Threats affecting Sweden

Open VSX, a public registry for Visual Studio Code extensions, recently rotated access tokens following a supply-chain malware attack. The attack involved malicious actors exploiting compromised tokens to inject malware into extensions distributed via the Open VSX platform. This supply-chain compromise poses significant risks as infected extensions can propagate malware to end users and organizations relying on these extensions. Although no known exploits are currently active in the wild, the potential for widespread impact remains high due to the trust placed in Open VSX as a source for extensions. European organizations using Open VSX-hosted extensions may face risks to confidentiality, integrity, and availability if infected extensions are installed. Immediate mitigation involves verifying extension sources, monitoring for unusual token activity, and applying any updates or token rotations issued by Open VSX. Countries with strong developer communities and high adoption of Visual Studio Code, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation via trusted extension updates and the broad scope of affected users, this threat is assessed as high severity. Defenders should prioritize auditing extension usage and enhancing supply-chain security measures to mitigate potential impacts.

Malware#infosecnews#redditGermany+5

A hacker claims to have stolen 1.2 million donor records from the University of Pennsylvania in a significant data breach. The breach reportedly involves sensitive donor information, potentially including personal and financial data. Although technical details about the attack vector or exploited vulnerabilities are not provided, the breach poses a high risk to confidentiality and privacy. There is no evidence of known exploits in the wild or patches available yet. European organizations should be aware of the risks related to third-party data handling and donor information security. Mitigation should focus on verifying vendor security, enhancing monitoring for unusual access, and preparing incident response plans. Countries with strong academic and philanthropic sectors, such as the UK, Germany, and France, may be more impacted due to similar institutional profiles. The severity is assessed as high given the scale and sensitivity of the data involved, despite limited technical details. Defenders should prioritize data protection, breach detection, and communication readiness.

Breach#infosecnews#redditGermany+4

North Korean threat actors Kimsuky and Lazarus have deployed new sophisticated malware toolsets named HttpTroy and an upgraded BLINDINGCAN variant. HttpTroy is a backdoor delivered via a VPN invoice-themed attack, involving a dropper and loader (MemLoad), granting extensive system control. Lazarus's upgraded BLINDINGCAN is delivered through a new Comebacker malware variant, targeting victims in Canada. Both toolsets use advanced obfuscation, stealth techniques, and layered evasion to avoid detection. These attacks highlight DPRK's evolving cyber espionage capabilities. Although currently observed targeting South Korea and Canada, European organizations could be at risk due to geopolitical tensions and similar attack methodologies. No known exploits in the wild have been reported yet. Mitigation requires targeted detection of these toolsets, network monitoring for associated indicators, and enhanced endpoint defenses. The threat is assessed as medium severity due to its espionage focus, stealth, and complexity, but limited current scope and no public CVSS score.

Malware#comebacker#remote access toolGermany+9

The Rhysida ransomware gang, previously known as Vice Society, is conducting a sophisticated malvertising campaign using Bing ads to distribute OysterLoader malware. This malware acts as an initial access tool, establishing persistence and enabling further payload deployment, including ransomware. The gang employs code-signing certificates, including Microsoft Trusted Signing, to evade detection and increase trustworthiness of their malware. Their activity has notably increased in 2025, with over 40 certificates tracked compared to 7 in 2024. They also utilize Latrodectus malware for initial access. The campaign leverages legitimate services and advanced evasion techniques, highlighting significant resource investment and operational maturity. This threat poses a medium severity risk but can lead to severe consequences if ransomware is deployed. European organizations should be vigilant against malvertising campaigns and suspicious software downloads, especially those impersonating popular software. Mitigation requires enhanced monitoring of code-signed binaries, user awareness, and blocking malicious ad traffic.

Malware#latrodectus#initial accessGermany+9

For the latest discoveries in cyber research for the week of 3rd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Everest ransomware group has claimed responsibility for a series of attacks impacting AT&T, Dublin Airport, and Air Arabia. The ransomware gang exfiltrated sensitive data including 576,000 AT&T applicant records, 1.5 million […] The post 3rd November – Threat Intelligence Report appeared first on Check Point Research .

