The PlushDaemon threat group has been reported to hijack software updates as part of supply-chain attacks, compromising the integrity of software distribution mechanisms. This attack vector allows adversaries to inject malicious code into legitimate software updates, potentially affecting a wide range of organizations relying on the targeted software. While specific affected software versions and exploits in the wild have not been detailed, the high severity rating indicates significant risk. European organizations could face data breaches, operational disruptions, and reputational damage if targeted. Mitigation requires rigorous supply-chain security practices, including verifying update authenticity and monitoring for anomalous update behavior. Countries with strong software development sectors and critical infrastructure relying on third-party software are at higher risk. Given the attack complexity and potential widespread impact, the threat is assessed as high severity. Defenders should prioritize supply-chain security controls and incident readiness to mitigate this evolving threat.
The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.
A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories, unpacks components, and generates new APK files before silently installing the malware. BTMob grants extensive device access, enabling credential theft and surveillance. UASecurity Miner focuses on persistence and remote control. The attack chain involves social engineering, APK generation, third-party packer services, and multiple command and control endpoints, reflecting a growing trend in modular Android threats.
RONINGLOADER is a sophisticated multi-stage malware loader used by the DragonBreath APT group to deploy an updated variant of the gh0st RAT. It begins infection via trojanized NSIS installers disguised as legitimate software and employs advanced evasion techniques including signed driver abuse, thread-pool injection, and Protected Process Light (PPL) exploitation to disable Microsoft Defender. The loader terminates antivirus processes, applies custom Windows Defender Application Control (WDAC) policies, and injects payloads into trusted system processes to avoid detection. This campaign targets Chinese EDR tools but demonstrates advanced tactics that could be adapted elsewhere. The malware’s complexity and stealth capabilities pose a medium severity threat, with potential impacts on confidentiality and integrity. European organizations using Windows environments with Microsoft Defender could be at risk, especially those in critical infrastructure and government sectors. Mitigation requires tailored detection of abnormal driver behavior, WDAC policy monitoring, and restricting installation of unsigned drivers. Countries with high adoption of Microsoft Defender and strategic geopolitical interest in China-related espionage are most likely affected.
'The Gentlemen' ransomware group, active since July 2025, operates a Ransomware-as-a-Service (RaaS) platform that employs advanced dual-extortion tactics by encrypting data and exfiltrating sensitive information to coerce ransom payments. Their ransomware targets Windows, Linux, and ESXi platforms, encrypting both local and network-shared drives using strong cryptographic algorithms XChaCha20 and Curve25519. Recent updates include automatic self-restart, run-on-boot persistence, configurable encryption speeds, and attack methods, enhancing their operational resilience and adaptability. The group has publicly disclosed 47 victims within two months, indicating rapid propagation and impact. The malware leverages multiple MITRE ATT&CK techniques such as persistence (T1547.001), data encryption (T1486), and network share discovery (T1135). No known exploits or CVEs are associated yet, but the threat is significant due to its multi-platform support and dual-extortion approach. European organizations with mixed OS environments and ESXi virtualization are at particular risk. Mitigation requires tailored detection of persistence mechanisms, network segmentation, and robust incident response plans. Countries with high adoption of VMware ESXi and diverse enterprise IT infrastructures, such as Germany, France, and the UK, are likely most affected.
The SupaPwn report details a security research exercise involving penetration testing activities targeting Supabase, a popular backend-as-a-service platform. The activity involved ethical hacking efforts to identify and help remediate security weaknesses within Supabase's infrastructure. While the report is categorized as security news, it lacks detailed technical vulnerability disclosures or exploit information. No known exploits are currently active in the wild, and the discussion level on Reddit is minimal, indicating limited public technical details. The severity is assessed as medium, reflecting the responsible disclosure nature and absence of active exploitation. European organizations using Supabase or similar backend services should be aware of potential risks but are not facing immediate threats. Mitigation should focus on applying any forthcoming patches from Supabase, conducting internal security reviews, and monitoring for updates. Countries with significant cloud adoption and developer communities using Supabase, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the lack of detailed exploit data and the ethical context, the suggested severity is medium. Defenders should monitor official Supabase communications for patches and maintain robust cloud security hygiene.
This post describes a method to detect BGP hijacking events by comparing BGP route announcements against authoritative IP/ASN mappings from IRR databases. The approach involves crawling live BGP stream data and flagging discrepancies where the originating ASN differs from the registered ASN in IRR data. While this is a detection technique rather than a direct threat or vulnerability, BGP hijacking itself poses significant risks to network confidentiality, integrity, and availability. European organizations relying on BGP for internet routing could be impacted by such attacks, especially critical infrastructure and large ISPs. The method described could help defenders identify suspicious route announcements quickly. However, the post is more of a community-shared detection approach than a report of an active exploit or vulnerability. Mitigation involves deploying real-time BGP monitoring, validating route origins with RPKI, and collaborating with regional internet registries. Countries with large internet exchange points and critical network infrastructure, such as Germany, the Netherlands, France, and the UK, are most likely to be affected by BGP hijacks. Given the nature of the content, the severity of the underlying threat (BGP hijacking) is high due to potential widespread impact and ease of exploitation by motivated attackers.
