Denmark and Norway are investigating a security flaw found in Yutong buses amid growing concerns about technology vulnerabilities in public transportation. The flaw reportedly affects Yutong buses, a widely used brand in several European countries, raising fears about potential exploitation that could impact passenger safety and operational integrity. Although no known exploits are currently active in the wild, the medium severity rating suggests a tangible risk that requires attention. The investigation highlights the increasing cybersecurity risks in connected vehicle systems, especially in critical public infrastructure. European organizations operating or regulating public transport systems using Yutong buses should be vigilant and prioritize security assessments. Mitigation should focus on thorough vulnerability assessments, patch management, and network segmentation to reduce attack surfaces. Countries with significant Yutong bus deployments and strategic public transport infrastructure, such as Denmark, Norway, Germany, and the UK, are most likely to be affected. Given the potential impact on safety and service availability, the threat severity is assessed as medium. Immediate proactive measures can prevent exploitation and ensure public safety and trust in transportation systems.
The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.
The LANDFALL spyware campaign targets Samsung Galaxy phones by delivering malicious images via WhatsApp. These images exploit vulnerabilities in the device's image processing to install spyware without user interaction. The spyware can exfiltrate sensitive data, monitor communications, and compromise device integrity. Although no known exploits are currently in the wild, the attack vector via a popular messaging app and widely used devices poses a significant risk. European organizations using Samsung Galaxy phones, especially those with high-value data, could be targeted. Mitigation requires patching vulnerable devices, restricting image processing from untrusted sources, and enhancing mobile threat detection. Countries with high Samsung market share and strategic geopolitical relevance are more likely to be affected. Given the medium severity and complexity of exploitation, vigilance and proactive defense are essential for European defenders.
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
Wiz found the secrets and warned that they can expose training data, organizational structures, and private models. The post Many Forbes AI 50 Companies Leak Secrets on GitHub appeared first on SecurityWeek .
Today, I noticed scans using the username "FTP_3cx" showing up in our logs.3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty for this particular string. The 3CX software does not appear to run an FTP server, but it offers a feature to back up configurations to an FTP server [2]. The example user used in the documentation is "3cxftpuser", not "FTP_3cx". Additionally, the documentation notes that the FTP server can run on a different system from the 3CX software. For a backup, it would not make much sense to have it all run on the same system.
For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and potentially exposing sensitive communications between congressional offices and CBO […] The post 10th November – Threat Intelligence Report appeared first on Check Point Research .
OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications. The post Two New Web Application Risk Categories Added to OWASP Top 10 appeared first on SecurityWeek .
GlassWorm malware has been discovered embedded within three Visual Studio Code extensions that have collectively been installed thousands of times. This malware targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, GlassWorm can execute malicious activities potentially compromising confidentiality and integrity of affected systems. Although no known exploits are currently active in the wild, the high severity rating indicates significant risk if exploited. European organizations using these extensions are at risk, especially those in software development and IT sectors. Mitigation requires immediate auditing of installed VS Code extensions, removal of suspicious ones, and monitoring for unusual activity. Countries with high adoption of VS Code and strong software development industries, such as Germany, France, and the UK, are most likely to be affected. The threat is considered high severity due to the potential impact on sensitive development environments and ease of distribution via trusted extension marketplaces. Defenders should prioritize verifying extension authenticity and applying strict controls on extension installation policies.
Nine malicious NuGet packages have been identified that contain time-delayed payloads designed to disrupt databases and industrial systems. These packages, once integrated into software projects, activate their payloads after a delay, complicating detection and mitigation efforts. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential to impact critical infrastructure and data integrity. European organizations relying on NuGet packages in software development, especially those in industrial automation and database management sectors, should be vigilant. The delayed activation mechanism increases the risk of prolonged undetected presence, potentially causing significant operational disruption. Mitigation requires proactive package auditing, supply chain security enhancements, and monitoring for unusual system behaviors. Countries with strong industrial bases and extensive software development ecosystems, such as Germany, France, and the UK, are particularly at risk. Given the complexity and potential impact, the threat is assessed as medium severity. Immediate attention to supply chain security hygiene is recommended to prevent exploitation.
Three more VS Code extensions were infected last week and the malware has emerged in GitHub repositories as well. The post GlassWorm Malware Returns to Open VSX, Emerges on GitHub appeared first on SecurityWeek .
The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland. The post Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site appeared first on SecurityWeek .
A new Android remote data-wipe attack exploiting Google's Find Hub feature has been identified as part of the KONNI APT campaign. The attackers impersonated psychological counselors and human rights activists, distributing malware disguised as stress-relief programs via KakaoTalk messenger. They compromised Google accounts to track victims' locations and remotely wipe Android devices. The attack involved spear-phishing, prolonged reconnaissance, and abuse of legitimate management functions. Multiple RAT variants were deployed, including RemcosRAT, QuasarRAT, and RftRAT. The campaign utilized WordPress-based hosting and geographically distributed C2 servers to evade detection. This sophisticated attack demonstrates the evolving tactics of state-sponsored threat actors.