AnalysisIrelandSweden+6

This entry is a brief writeup providing guidance on what to check when encountering Firebase during a penetration test. It is sourced from a blog post linked on Reddit's NetSec community and does not describe a specific vulnerability or exploit. The content serves as security advice rather than reporting a new threat or vulnerability. There are no affected versions, no known exploits in the wild, and minimal technical details beyond the reference to Firebase security fundamentals. As such, it does not represent an immediate security threat but rather general security awareness information.

News#netsec#redditGermany+6

A new security threat involves stealing Microsoft Teams application cookies using a Buffer Overflow (BOF) technique, as demonstrated by a proof-of-concept available on GitHub. This technique targets session cookies that could allow attackers to hijack user sessions without needing credentials. Although no specific affected versions or patches are identified, the exploit could compromise confidentiality and integrity of communications within Teams. The threat currently has minimal discussion and no known exploits in the wild, but its potential impact on enterprise collaboration security is significant. European organizations relying heavily on Microsoft Teams for communication and collaboration could face risks of unauthorized access and data leakage. Mitigation requires advanced endpoint protection, monitoring for suspicious activity, and restricting access to sensitive session data. Countries with high Microsoft Teams adoption and critical infrastructure sectors are more likely to be targeted. Given the ease of exploitation via a BOF and the potential for session hijacking without user interaction, the threat severity is assessed as high. Defenders should prioritize detection and containment strategies to prevent exploitation and protect session integrity.

News#netsec#redditGermany+6

The Kurdish hacktivist group Hezi Rash has reportedly conducted approximately 350 distributed denial-of-service (DDoS) attacks over a two-month period. These attacks leverage botnet capabilities to overwhelm targeted networks and services, causing service disruptions. While no specific affected software versions or exploits are identified, the volume and persistence of attacks indicate a sustained campaign likely aimed at political or ideological targets. The threat is assessed as medium severity due to the disruption potential but lacks evidence of data breaches or advanced exploitation. European organizations, especially those with high-profile online services or political relevance, could face availability impacts. Mitigation requires enhanced DDoS detection and response capabilities, including traffic filtering, rate limiting, and collaboration with ISPs and DDoS mitigation providers. Countries with significant Kurdish populations or geopolitical interest in Kurdish issues, such as Germany, France, and the UK, may be more likely targets. Given the ease of launching DDoS attacks via botnets and the broad scope of potential targets, vigilance is advised. No authentication or user interaction is required for the attacks, but the impact is limited to availability disruptions without direct data compromise.

Botnet#infosecnews#redditGermany+4

VulScan-MCP is an open-source Visual Studio Code extension designed to scan project dependencies for known CVEs using NVD and OSV databases. It integrates with VS Code and GitHub Copilot, allowing developers to query vulnerability status of their manifest files. The tool only reports confirmed CVEs, avoiding noise from deprecated or outdated packages, and provides remediation guidance without automatic patching. While it enhances visibility into dependency vulnerabilities, it is not itself a security threat or vulnerability. European organizations can benefit from improved dependency security management, but the tool's effectiveness depends on developer adoption and integration into secure development workflows. Countries with strong software development sectors and high VS Code usage are most likely to be impacted positively. Given this is a security tool rather than a threat, the severity assessment is not applicable. Defenders should consider integrating such tools to proactively identify and remediate dependency risks.

News#netsec#redditGermany+7

A large-scale attack infrastructure dubbed TruffleNet has been identified, built around the open-source tool TruffleHog. This infrastructure is used to systematically test compromised credentials and perform reconnaissance across AWS environments. The campaign involves over 800 unique hosts across 57 distinct Class C networks, characterized by consistent configurations and the use of Portainer. Alongside TruffleNet, adversaries are exploiting Amazon Simple Email Service (SES) to facilitate Business Email Compromise (BEC) campaigns. The attackers create email identities using compromised WordPress sites and conduct aggressive cloud reconnaissance. This activity highlights the evolving tactics of threat actors in exploiting cloud infrastructure at scale, combining credential theft, reconnaissance automation, and SES abuse to conduct high-volume fraud with minimal detection.

