traditional security measures by leveraging legitimate platforms and user behavior, making it particularly insidious. AMOS targets cryptocurrency wallets, browser data, and system information, exfiltrating sensitive data to attacker-controlled servers. This campaign represents a significant evolution in social engineering techniques, exploiting the growing reliance on AI assistants for technical guidance.

Malware#chatgpt#persistenceGermany+9

The DeadLock ransomware campaign employs a new Bring Your Own Vulnerable Driver (BYOVD) loader exploiting CVE-2024-51324, a vulnerability in Baidu Antivirus driver, to evade endpoint detection and response (EDR) tools. Attackers use PowerShell scripts to bypass User Account Control (UAC), disable Windows Defender, terminate security services, and delete volume shadow copies, facilitating ransomware deployment. DeadLock ransomware targets Windows systems with a custom stream cipher encryption using time-based cryptographic keys, employing advanced techniques such as recursive directory traversal, memory-mapped file I/O, and multi-threaded processing. Initial access is gained through compromised accounts, followed by system registry modifications, remote access establishment, reconnaissance, lateral movement, and defense impairment. Although no known exploits are currently in the wild, the sophisticated use of BYOVD and defense evasion techniques poses a significant threat to organizations. The attack complexity and multi-stage process highlight the need for targeted mitigation strategies. This threat is particularly relevant to European organizations using Baidu Antivirus or similar vulnerable drivers and those with Windows-based infrastructure. The suggested severity is high due to the potential for widespread impact, ease of defense evasion, and the ransomware’s destructive capabilities.

EPSS 0.5%Malware#deadlock#edr evasionGermany+9

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.

Campaign#domain spoofing#fileless executionGermany+9

This offering provides free honey tokens such as AWS access keys, SSH private keys, and S3 bucket tokens designed to detect unauthorized access and breaches by alerting defenders when these tokens are used. The tokens are intended to be planted in locations where attackers might find them, such as hardcoded credentials in code repositories or backup folders. When an adversary uses these tokens, the platform sends alerts with detailed metadata including source IP, geolocation, and VPN/proxy detection. This approach leverages deception technology to identify attackers early in their reconnaissance or exploitation phases. While the service is free with limited tokens, it uses the same detection pipeline as the paid version, aiming to provide effective breach detection without signup friction. The threat is not a direct vulnerability or malware but a detection mechanism to expose attacker activity. European organizations can benefit from deploying such tokens to detect lateral movement or credential theft, especially in cloud environments. Countries with high cloud adoption and significant AWS usage are most likely to benefit. The severity is assessed as high due to the potential to detect critical breaches early, though it requires proactive deployment and monitoring by defenders.

Malware#netsec#redditGermany+7

Britain and its allies face escalating “hybrid threats … designed to weaken critical national infrastructure, undermine our interests and interfere in our democracies.” The post UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare appeared first on SecurityWeek .

NewsGermanyFrance+8

The Spiderman Phishing Kit is a newly identified phishing toolkit targeting European banks, designed to steal user credentials in real-time. It enables attackers to capture login details as victims interact with fake banking websites. The kit is reported via Reddit and linked from a cybersecurity news source, indicating emerging threat activity but with minimal current discussion or exploitation evidence. This phishing campaign focuses on European financial institutions, potentially impacting customer data confidentiality and banking operations. The attack requires user interaction, typically through deceptive emails or messages leading to fraudulent sites. No known exploits or patches exist yet, and the threat is assessed as medium severity due to its targeted nature and real-time credential theft capability. European organizations, especially banks and their customers, should be vigilant and implement specific anti-phishing controls. Countries with significant banking sectors and high internet banking adoption are more likely to be targeted. Immediate mitigation includes enhanced email filtering, user awareness training, and multi-factor authentication enforcement. Given the lack of CVSS score, the threat is assessed as medium severity considering the impact on confidentiality and the need for user interaction for exploitation.

Phishing#infosecnews#redditGermany+7

Fortinet has disclosed critical authentication bypass vulnerabilities affecting FortiCloud's Single Sign-On (SSO) login mechanism. These flaws allow attackers to circumvent authentication controls, potentially gaining unauthorized access to FortiCloud management interfaces without valid credentials. Although no known exploits are currently observed in the wild, the critical severity rating underscores the urgency for organizations to address these issues promptly. The vulnerabilities impact the confidentiality and integrity of cloud-managed Fortinet devices and services, posing significant risks to network security. European organizations relying on FortiCloud for centralized device management and SSO are particularly at risk. Mitigation requires immediate application of vendor patches once available, strict monitoring of FortiCloud access logs, and implementing compensating controls such as multi-factor authentication and network segmentation. Countries with high Fortinet market penetration and critical infrastructure deployments, including Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected. Given the ease of exploitation without authentication and the broad impact on cloud-managed security infrastructure, the suggested severity is critical. Defenders must prioritize patch management and enhance monitoring to prevent potential unauthorized access and lateral movement within networks.

