Threats affecting Sweden

The Kraken ransomware group, originating from the HelloKitty cartel, conducts sophisticated big-game hunting and double extortion attacks targeting Windows, Linux, and VMware ESXi systems. They exploit SMB vulnerabilities for initial access and use tools like Cloudflared and SSHFS for persistence and data exfiltration. Kraken ransomware features advanced capabilities including multi-threaded encryption, encryption benchmarking, anti-analysis techniques, and self-deletion to evade detection. The group operates a public data leak site and has launched an underground forum called 'The Last Haven Board' to facilitate their activities. They target a wide range of file types, including SQL databases and network shares, increasing their impact on enterprise environments. Although no known exploits are currently reported in the wild, the threat is medium severity due to its cross-platform nature and complex attack techniques. European organizations, especially those with VMware ESXi and SMB-exposed systems, face significant risk. Denmark is specifically noted as affected, with other European countries likely at risk based on market penetration and strategic targets. Mitigation requires targeted patching of SMB vulnerabilities, network segmentation, monitoring for Cloudflared and SSHFS usage, and robust incident response plans.

Malware#cross-platform#data leakDenmark+7

Researchers have demonstrated how malicious extensions can create fake AI sidebars in the Comet and Atlas browsers, and spoof the models' responses. We explain how to avoid becoming a victim.

AnalysisGermanyFrance+5

A November 2025 Homeland Security brief highlights emerging cyber threats from state actors including China, Russia, Iran, and North Korea. Among these threats is a novel malware strain that uniquely interacts with large language models (LLMs). Although detailed technical specifics are limited, this represents an evolution in malware capabilities leveraging AI technologies. The threat is currently assessed as medium severity with no known exploits in the wild. European organizations could face risks related to data confidentiality and operational integrity, especially those integrating AI or LLM-based systems. Mitigation requires enhanced monitoring of AI-related endpoints, strict access controls, and collaboration with threat intelligence communities. Countries with significant AI adoption and strategic geopolitical relevance, such as Germany, France, and the UK, are more likely to be targeted. Given the novelty, ease of exploitation is uncertain but the potential impact on confidentiality and integrity justifies a medium severity rating. Defenders should prioritize awareness of AI-targeted malware and prepare incident response plans accordingly.

Malware#infosecnews#redditGermany+4

Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .

AnalysisGermanyFrance+9

A large-scale spam campaign involving tens of thousands of malicious NPM packages has been identified, distributing a self-replicating worm. The campaign appears to be orchestrated by an Indonesian threat actor, inferred from code comments and the random naming of packages. These malicious packages propagate by infecting other packages or systems, potentially compromising software supply chains. Although no known exploits in the wild have been reported yet, the widespread nature of the packages poses a significant risk. The threat primarily targets the JavaScript ecosystem, specifically developers and organizations relying on NPM packages. European organizations using NPM packages in their development workflows could face supply chain contamination, leading to data breaches, system compromise, or further malware propagation. Mitigation requires proactive package vetting, dependency auditing, and restricting automated package installations. Countries with strong software development sectors and high NPM usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium severity and the potential for widespread impact without requiring user interaction, the threat should be taken seriously and addressed promptly.

MalwareGermanyFrance+5

CVE-2025-12765 is a high-severity vulnerability affecting pgAdmin 4 versions up to 9.9, specifically in its LDAP authentication mechanism. The flaw allows an attacker to bypass TLS certificate verification, enabling potential man-in-the-middle attacks during LDAP authentication. This vulnerability does not require authentication or user interaction and can be exploited remotely over the network. While it impacts confidentiality by potentially exposing sensitive authentication credentials, it does not affect integrity or availability. No known exploits are currently reported in the wild. European organizations using pgAdmin 4 with LDAP authentication are at risk, especially those in countries with significant PostgreSQL adoption and critical infrastructure relying on secure database management. Mitigation involves applying patches once available, enforcing strict TLS validation policies, and considering alternative authentication methods until patched. Countries like Germany, France, the UK, the Netherlands, and Sweden are likely most affected due to their extensive use of PostgreSQL and related tools in enterprise and government sectors.

EPSS 0.2%Vulnerabilitypgadmin.orgCWE-295Germany+4

The UK National Health Service (NHS) is investigating claims of a hack involving Oracle E-Business Suite (EBS), with hackers naming over 40 alleged victims. The incident is under scrutiny by the NHS and the UK National Cyber Security Centre. While specific technical details and affected versions are not disclosed, the attack reportedly targets Oracle EBS, a widely used enterprise resource planning platform. No known exploits are currently confirmed in the wild, and the severity is assessed as medium. This situation highlights potential risks to sensitive healthcare and administrative data managed through Oracle EBS systems. European organizations using Oracle EBS, especially in healthcare and critical infrastructure sectors, should be vigilant. Immediate mitigation steps include enhanced monitoring, access control reviews, and collaboration with cybersecurity authorities. The UK and other European countries with significant Oracle EBS deployments are most likely to be impacted. Given the lack of detailed exploit information, the suggested severity is medium due to potential data confidentiality and integrity risks without confirmed active exploitation.