The Lazarus Group, a DPRK-linked threat actor, has launched a targeted espionage campaign against aerospace and defense sectors using a new variant of the Comebacker backdoor. The attack employs spear phishing with highly specific lure documents to deliver macro-based malware. The infection chain is multi-staged, featuring custom decryption algorithms and encrypted command-and-control communications, indicating advanced evasion techniques. The campaign infrastructure remains active, suggesting ongoing operations. This threat poses risks to confidentiality and integrity of sensitive defense-related information. European aerospace and defense organizations should enhance phishing defenses and monitor for indicators such as specific file hashes and suspicious domains. No CVSS score is assigned, but the threat is assessed as high severity due to its targeted nature, potential impact, and sophisticated malware. Countries with significant aerospace and defense industries and geopolitical interest in DPRK activities are most at risk. Immediate mitigation includes user training, macro restrictions, network monitoring, and threat intelligence sharing.
Australia mirrored the US’s recent sanctions against bankers, financial institutions, and others allegedly involved in laundering funds for North Korea. The post Australia Sanctions Hackers Supporting North Korea’s Weapons Program appeared first on SecurityWeek .
Recent reports highlight dangerous vulnerabilities in runC, the container runtime used by Docker, that could allow attackers to escape container isolation. Exploiting these flaws would enable malicious actors to break out of Docker containers and gain unauthorized access to the host system. Although no known exploits are currently in the wild, the high severity rating underscores the critical nature of these vulnerabilities. The threat primarily impacts environments running containerized applications using vulnerable versions of runC. European organizations relying heavily on Docker for cloud-native deployments and microservices architectures are at risk, especially those in countries with large tech sectors and cloud infrastructure. Mitigation requires prompt patching of runC once updates are released, restricting container privileges, and employing runtime security tools to detect anomalous behavior. Countries such as Germany, the United Kingdom, France, and the Netherlands are likely most affected due to their extensive use of container technologies and cloud services. Given the potential for complete host compromise without user interaction, the suggested severity is critical. Defenders should prioritize monitoring for updates from runC maintainers and prepare incident response plans for container breakout scenarios.
The GlassWorm malware has resurfaced on the OpenVSX marketplace with three new malicious Visual Studio Code extensions. These extensions are designed to infiltrate developer environments, potentially compromising source code confidentiality and integrity. GlassWorm is known for its stealthy behavior and ability to exfiltrate sensitive data from infected systems. Although no known exploits are currently active in the wild, the presence of these extensions on a popular open-source extension repository poses a significant risk. European organizations relying on VSCode and OpenVSX for development are at risk of supply chain attacks. The malware’s return highlights the ongoing threat of malicious code injection via trusted development tools. Mitigation requires strict extension vetting, monitoring network traffic for unusual activity, and restricting extension installation policies. Countries with large software development sectors and high adoption of VSCode and OpenVSX are most vulnerable. Given the malware’s potential impact on confidentiality and integrity, ease of exploitation via trusted extensions, and broad scope, the threat severity is assessed as high.
A China-linked hacking group has been conducting a long-term espionage campaign targeting a U. S.non-profit organization. The campaign involves persistent cyber intrusions aimed at gathering sensitive information over an extended period. While specific technical details and exploited vulnerabilities are not disclosed, the threat reflects ongoing state-sponsored cyber espionage activities. The campaign is assessed as medium severity due to its targeted nature and potential impact on confidentiality. European organizations with ties to U. S.non-profits or similar sectors should be vigilant. Mitigation requires enhanced monitoring, threat intelligence sharing, and strict access controls.
The 'Whisper Leak' attack, uncovered by Microsoft, is a novel side-channel threat that can infer AI chat topics from encrypted traffic. This attack does not decrypt the content but uses traffic analysis techniques to identify the subject matter of AI conversations despite encryption. It poses a high risk to confidentiality, especially for organizations relying on AI chat services for sensitive communications. While no known exploits are currently active in the wild, the potential for privacy breaches is significant. European organizations using AI chat platforms could face exposure of confidential discussion topics, impacting competitive advantage and regulatory compliance. Mitigation requires advanced traffic obfuscation and network monitoring tailored to detect such side-channel leaks. Countries with high AI adoption and strict data privacy regulations are most vulnerable. The attack is rated high severity due to its impact on confidentiality, ease of exploitation via passive network observation, and broad scope affecting encrypted AI chat traffic without requiring user interaction or authentication.
A free, open-source file scanner hosted on GitHub has been highlighted in InfoSec news due to potential remote code execution (RCE) risks. Although no specific affected versions or exploits in the wild are currently reported, the mention of RCE indicates a high-severity threat if vulnerabilities exist. The tool's open-source nature means vulnerabilities could be discovered or exploited by attackers, especially if the scanner processes untrusted files. European organizations using or evaluating this tool should be cautious and perform thorough security assessments before deployment. Mitigations include code review, sandboxing, and restricting file inputs. Countries with strong open-source adoption and critical infrastructure relying on file scanning tools are more likely to be impacted. Given the potential for RCE and lack of authentication requirements, the threat is assessed as high severity. Defenders must prioritize monitoring and validation when integrating such tools.