News#infosecnews#redditGermany+7

Ransomware IAB is a newly reported malware strain that abuses Endpoint Detection and Response (EDR) solutions to execute its payload stealthily, evading traditional detection mechanisms. By leveraging the trust and elevated privileges of EDR software, the ransomware can bypass security controls and maintain persistence on infected systems. Although no known exploits are currently observed in the wild, the technique represents a sophisticated escalation in ransomware tactics. European organizations relying heavily on EDR solutions for endpoint security may face increased risk due to this stealthy execution method. The threat is assessed as high severity given its potential to compromise confidentiality, integrity, and availability without requiring user interaction. Mitigation requires advanced monitoring of EDR behavior, strict application control policies, and rapid incident response capabilities. Countries with high adoption of EDR technologies and critical infrastructure sectors are most likely to be targeted. Immediate attention to this emerging threat is recommended to prevent impactful ransomware incidents in Europe.

Malware#infosecnews#redditGermany+7

The GeminiJack 0-Click flaw in Gemini AI is a recently disclosed vulnerability that allows data leaks without any user interaction. This zero-click nature means attackers can exploit the flaw remotely and silently, potentially accessing sensitive user data. Although no known exploits are currently observed in the wild, the medium severity rating suggests moderate risk. The vulnerability affects Gemini AI, a product whose market penetration and deployment details remain unclear. European organizations using Gemini AI or related services could face confidentiality breaches if targeted. Mitigation is complicated by the absence of patches or detailed technical disclosures, requiring heightened monitoring and cautious data handling. Countries with advanced AI adoption and critical infrastructure relying on Gemini AI are more likely to be impacted. Given the zero-click exploit vector and data exposure potential, the threat is assessed as medium severity. Defenders should prioritize detection capabilities and restrict unnecessary data exposure until official patches are available.

Breach#infosecnews#redditGermany+7

STAC6565 is a threat actor group deploying the QWCrypt ransomware, with a strong focus on Canadian targets, accounting for 80% of observed attacks. The ransomware campaign, attributed to the Gold Blade group, represents a high-severity threat due to its potential to disrupt operations and cause data loss. While currently primarily targeting Canada, the ransomware's capabilities and tactics could pose risks to European organizations, especially those with cross-border ties or similar infrastructure. No known exploits or patches are available yet, and minimal public technical details limit immediate defensive measures. European entities should be vigilant, particularly in sectors with Canadian connections or similar vulnerabilities. Proactive monitoring for ransomware indicators and strengthening incident response plans are critical. Countries with strong trade or digital ties to Canada, or with significant ransomware incident histories, are at higher risk. Given the ransomware's impact potential and ease of deployment by threat actors, the suggested severity is high. Defenders should prioritize threat intelligence sharing and implement advanced endpoint detection and response solutions to mitigate risks.

Malware#infosecnews#redditGermany+6

The SimpleX Chat official X (formerly Twitter) account was compromised, leading to the promotion of a fake website designed to scam users by impersonating a crypto wallet service. This phishing campaign aims to deceive users into submitting sensitive information or cryptocurrency to attackers. Although no direct exploits or vulnerabilities in SimpleX Chat software are reported, the account hijacking facilitates social engineering attacks. European organizations and users involved in cryptocurrency or blockchain communities are at risk of financial loss and reputational damage. Mitigation requires vigilance against phishing, verification of official communication channels, and enhanced account security measures. Countries with significant crypto adoption and active social media usage are more likely to be targeted. Given the medium severity, the threat impacts confidentiality and financial integrity primarily, with moderate ease of exploitation due to account compromise. Defenders should prioritize monitoring social media accounts, educating users on phishing risks, and implementing multi-factor authentication (MFA) for social media management.

Phishing#infosecnews#redditGermany+5

The US seeks information on the leader of Emennet Pasargad, Mohammad Bagher Shirinkar, and long-time employee Fatemeh Sedighian Kashi. The post US Posts $10 Million Bounty for Iranian Hackers appeared first on SecurityWeek .

NewsGermanyFrance+6