NewsGermanyFrance+5

Synnovis, a pathology services provider, suffered a ransomware attack that disrupted operations at several London hospitals and resulted in the theft of patient information. The attack caused significant operational interruptions in healthcare delivery, impacting critical diagnostic services. Although no specific vulnerability or exploit details have been disclosed, the incident highlights the risk ransomware poses to healthcare infrastructure. There is no evidence of known exploits in the wild or available patches, and the attack appears targeted at healthcare service providers. The breach of patient data raises concerns about confidentiality and regulatory compliance under GDPR. European healthcare organizations should prioritize securing their IT environments to prevent similar disruptions. Mitigation should focus on network segmentation, robust backup strategies, incident response readiness, and enhanced monitoring for ransomware indicators. Given the critical nature of healthcare services and the sensitivity of patient data, the suggested severity of this threat is high. The United Kingdom is the most directly affected country, with potential risks extending to other European nations with similar healthcare service providers and infrastructure. Defenders must be vigilant about ransomware threats targeting healthcare and ensure comprehensive cybersecurity hygiene to mitigate impact.

MalwareGermanyFrance+6

A large-scale spam attack has flooded the npm registry with over 67,000 fake packages, mimicking a worm-like propagation pattern. These counterfeit packages may contain malicious code or be used to distribute malware, posing significant risks to developers and organizations relying on npm for software dependencies. Although no known exploits in the wild have been reported yet, the sheer volume and automated nature of the attack increase the likelihood of accidental inclusion of malicious packages in projects. European organizations using npm extensively for development and production environments face risks including supply chain compromise, data breaches, and service disruptions. Mitigation requires enhanced package vetting, use of trusted package sources, dependency auditing, and implementation of strict CI/CD pipeline controls. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the potential for widespread impact on confidentiality, integrity, and availability, and the ease of exploitation via automated package installation, this threat is assessed as high severity. Defenders must prioritize monitoring npm package sources and applying automated security tools to detect and block fake or malicious packages.

Malware#infosecnews#redditGermany+6

A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.

News#infosecnews#redditGermany+9

SysLeaks for Attackers is a newly launched data leak search service aimed at penetration testers and red teamers, providing access to leaked usernames, email addresses, plaintext passwords, and platform information tied to domain names. The service requires users to register with company emails from offensive security firms and excludes leaks from the last 14 days to give affected companies a grace period. Although it is in beta with usage limits, it aggregates leaked credentials that could be exploited for credential stuffing, phishing, or lateral movement. While no direct exploits or vulnerabilities are reported, the availability of such a service increases the risk of targeted attacks using real leaked credentials. European organizations could be impacted if their domains appear in the database, especially in countries with high adoption of targeted sectors or where offensive security firms operate extensively. Mitigation should focus on enhanced credential hygiene, monitoring for leaked credentials, and restricting access to sensitive systems. Given the nature of the service and its potential to facilitate attacks, the suggested severity is medium.

Breach#netsec#redditGermany+6

When I&#x27m teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[2]. Let&#x27s have a look at the infection path.

NewsGermanyFrance+6

ThreatFox IOCs for 2025-11-13

Indicator#type:osint#tlp:whiteGermany+9

This report discusses the manual creation of . NET serialization gadgets, which are components that can be exploited in deserialization attacks to execute arbitrary code. While no specific vulnerabilities or exploits are currently known in the wild, the technique highlights potential risks in . NET applications that use insecure deserialization. The threat is of medium severity due to the complexity of exploitation and the need for specific conditions. European organizations using . NET frameworks in their applications should be aware of this emerging technique and review their deserialization practices. Mitigations include avoiding deserialization of untrusted data, implementing strict input validation, and employing secure coding practices. Countries with significant . NET development ecosystems and critical infrastructure relying on .

News#netsec#redditGermany+8

Introduction

MalwareGermanyFrance+8

Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.

Phishing#infosecnews#redditGermany+9

DarkComet RAT, a well-known remote access trojan, has resurfaced disguised as fake Bitcoin wallet applications. This phishing threat attempts to trick users into installing malicious software under the guise of cryptocurrency management tools. Once installed, the RAT can enable attackers to gain unauthorized access to victims' systems, potentially compromising sensitive data and system integrity. The threat is currently reported with minimal discussion and no known exploits in the wild, but its reappearance signals a renewed risk for users involved in cryptocurrency activities. European organizations dealing with cryptocurrency or financial services could be targeted due to the lure of Bitcoin wallets. Mitigation requires heightened user awareness, verification of software sources, and robust endpoint security measures. Countries with significant cryptocurrency adoption and financial sectors are more likely to be affected. Given the ease of social engineering and potential for significant data compromise, the threat severity is assessed as high.

Phishing#infosecnews#redditGermany+5

NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .

NewsGermanyFrance+8

Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.

News#infosecnews#redditGermany+9

Google is targeting the threat group known as Smishing Triad, which used over 194,000 malicious domains in a campaign. The post Google Sues Chinese Cybercriminals Behind ‘Lighthouse’ Phishing Kit appeared first on SecurityWeek .

PhishingGermanyFrance+5