Malware#identity compromise#trufflehogGermany+9

A recent security breach at the University of Pennsylvania has resulted in attackers sending 'We got hacked' emails threatening to leak sensitive university data. The incident was reported on Reddit's InfoSecNews and covered by BleepingComputer, highlighting the potential exposure of confidential information. Although no specific technical details or exploited vulnerabilities have been disclosed, the breach indicates unauthorized access to university systems or data repositories. There is no evidence of known exploits in the wild related to this incident, and the discussion level remains minimal. The threat poses a high risk due to potential data leakage impacting confidentiality and institutional reputation. European organizations, especially academic institutions, should be vigilant against similar targeted attacks. Mitigation should focus on enhancing email security, monitoring for phishing and data exfiltration attempts, and conducting thorough forensic investigations. Countries with strong academic ties and collaborations with U. S.universities, such as the UK, Germany, and France, may be more likely to face related threats.

Breach#infosecnews#redditGermany+5

ThreatFox IOCs for 2025-11-01

Indicator#type:osint#tlp:whiteGermany+5

Open VSX fully contained the GlassWorm attacks and says it was not a self-replicating worm in the traditional sense. The post Open VSX Downplays Impact From GlassWorm Campaign appeared first on SecurityWeek .

CampaignGermanyFrance+4

A family of four new remote access trojans (RATs) operated by the STD Group has been identified, leveraging Discord as their command and control (C2) channel. These RATs—Minecraft RAT, UwUdisRAT, STD RAT, and Propionanilide RAT—are written in C++ and use a ROT23 cipher to obfuscate Discord bot tokens for C2 communication. The malware has evolved from single payloads to using packers, complicating detection efforts. The RATs enable attackers to perform reconnaissance, execute commands, and maintain persistence on infected systems. Detection is supported by YARA rules and file indicators provided in the analysis. While no known exploits in the wild have been reported yet, the use of Discord for C2 is notable for evading traditional network defenses. European organizations, especially those with high Discord usage or gaming-related sectors, could be targeted. Mitigation requires enhanced monitoring of Discord traffic, endpoint detection tuned for these RAT behaviors, and restricting unauthorized Discord bot usage within corporate environments.

Malware#std rat#propionanilideGermany+7

Android/BankBot-YNRK is a sophisticated mobile banking Trojan targeting Android devices, specifically aiming at financial and cryptocurrency applications. It abuses Android accessibility services to gain elevated privileges, enabling it to automate UI interactions and extract sensitive user data. The malware can masquerade as legitimate apps, suppress audio notifications to avoid user detection, and perform unauthorized operations such as credential theft and fraudulent transactions. It maintains persistence on infected devices and communicates with command-and-control (C2) servers to receive remote commands and exfiltrate data. Although no known exploits are reported in the wild, the trojan represents a significant threat to Android users, especially those engaged in mobile banking and cryptocurrency activities. The malware’s complexity and stealth capabilities increase the risk of financial loss and privacy breaches. European organizations with employees or customers using Android banking or crypto apps are at risk, particularly in countries with high Android market share and digital banking adoption. Mitigation requires targeted measures including restricting accessibility service permissions, monitoring network traffic for suspicious domains, and educating users on app installation risks.

Malware#overlay attacks#cryptocurrency theftGermany+7

The Eclipse Foundation revoked leaked Open VSX tokens after their exposure was discovered by Wiz. These tokens could have allowed unauthorized access to Open VSX services, potentially enabling malicious actors to manipulate or disrupt the open-source extension registry. Although no known exploits are currently active in the wild, the incident highlights risks related to leaked credentials in software supply chains. European organizations relying on Open VSX for development or distribution of extensions should be aware of the potential for unauthorized access and take immediate steps to verify token security. The threat is considered high severity due to the sensitive nature of the tokens and the potential impact on software integrity and availability. Mitigation involves auditing token usage, rotating credentials, and enhancing monitoring for suspicious activity. Countries with strong open-source ecosystems and significant software development sectors, such as Germany, France, and the Netherlands, are likely to be most affected. Vigilance is required to prevent exploitation and maintain trust in open-source infrastructure.