ShadowRay attacks target Ray clusters by compromising them to deploy unauthorized cryptocurrency mining operations. These attacks exploit vulnerabilities or misconfigurations in Ray cluster environments, converting legitimate compute resources into crypto miners, which leads to resource exhaustion and degraded performance. The threat is recent and has been reported by credible sources but currently lacks known exploits in the wild. European organizations using Ray clusters for distributed computing or AI workloads are at risk of operational disruption and increased costs due to unauthorized resource usage. Mitigation requires securing cluster access, monitoring for anomalous mining activity, and applying strict resource usage policies. Countries with significant cloud and AI infrastructure adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the high impact on availability and resource integrity, ease of exploitation through misconfiguration, and no need for user interaction, the threat severity is assessed as high. Defenders should prioritize immediate cluster security audits and implement continuous monitoring to detect and prevent such crypto-mining compromises.
This threat analysis highlights how certain legitimate Python packages can be repurposed by attackers to build surveillance and spyware tools. These packages enable capabilities such as keylogging, screen capture, webcam access, and browser data extraction. The write-up emphasizes the ease with which these libraries can be misused to create full-scope monitoring malware without requiring vulnerabilities in the packages themselves. While no direct exploits or vulnerabilities are reported, the potential for abuse exists due to the functionality these packages provide. The threat is categorized as medium severity given the potential impact on confidentiality and privacy, combined with the ease of misuse by attackers. European organizations using Python in development or automation environments could be targeted for espionage or data theft. Mitigations focus on developer awareness, supply chain security, and monitoring for suspicious use of these packages. Countries with strong software development sectors and critical infrastructure relying on Python are most likely to be affected. This analysis is based on a recent audit-style report shared on Reddit’s NetSec community and does not describe an active exploit campaign.
A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.
Cloudflare experienced a global network outage impacting its services worldwide. The outage disrupted Cloudflare's network infrastructure, affecting many dependent websites and services. Although no specific vulnerability or exploit was reported, the incident highlights the risks associated with reliance on major cloud and CDN providers. The outage caused availability issues but did not indicate a breach or compromise of confidentiality or integrity. European organizations relying on Cloudflare for DNS, CDN, or security services may have faced service disruptions. No known exploits or malicious activity were linked to this event. Mitigation focuses on improving resilience through multi-provider strategies and robust incident response plans. Countries with high Cloudflare adoption and critical internet infrastructure are most likely affected. The severity is assessed as high due to the broad impact on availability and the critical nature of Cloudflare's services. Defenders should prioritize continuity planning and monitoring for similar future incidents.
The Tycoon 2FA Phishing Platform represents a sophisticated phishing framework designed to bypass legacy multi-factor authentication (MFA) methods by intercepting and relaying two-factor authentication tokens in real time. This threat undermines the security assurances of traditional MFA implementations, particularly those relying on SMS or time-based one-time passwords (TOTP). European organizations using legacy MFA solutions are at risk of credential compromise and unauthorized access, potentially leading to data breaches and operational disruptions. The platform exploits user interaction through phishing, requiring victims to enter credentials and 2FA codes on fraudulent sites. Mitigation requires adopting modern MFA methods resistant to phishing, such as hardware security keys (FIDO2/WebAuthn), continuous monitoring for phishing campaigns, and user training focused on recognizing sophisticated phishing attempts. Countries with high adoption of legacy MFA and significant digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the high impact on confidentiality and integrity, ease of exploitation via phishing, and broad scope of affected systems, the threat severity is assessed as high. Defenders must prioritize upgrading MFA solutions and enhancing phishing detection capabilities to mitigate this evolving threat.
Major online services such as ChatGPT, X, and Shopify were disrupted in a global Cloudflare outage on Nov.18th, as well as transit and city services. The post Cloudflare Outage Not Caused by Cyberattack appeared first on SecurityWeek .
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Britain’s domestic intelligence agency warned that Chinese nationals were ”using LinkedIn profiles to conduct outreach at scale” on behalf of the Chinese Ministry of State Security. The post MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn appeared first on SecurityWeek .
ShadowRay 2.0 is an active global cyber campaign that hijacks Ray AI infrastructure to create a self-propagating botnet. The attackers exploit AI systems to turn them against themselves, leveraging the compromised AI nodes to expand the botnet autonomously. This campaign is currently ongoing and has been reported by Oligo Security with limited public technical details. Although no known exploits are confirmed in the wild, the campaign's medium severity rating reflects its potential to disrupt AI-based services and infrastructure. European organizations using Ray AI infrastructure or related AI platforms could face risks of service disruption, data compromise, or being unwitting participants in botnet activities. Mitigations require proactive monitoring of AI infrastructure, network segmentation, and rapid incident response capabilities. Countries with significant AI technology adoption and critical infrastructure relying on AI are more likely to be targeted. Given the campaign's self-propagating nature and AI focus, the threat severity is assessed as high due to potential widespread impact and complexity of mitigation.
The Inc Ransom group has taken credit for the hack, claiming to have stolen several terabytes of data. The post Pennsylvania Attorney General Confirms Data Breach After Ransomware Attack appeared first on SecurityWeek .
Hackers accessed a database containing information about alumni, donors, faculty, students, parents, and other individuals. The post Princeton University Data Breach Impacts Alumni, Students, Employees appeared first on SecurityWeek .