News#infosecnews#redditGermany+5

The Akira ransomware group claims to have stolen 23GB of data from Apache OpenOffice, a widely used open-source office productivity suite. Although no specific vulnerabilities or exploits have been detailed, the incident highlights a targeted ransomware attack involving data exfiltration prior to encryption. There is no evidence of known exploits in the wild or affected software versions disclosed. The attack appears to be recent and reported via Reddit and cybersecurity news sources, but with minimal technical discussion or confirmation. European organizations using Apache OpenOffice or related infrastructure could face risks of data compromise and operational disruption. Mitigation requires enhanced network segmentation, monitoring for unusual data transfers, and robust incident response plans. Countries with significant open-source software adoption and critical infrastructure relying on Apache OpenOffice are more likely to be impacted. Given the medium severity rating and lack of detailed exploit information, the threat is assessed as medium severity. Defenders should prioritize detection of ransomware behaviors and data exfiltration attempts while maintaining updated backups and access controls.

Malware#infosecnews#redditGermany+7

Malicious applications impersonating popular platforms such as ChatGPT, DALL·E, and WhatsApp have been identified targeting users primarily in the United States. These apps are embedded with spyware designed to covertly collect user data and potentially compromise device security. Although currently focused on US users, the threat highlights the risk of fake or malicious apps exploiting trusted brand names to distribute spyware. There is no evidence of known exploits in the wild beyond these apps, and technical details remain limited. The threat is assessed as medium severity due to the potential privacy impact and ease of distribution via app stores or third-party sources. European organizations should be aware of the risk of similar campaigns targeting their users, especially given the popularity of these platforms. Mitigation requires vigilant app vetting, user education on downloading official apps only, and deployment of advanced endpoint protection capable of detecting spyware behaviors. Countries with high usage of these platforms and strong digital economies are more likely to be targeted if the campaign expands beyond the US. Overall, this threat underscores the ongoing challenge of supply chain and app impersonation attacks in cybersecurity.

News#infosecnews#redditGermany+6

A nation-state threat actor conducted a year-long cyber intrusion targeting Ribbon Communications, a major US telecom equipment provider. The attack involved persistent unauthorized access, likely aiming to compromise sensitive telecom infrastructure and intellectual property. Although specific technical details and exploited vulnerabilities are not disclosed, the breach underscores risks to telecom supply chains globally. European organizations relying on Ribbon Communications' products could face indirect impacts through compromised equipment or disrupted services. Mitigation requires enhanced monitoring of supply chain security, rigorous network segmentation, and proactive threat hunting focused on telecom infrastructure. Countries with significant telecom sectors and Ribbon Communications' market presence, such as Germany, France, and the UK, are most at risk. Given the prolonged nature of the attack and potential for espionage or disruption, the threat severity is assessed as high. Defenders should prioritize supply chain risk assessments and implement strict access controls to mitigate similar threats.

News#infosecnews#redditGermany+6

A security research campaign uncovered over 2,000 medium vulnerabilities, including 98 highly critical issues, across publicly exposed applications built on vibe-coded platforms integrating Lovable front-ends with Supabase backends. The research revealed 400+ exposed secrets and 175 instances of personally identifiable information (PII), including sensitive data such as bank details and medical information. Notable vulnerabilities include Broken Object Level Authorization (BOLA), Server-Side Request Forgery (SSRF), and zero-click account takeover exploits. The threat arises from the architectural integration where sensitive tokens and API keys are exposed in frontend bundles, increasing the attack surface. Although no known exploits are currently in the wild, the critical severity and volume of findings indicate a significant risk. European organizations using these platforms or similar architectures face risks of data breaches, unauthorized access, and service disruption. Mitigation requires targeted scanning for exposed secrets in frontend code, strict API authorization enforcement, and comprehensive secrets management. Countries with high adoption of Supabase and vibe-coded platforms, such as the UK, Germany, France, and the Netherlands, are most likely affected. Given the ease of exploitation and sensitive data exposure without authentication, the suggested severity is critical.

Campaign#netsec#redditGermany+5